Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix code scanning alert no. 2: Reflected cross-site scripting #26

Merged
merged 2 commits into from
Oct 1, 2024

Conversation

MichaelKreil
Copy link
Member

Fixes https://github.com/versatiles-org/versatiles-frontend/security/code-scanning/2

To fix the reflected cross-site scripting vulnerability, we need to sanitize the user input before incorporating it into the response. The best way to do this is by using a well-known library for escaping HTML, such as escape-html. This will ensure that any potentially malicious characters in the req.path are properly escaped, preventing XSS attacks.

  • General Fix: Use contextual output encoding/escaping before writing user input to the response.
  • Detailed Fix: Import the escape-html library and use it to sanitize req.path before including it in the response.
  • Specific Changes: Modify the file src/server/server.ts to include the escape-html library and apply it to the req.path on line 75.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

MichaelKreil and others added 2 commits October 1, 2024 12:54
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@MichaelKreil MichaelKreil marked this pull request as ready for review October 1, 2024 10:58
@MichaelKreil MichaelKreil merged commit a5c0ba0 into main Oct 1, 2024
6 checks passed
@MichaelKreil MichaelKreil deleted the autofix/alert-2-a72975b2f4 branch October 1, 2024 10:58
Copy link

codecov bot commented Oct 1, 2024

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant