✨ (CodeQL) Fixed finding: "Incomplete URL substring sanitization" #10
Conversation
![pixeebot[bot]](https://avatars.githubusercontent.com/in/193111?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -20,8 +20,7 @@ | |||
| UserModel.findByPk(loggedInUser.data.id).then((user: UserModel | null) => { | |||
| if (user != null) { | |||
| challengeUtils.solveIf(challenges.csrfChallenge, () => { | |||
| return ((req.headers.origin?.includes('://htmledit.squarefree.com')) ?? | |||
| (req.headers.referer?.includes('://htmledit.squarefree.com'))) && | |||
| return ([new URL(req.headers.origin).hostname, new URL(req.headers.referer).hostname].includes('htmledit.squarefree.com')) && | |||
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
|
|
I'm confident in this change, but I'm not a maintainer of this project. Do you see any reason not to merge it? If this change was not helpful, or you have suggestions for improvements, please let me know! |
|
Just a friendly ping to remind you about this change. If there are concerns about it, we'd love to hear about them! |
|
This change may not be a priority right now, so I'll close it. If there was something I could have done better, please let me know! You can also customize me to make sure I'm working with you in the way you want. |
✨✨✨
Remediation
This change fixes "Incomplete URL substring sanitization" (id = js/incomplete-url-substring-sanitization) identified by CodeQL.
Details
Replace url substring check with robust check to allowed hosts.
🧚🤖 Powered by Pixeebot
Enhanced with AILearn moreFeedback | Community | Docs | Codemod ID: codeql:javascript/url-substring-sanitization