From ee743f1d6153edeb268ebf95e7d5fad6785c6960 Mon Sep 17 00:00:00 2001 From: Gudmundur Haraldsson Date: Mon, 28 Feb 2022 12:22:43 +0000 Subject: [PATCH 1/6] Improve output escaping. --- auto-approval.php | 4 ++-- github-api.php | 4 ++-- reports.php | 4 +++- svg-scan.php | 2 +- 4 files changed, 8 insertions(+), 6 deletions(-) diff --git a/auto-approval.php b/auto-approval.php index 999ba2cc3..d2b9e21e8 100644 --- a/auto-approval.php +++ b/auto-approval.php @@ -147,7 +147,7 @@ function vipgoci_auto_approval_non_approval( 'file_name' => $approved_file, 'file_line' => 1, 'issue' => array( - 'message' => VIPGOCI_FILE_IS_APPROVED_MSG, + 'message' => vipgoci_output_html_escape( VIPGOCI_FILE_IS_APPROVED_MSG ), 'source' => 'VipgociInternal.Info.ApprovedHashesToHashesAPI', 'severity' => 1, 'fixable' => false, @@ -240,7 +240,7 @@ function vipgoci_auto_approval_non_approval( $options['repo-name'], (int) $pr_item->number, (int) $pr_item_review->id, - 'Dismissing obsolete review; not approved any longer', + vipgoci_output_html_escape('Dismissing obsolete review; not approved any longer'), $options['token'] ); } diff --git a/github-api.php b/github-api.php index 3f6f74e0c..fe4aeeb78 100644 --- a/github-api.php +++ b/github-api.php @@ -2225,8 +2225,8 @@ function vipgoci_github_pr_reviews_dismiss_with_non_active_comments( $options['repo-name'], $pr_number, $pr_review->id, - 'Dismissing review as all inline comments ' . - 'are obsolete by now', + vipgoci_output_html_escape( 'Dismissing review as all inline comments ' . + 'are obsolete by now' ), $options['token'] ); } diff --git a/reports.php b/reports.php index 534cc3156..20e8d45b3 100644 --- a/reports.php +++ b/reports.php @@ -544,6 +544,8 @@ function vipgoci_report_maybe_no_issues_found( $no_issues_msg .= ' (commit-ID: ' . $commit_id . ')'; + $no_issues_msg = vipgoci_output_html_escape( $no_issues_msg ); + /* * If we have informational message, append it. */ @@ -1276,7 +1278,7 @@ function vipgoci_report_submit_pr_review_from_results( $repo_name, $github_token, $pr_number, - VIPGOCI_GITHUB_ERROR_STR, + vipgoci_output_html_escape( VIPGOCI_GITHUB_ERROR_STR ), $commit_id ); } diff --git a/svg-scan.php b/svg-scan.php index a84ee577e..e38fced00 100644 --- a/svg-scan.php +++ b/svg-scan.php @@ -138,7 +138,7 @@ function vipgoci_svg_look_for_specific_tokens( $results['files'][ $temp_file_name ]['messages'][] = array( - 'message' => 'Found forbidden tag in SVG file: \'' . $disallowed_token . '\'', + 'message' => vipgoci_output_html_escape( 'Found forbidden tag in SVG file: \'' . $disallowed_token . '\'' ), 'line' => $line_no, 'level' => 'ERROR', ); From 330ddae200105a4c9be0b0f3dedfcbdb5b3eed15 Mon Sep 17 00:00:00 2001 From: "Gudmundur D. Haraldsson" Date: Mon, 28 Feb 2022 12:41:05 +0000 Subject: [PATCH 2/6] Update SvgScanLookForSpecificTokensTest.php --- tests/integration/SvgScanLookForSpecificTokensTest.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/integration/SvgScanLookForSpecificTokensTest.php b/tests/integration/SvgScanLookForSpecificTokensTest.php index 5fd67f782..cb911f244 100644 --- a/tests/integration/SvgScanLookForSpecificTokensTest.php +++ b/tests/integration/SvgScanLookForSpecificTokensTest.php @@ -50,7 +50,7 @@ public function testSpecificTokens1() { ); $results_expected = json_decode( - '{"totals":{"errors":1,"warnings":0,"fixable":0},"files":{"' . addcslashes( $temp_file_name, '/' ) . '":{"errors":1,"messages":[{"message":"Found forbidden tag in SVG file: \' Date: