feat: support getting page of static files #814
Conversation
|
There are 1 test cases, failed count 0:
Reported by api-testing. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| Name: pathParams["data"], | ||
| }) | ||
| if err == nil { | ||
| w.Write([]byte(result.GetMessage())) |
Check warning
Code scanning / CodeQL
Reflected cross-site scripting Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
To address the XSS vulnerability, we should escape any untrusted data before embedding it in an HTTP response likely to be rendered as HTML by browsers. In this case, the output from result.GetMessage() should be HTML-escaped, especially since extension code receives arbitrary header values from the user and could include them in the message.
Best fix:
- In the handler function, change the line that writes the message to the response to write the HTML-escaped version of the message.
- Use Go's standard
html.EscapeString()function (import "html"package) for HTML escaping. - Only the relevant region of
cmd/server.goneeds to be changed: around line 549, and a new import added at the top.
No changes are required to the proto or server files; only the handler that produces the HTTP response needs adjusting.
| @@ -32,7 +32,7 @@ | ||
| "strings" | ||
| "syscall" | ||
| "time" | ||
|
|
||
| "html" | ||
| "github.com/linuxsuren/api-testing/pkg/apispec" | ||
|
|
||
| "github.com/linuxsuren/api-testing/pkg/runner" | ||
| @@ -546,9 +546,9 @@ | ||
| Name: pathParams["data"], | ||
| }) | ||
| if err == nil { | ||
| w.Write([]byte(result.GetMessage())) | ||
| w.Write([]byte(html.EscapeString(result.GetMessage()))) | ||
| } else { | ||
| w.Write([]byte(err.Error())) | ||
| w.Write([]byte(html.EscapeString(err.Error()))) | ||
| } | ||
| } | ||
| } |
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferences |
|
What type of PR is this?
What this PR does / why we need it:
LinuxSuRen/atest-ext-store-mermaid#2 implemented the static file extension point.
Which issue(s) this PR fixes:
Fixes #