add tcp proxy support #692
Conversation
|
There are 1 test cases, failed count 0:
Reported by api-testing. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| item: &item, | ||
| metrics: s.metrics, | ||
| mu: sync.Mutex{}, | ||
| } |
Check warning
Code scanning / CodeQL
Reflected cross-site scripting Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix the reflected XSS vulnerability, we need to ensure that any user-controlled data (e.g., mux.Vars(req)) is properly sanitized or escaped before being included in the HTTP response. In Go, the html.EscapeString function can be used to escape special HTML characters, preventing malicious scripts from being executed in the browser.
The fix involves:
- Escaping the
datavariable before writing it to the response in thewriteResponsefunction. - Ensuring that any intermediate processing (e.g.,
render.RenderAsBytes) does not reintroduce unsanitized user input.
| @@ -26,2 +26,3 @@ | ||
| "net/http" | ||
| "html" | ||
| "strings" | ||
| @@ -447,3 +448,4 @@ | ||
| if err == nil { | ||
| w.Write(data) | ||
| escapedData := html.EscapeString(string(data)) | ||
| w.Write([]byte(escapedData)) | ||
| } else { |
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferencesFootnotes
|
|
What type of PR is this?
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes #