Address security issues #1589
Address security issues #1589
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
openc3-cosmos-init/plugins/packages/openc3-tool-common/src/tools/base/components/Login.vue
Fixed
Show resolved
Hide resolved
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1589 +/- ##
==========================================
- Coverage 77.03% 76.80% -0.24%
==========================================
Files 613 613
Lines 46056 46307 +251
Branches 803 805 +2
==========================================
+ Hits 35480 35564 +84
- Misses 10489 10655 +166
- Partials 87 88 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
| value = arg.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "�").strip.tr("\u{202E}%$|:;/\t\r\n\\", "-") | ||
| end | ||
| if value != arg | ||
| render(json: { status: 'error', message: "Invalid parameter #{param_list[index]}" }, status: 400) |
There was a problem hiding this comment.
Should this still be param_list[index] or should it be result[index]?
There was a problem hiding this comment.
I updated to match other messages.
| @@ -25,6 +25,7 @@ | |||
|
|
|||
| class StorageController < ApplicationController | |||
| def buckets | |||
| return unless authorization('system') | |||
There was a problem hiding this comment.
This is a good check but doesn't everyone have system?
There was a problem hiding this comment.
Yes, but at least not it requires you to be authenicated. Before even not logged in could get it.
| let result = url.pathname | ||
| if (url.search) { | ||
| result = result + url.search | ||
| } |
There was a problem hiding this comment.
What are you accomplishing here? Comment?
There was a problem hiding this comment.
This converts to a relative url.
openc3-cosmos-init/plugins/packages/openc3-tool-common/src/tools/base/components/Login.vue
Fixed
Show resolved
Hide resolved
|
Addresses:
GHSL-2024-127
GHSL-2024-128
GHSL-2024-129