Skip to content

fix: remaining CodeQL fixes #1612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Dec 3, 2024
Merged

fix: remaining CodeQL fixes #1612

merged 8 commits into from
Dec 3, 2024

Conversation

hallvictoria
Copy link
Contributor

@hallvictoria hallvictoria commented Nov 19, 2024

Description

Addresses remaining CodeQL issues:

  • Usage of unapproved crypto library: converts from using pycryptodome to cryptography
  • Reflected server-side cross-site scripting: added base64 encoding and stores in an HTML tag
    • Note: CodeQL suggests using the escape method, but that isn't supported for images. If this test is still failing, we will need to change the test
  • URL redirection from remote source: added validation on the URL, ports, and code param

Fixed HTTP console logging tests that were failing due to the recent host logging changes.

Fixes #


PR information

  • The title of the PR is clear and informative.
  • There are a small number of commits, each of which has an informative message. This means that previously merged commits do not appear in the history of the PR. For information on cleaning up the commits in your pull request, see this page.
  • If applicable, the PR references the bug/issue that it fixes in the description.
  • New Unit tests were added for the changes made and CI is passing.

Quality of Code and Contribution Guidelines

@hallvictoria hallvictoria marked this pull request as ready for review December 2, 2024 21:02
@hallvictoria hallvictoria merged commit 114be16 into dev Dec 3, 2024
27 checks passed
@hallvictoria hallvictoria deleted the hallvictoria/codeql branch December 3, 2024 17:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants