Release v1.146.0 - release → staging#12493
Conversation
…e/alertsContextualView
…e/alertsContextualView
…i/manager into feature/alertsContextualView
mjac0bs
left a comment
There was a problem hiding this comment.
There's just one changeset who appears to be in the wrong spot, but otherwise the changes, version bumps, and changelogs look good.
45b065f
|
ahh I forgot new commits here dismiss old reviews - will need some reapprovals 🙏 |
|
|
||
| const authorizeUrl = await generateOAuthAuthorizeEndpoint(returnTo); | ||
|
|
||
| window.location.assign(authorizeUrl); |
Check failure
Code scanning / CodeQL
DOM text reinterpreted as HTML High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
To fix the issue, we need to ensure that the authorizeUrl is properly sanitized before being used in window.location.assign. This can be achieved by encoding the entire URL using a safe method, such as encodeURI, to prevent any malicious input from being interpreted as executable code.
Steps to fix:
- Use
encodeURIto encode theauthorizeUrlbefore passing it towindow.location.assign. - Ensure that all components of the URL, including the query parameters, are properly escaped to prevent injection attacks.
Required changes:
- Modify the
redirectToLoginfunction inpackages/manager/src/OAuth/oauth.tsto encode theauthorizeUrlusingencodeURI.
| @@ -178,3 +178,3 @@ | ||
|
|
||
| window.location.assign(authorizeUrl); | ||
| window.location.assign(encodeURI(authorizeUrl)); | ||
| } |
There was a problem hiding this comment.
@bnussman-akamai Dismissible as well, trusting generateOAuthAuthorizeEndpoint to return a sanitized URL?
There was a problem hiding this comment.
I think so. generateOAuthAuthorizeEndpoint does return a properly encoded URL so I feel okay dismissing
Cloud Manager UI test results🔺 2 failing tests on test run #2 ↗︎
Details
TroubleshootingUse this command to re-run the failing tests: pnpm cy:run -s "cypress/e2e/core/account/account-maintenance.spec.ts" |
||||||||||||||||||||
mjac0bs
left a comment
There was a problem hiding this comment.
Thanks for the changeset fix, @coliu-akamai
cliu-akamai
left a comment
There was a problem hiding this comment.
The test failure is due to the new Host & VM Maintenance feature flag. A fix PR is ready: #12499
Cloud Manager - [2025-07-15] - v1.146.0
Added:
Changed:
Paperin create page sidebars (#12463)Fixed:
Removed:
queriespackage (#12406)queriespackage (#12426)queriespackage (#12468)Tech Stories:
REACT_APP_ENVIRONMENT_NAMEto set the Sentry environment (#12450)aclpBetaServicesnested feature flags (#12478)Tests:
Upcoming Features:
AlertInformationActionTable.tsx, add new alerts mutation query inalerts.tsx(#12393)FilterConfig.ts, add new componentCloudPulsePortFilter.tsx, update utilities inutils.ts(#12401)nodebalancerIpv6feature flag for NodeBalancer Dual Stack Support (#12420)CloudPulseModifyAlertRegions,AlertRegionsandDisplayAlertRegionscomponent, addgetSupportedRegionsfunction in alert utils.ts file, addregionskey inCreateAlertDefinitionForm(#12435)View Code Snippetsfor beta Alerts opt-in users in Create Linode flow (#12446)nodebalanceratFilterConfig.tsin metrics (#12464)APIv4 - [2025-07-15] - v0.144.0
Changed:
Fixed:
Upcoming Features:
alerts.tsandtypes.ts; Linode: Update type intypes.ts(#12393)types.ts(#12401)regionsinAlertinterface intypes.tsfile for cloudpulse (#12435)UI - [2025-07-15] - v0.16.0
Added:
nullas type option forheadingChip(#12460)Changed:
timeZonePropsto controltimeZone dropdownin DateTimeRangePicker.tsx (#12423)selectedprop inListItemOptionPropstype (#12481)Queries - [2025-07-15] - v0.9.0
Added:
entitytransfers/directory and migrated relevant query keys and hooks (#12406)databases/directory and migrated relevant query keys and hooks (#12426)statusPage/directory and migrated relevant query keys and hooks (#12468)Validation - [2025-07-15] - v0.70.0
Upcoming Features:
regionsincreateAlertDefinitionSchemaandeditAlertDefinitionSchema(#12435)Shared - [2025-07-15] - v0.5.0
Upcoming Features:
useIsLinodeAclpSubscribedhook and unit tests (#12479)