Skip to content

🔒(frontend) enhance file download security #889

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

🔒(frontend) enhance file download security #889

wants to merge 1 commit into from
+171 −1

Conversation

PanchoutNathan
Copy link
Contributor

Purpose

Added a safety check for URLs in the FileDownloadButton component. Now, before opening a URL, it verifies if the URL is safe using the isSafeUrl function.
This prevents potentially unsafe URLs from being opened in a new tab.

@PanchoutNathan PanchoutNathan self-assigned this Apr 18, 2025
NathanVss
NathanVss approved these changes Apr 18, 2025
View reviewed changes
Copy link
Contributor

@NathanVss NathanVss left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I approve now as it must pass as a hotfix. But imo we should add all the tests cases that clear the OWASP recommendations

lunika
lunika approved these changes Apr 18, 2025
View reviewed changes
Copy link
Member

@lunika lunika left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you update the changelog please

@PanchoutNathan PanchoutNathan force-pushed the fix/xss-file-download-button branch 2 times, most recently from 8f5bcba to 42c0f11 Compare April 18, 2025 10:11
@PanchoutNathan
🔒️(frontend) enhance file download security
f8bd2ce 
Added a safety check for URLs in the FileDownloadButton component.
Now, before opening a URL, it verifies if the URL is safe using the
isSafeUrl function.
This prevents potentially unsafe URLs from being opened in a new tab
@PanchoutNathan PanchoutNathan force-pushed the fix/xss-file-download-button branch 3 times, most recently from bb10b34 to f8bd2ce Compare April 23, 2025 06:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@lunika lunika lunika approved these changes

@NathanVss NathanVss NathanVss approved these changes

Assignees

@PanchoutNathan PanchoutNathan

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@PanchoutNathan @lunika @NathanVss