[dev] [claudfuen] claudio/comp-210-self-serve-implementation-v1#932
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
1 Skipped Deployment
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } catch (error) { | ||
| // If URL parsing fails, it might be a relative path/key | ||
| // Only accept it if it doesn't look like it's trying to be an amazonaws URL | ||
| if (!url.includes("amazonaws.com") && url.split("/").length > 1) { | ||
| if (!url.includes('amazonaws.com') && url.split('/').length > 1) { |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
| } | ||
|
|
||
| export function extractS3KeyFromUrl(url: string): string { | ||
| const fullUrlMatch = url.match(/amazonaws\.com\/(.+)$/); | ||
| if (fullUrlMatch?.[1]) { | ||
| return decodeURIComponent(fullUrlMatch[1]); | ||
| } | ||
| if (!url.includes("amazonaws.com") && url.split("/").length > 1) { | ||
| if (!url.includes('amazonaws.com') && url.split('/').length > 1) { |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix the issue, the code should parse the URL and validate its host explicitly instead of relying on a substring check. This ensures that the host matches the expected domain (amazonaws.com) and prevents bypasses caused by embedding the substring in other parts of the URL.
Steps to fix:
- Use the
URLconstructor to parse the URL and extract its host. - Validate that the host ends with
.amazonaws.comto account for subdomains likes3.amazonaws.com. - Replace the substring check (
url.includes('amazonaws.com')) with the host validation.
Required changes:
- Modify the
extractS3KeyFromUrlfunction to use theURLconstructor for parsing and host validation. - Ensure the function throws an error if the host does not match the expected domain.
| @@ -42,4 +42,10 @@ | ||
| } | ||
| if (!url.includes('amazonaws.com') && url.split('/').length > 1) { | ||
| return url; | ||
| try { | ||
| const parsedUrl = new URL(url); | ||
| if (!parsedUrl.host.endsWith('.amazonaws.com') && url.split('/').length > 1) { | ||
| return url; | ||
| } | ||
| } catch (error) { | ||
| console.error('Invalid URL format:', url, error); | ||
| throw new Error('Invalid URL format'); | ||
| } |
…tion membership and managing customer records
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🎉 This PR is included in version 1.42.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
2 participants
This is an automated pull request to merge claudio/comp-210-self-serve-implementation-v1 into dev.
It was created by the [Auto Pull Request] action.