Fix security issues by:

* remove useless replace with itself * encode email from from input * define permissions for actions * reference external github actions by their commit hash instead of tagged version
tegonal · Jan 15, 2025 · 1f935bb · 1f935bb
1 parent 6a5c9ce
commit 1f935bb
Show file tree

Hide file tree

Showing 5 changed files with 26 additions and 15 deletions.
diff --git a/.github/workflows/build_backend.yml b/.github/workflows/build_backend.yml
@@ -1,5 +1,8 @@
 name: Build & test backend application
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
   pull_request:
@@ -17,9 +20,9 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
       - name: Setup JDK
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
         with:
           distribution: temurin
           java-version: 17

diff --git a/.github/workflows/build_frontend.yml b/.github/workflows/build_frontend.yml
@@ -1,4 +1,8 @@
 name: Build frontend application
+
+permissions:
+  contents: read
+
 on:
   workflow_call:
   workflow_dispatch:
@@ -16,8 +20,8 @@ jobs:
     name: Build frontend application for amd64
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af #v4.1.0
         with:
           node-version: 22
       - name: build frontend

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -1,5 +1,8 @@
 name: Build & publish docker images
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -11,18 +14,18 @@ jobs:
     name: Build & push frontend
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
       - name: Add COMMIT_SHORT_SHA env property
         run: echo "COMMIT_SHORT_SHA=`echo ${GITHUB_SHA} | cut -c1-8`" >> $GITHUB_ENV
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 #v3.8.0
       - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Build & push frontend image to docker hub
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11
         with:
           context: "{{defaultContext}}:frontend"
           build-args: |
@@ -34,9 +37,9 @@ jobs:
     name: Build & push backend
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
       - name: Setup JDK
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
         with:
           distribution: temurin
           java-version: 17
@@ -46,14 +49,14 @@ jobs:
       - name: Add COMMIT_SHORT_SHA env property
         run: echo "COMMIT_SHORT_SHA=`echo ${GITHUB_SHA} | cut -c1-8`" >> $GITHUB_ENV
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 #v3.8.0
       - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Build & push backend image to docker hub
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11
         with:
           context: ./backend
           push: true

diff --git a/frontend/scripts/iconNames.js b/frontend/scripts/iconNames.js
@@ -28,7 +28,7 @@ for (const file of filesUnclean) {
   if (file.endsWith('.SVG') || file.startsWith('streamlinehq-') || file.includes('')) {
     fs.renameSync(
       `${directory}/${file}`,
-      `${directory}/${file.replace('.SVG', '.svg').replace('', '').replace('streamlinehq-', '')}`
+      `${directory}/${file.replace('.SVG', '.svg').replace('streamlinehq-', '')}`
     );
   }
 }

diff --git a/frontend/src/layout/pages/invitation/invitationUserRegister.tsx b/frontend/src/layout/pages/invitation/invitationUserRegister.tsx
@@ -93,8 +93,9 @@ export const InvitationUserRegister: React.FC<Props> = ({ invitation }) => {
     });
 
     if (response) {
+      const email = encodeURIComponent(data.email);
       await router.replace(
-        `/login?invitationId=${invitation.invitation.id}&email=${data.email}&registered=true`
+        `/login?invitationId=${invitation.invitation.id}&email=${email}&registered=true`
       );
     } else {
       setError('registerUserFailedUnknown');