Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CEF #8575

Draft
wants to merge 29 commits into
base: main
Choose a base branch
from
Draft

CEF #8575

wants to merge 29 commits into from

Conversation

Hinton
Copy link
Member

@Hinton Hinton commented Apr 2, 2024

- [ ] Bug fix
- [ ] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Code changes

  • file.ext: Description of what was changed and why

Screenshots

Before you submit

  • Please add unit tests where it makes sense to do so (encouraged but not required)
  • If this change requires a documentation update - notify the documentation team
  • If this change has particular deployment requirements - notify the DevOps team
  • Ensure that all UI additions follow WCAG AA requirements

@github-actions github-actions bot added the needs-qa Marks a PR as requiring QA approval label Apr 2, 2024
Copy link
Contributor

github-actions bot commented Apr 2, 2024

Logo
Checkmarx One – Scan Summary & Detailsffe9c06f-a7bc-45bc-93ac-2e3924448234

New Issues

Severity Issue Source File / Package Checkmarx Insight
LOW Client_Password_In_Comment /libs/importer/src/importers/cef/cef-importer.ts: 114 Attack Vector

@@ -289,7 +289,7 @@ export class Fido2AuthenticatorService implements Fido2AuthenticatorServiceAbstr
return {
authenticatorData,
selectedCredential: {
id: guidToRawFormat(selectedCredentialId),
id: Utils.fromUtf8ToArray(selectedCredentialId),
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coroiu This seems to be the main difference in how we handle passkeys. I think we can essentially migrate to storing our data B64Url encoded directly and have a if UUID fallback pattern.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah looks good, we should've done this from the start, but alas, we have debt instead :)

@JuniAlves2022

This comment was marked as spam.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs-qa Marks a PR as requiring QA approval
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants