fix: heroku subdomain check #842
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // split and slice isn't a great way to match arbitrary domains, | ||
| // but it's good enough for ensuring we only match herokuapp.com when it is the TLD | ||
| // for the hostname | ||
| return hostname.split('.').slice(-2).join('.').indexOf('herokuapp.com') === -1 |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
|
Size Change: +41 B (0%) Total Size: 725 kB
ℹ️ View Unchanged
|
|
hmm, I'm not really clear about the original functionality. Is it something like: By default, we want to share super properties across subdomains, unless we're on herokuapp, which makes sense since those apps are all independent. A URL that fails the current default is something like Overall, if my understanding is correct, I feel like defaulting to false whenever we see herokuapp is much more straightforward. |
resolves https://github.com/PostHog/posthog-js/security/code-scanning/3
We checked for an herokuapp.com domain without caring about the position of the match within the hostname.
So, we would have treated
appname.herokuapp.comandappname.herokuapp.com.intercepting-domain.ioas the same.Well, not any more!