Potential fix for code scanning alert no. 28: Incomplete URL substring sanitization#136
Potential fix for code scanning alert no. 28: Incomplete URL substring sanitization#136
Conversation
…g sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @Dargon789, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Dargon789
added
bug
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request improves the security of the Datadog RUM beforeSend hook by implementing strict hostname verification for Uniswap gateway requests using the URL API. Feedback was provided to optimize performance by re-introducing a string inclusion check as a guard to prevent unnecessary URL parsing for non-gateway resources.
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
This comment was marked as abuse.
This comment was marked as abuse.
There was a problem hiding this comment.
Sorry @Dargon789, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
1 participant
Potential fix for https://github.com/Dargon789/interface/security/code-scanning/28
Use URL parsing and strict hostname comparison instead of substring matching.
Best fix in this file:
packages/uniswap/src/utils/datadog.web.ts, replace:event.type === 'resource' && event.resource.url.includes('gateway.uniswap.org')event.type === 'resource'event.resource.urlvianew URL(...)in atry/catchparsed.hostname === 'gateway.uniswap.org'This preserves existing behavior (only enrich headers for gateway requests) while preventing false matches from path/query/other hostnames. No new imports are needed because
URLis a global in browser environments.Suggested fixes powered by Copilot Autofix. Review carefully before merging.