Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix regex misuse. #199

Merged
merged 2 commits into from
Jun 10, 2024
Merged

Fix regex misuse. #199

merged 2 commits into from
Jun 10, 2024

Commits on Jun 7, 2024

  1. Fix regex misuse. 

    - Overbroad matching of hostnames: `.` vs `\.`
- Overuse of `RegExp.prototype.match` where `String.prototype.includes`
  or `RegExp.prototype.test` suffice and better communicate the intent
  by returning a boolean.
- Use `Location.hostname` and not `Location.host`, because we're already
  assuming there isn't a port on the end (e.g. `:8080`). This avoids
  further complicating the (corrected) regexes.

Should resolve:

- https://github.com/alphagov/govuk-browser-extension/security/code-scanning/1
- https://github.com/alphagov/govuk-browser-extension/security/code-scanning/2
- https://github.com/alphagov/govuk-browser-extension/security/code-scanning/3
- https://github.com/alphagov/govuk-browser-extension/security/code-scanning/4

I don't believe these are exploitable, hence raising a regular PR.
    @sengi
    sengi committed Jun 7, 2024
    Configuration menu
    Copy the full SHA
    58e82c0 View commit details
    Browse the repository at this point in the history

  2. Parse URL properly when matching nationalarchives. 

    Otherwise we just substitute one CodeQL warning for another :/
    @sengi
    sengi committed Jun 7, 2024
    Configuration menu
    Copy the full SHA
    29e4db5 View commit details
    Browse the repository at this point in the history