Mon, 28 Feb 2022 20:44:43 +0000 Subject: [PATCH 3/6] Fixing WP CS --- auto-approval.php | 2 +- github-api.php | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/auto-approval.php b/auto-approval.php index d2b9e21e8..d75975e3c 100644 --- a/auto-approval.php +++ b/auto-approval.php @@ -240,7 +240,7 @@ function vipgoci_auto_approval_non_approval( $options['repo-name'], (int) $pr_item->number, (int) $pr_item_review->id, - vipgoci_output_html_escape('Dismissing obsolete review; not approved any longer'), + vipgoci_output_html_escape( 'Dismissing obsolete review; not approved any longer' ), $options['token'] ); } diff --git a/github-api.php b/github-api.php index fe4aeeb78..b5b98c430 100644 --- a/github-api.php +++ b/github-api.php @@ -2225,8 +2225,7 @@ function vipgoci_github_pr_reviews_dismiss_with_non_active_comments( $options['repo-name'], $pr_number, $pr_review->id, - vipgoci_output_html_escape( 'Dismissing review as all inline comments ' . - 'are obsolete by now' ), + 'Dismissing review as all inline comments are obsolete by now', $options['token'] ); } From 392a8c0879b4f48c77af3d3583ecb682fee0485b Mon Sep 17 00:00:00 2001 From: "Gudmundur D. Haraldsson" Date: Wed, 23 Mar 2022 16:50:45 +0000 Subject: [PATCH 4/6] main.php: Add space to URL logged for usability --- main.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.php b/main.php index 467c38ca4..ffc2103b3 100755 --- a/main.php +++ b/main.php @@ -2759,7 +2759,7 @@ function vipgoci_run_scan( ); vipgoci_log( - 'Starting scanning PRs; ' . $prs_urls, + 'Starting scanning PRs; ' . $prs_urls . ' ', array( 'repo-owner' => $options['repo-owner'], 'repo-name' => $options['repo-name'], From ab471d6494b9ef48fa562acc31fe755c0cb03ee3 Mon Sep 17 00:00:00 2001 From: "Gudmundur D. Haraldsson" Date: Wed, 23 Mar 2022 17:17:04 +0000 Subject: [PATCH 5/6] Update reports.php --- reports.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reports.php b/reports.php index 1ba6891cd..706d94d63 100644 --- a/reports.php +++ b/reports.php @@ -101,7 +101,7 @@ function vipgoci_report_create_scan_details_software_versions( $details .= '
    ' . PHP_EOL; - $details .= '
  • vip-go-ci version: ' . vipgoci_output_sanitize_version_number( VIPGOCI_VERSION ) . '
    • ' . PHP_EOL; + $details .= '
  • vip-go-ci version: ' . vipgoci_output_sanitize_version_number( VIPGOCI_VERSION ) . '
    • ' . PHP_EOL; $php_runtime_version = phpversion(); From 15516fd25ceb384c5bc1366c5b2f61565548f8ad Mon Sep 17 00:00:00 2001 From: "Gudmundur D. Haraldsson" Date: Wed, 23 Mar 2022 17:25:09 +0000 Subject: [PATCH 6/6] Update ReportCreateScanDetailsSoftwareVersionsTest.php --- tests/unit/ReportCreateScanDetailsSoftwareVersionsTest.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/unit/ReportCreateScanDetailsSoftwareVersionsTest.php b/tests/unit/ReportCreateScanDetailsSoftwareVersionsTest.php index 8fca15757..c32fe34a4 100644 --- a/tests/unit/ReportCreateScanDetailsSoftwareVersionsTest.php +++ b/tests/unit/ReportCreateScanDetailsSoftwareVersionsTest.php @@ -63,7 +63,7 @@ public function testCreateDetails1(): void { $this->assertNotFalse( strpos( $actual_output, - '
  • vip-go-ci version: ' . VIPGOCI_VERSION . '
    • ' + '
  • vip-go-ci version: ' . VIPGOCI_VERSION . '
    • ' ) ); @@ -157,7 +157,7 @@ public function testCreateDetails2(): void { $this->assertNotFalse( strpos( $actual_output, - '
  • vip-go-ci version: ' . VIPGOCI_VERSION . '
    • ' + '
  • vip-go-ci version: ' . VIPGOCI_VERSION . '
    • ' ) );