Develop #641
Develop #641
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| <li key={link.name} className='p-2.5 flex gap-2 items-center'> | ||
| <Link | ||
| className='flex items-center gap-2' | ||
| href={link.noResourceSlug ? link.path : `/${resourceSlug}${link.path}`}> |
Check warning
Code scanning / CodeQL
Client-side URL redirect Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 6 days ago
To fix the problem, we need to ensure that the resourceSlug is validated against a list of authorized slugs before using it to construct URLs. This can be achieved by maintaining a list of authorized slugs and checking if the resourceSlug is in this list before using it.
- Create a list of authorized slugs.
- Validate the
resourceSlugagainst this list. - If the
resourceSlugis not authorized, use a default or fallback value.
| @@ -246,3 +246,4 @@ | ||
| const posthog = usePostHog(); | ||
| const resourceSlug = router?.query?.resourceSlug || account?.currentTeam; | ||
| const authorizedSlugs = ['slug1', 'slug2', 'slug3']; // Replace with actual authorized slugs | ||
| const resourceSlug = authorizedSlugs.includes(router?.query?.resourceSlug) ? router?.query?.resourceSlug : account?.currentTeam; | ||
| const currentOrg = account?.orgs?.find(o => o.id === account?.currentOrg); |
| {teamNavigation.map(item => ( | ||
| <Link | ||
| key={item.id} | ||
| href={`/${resourceSlug}${item.href}`} |
Check warning
Code scanning / CodeQL
Client-side URL redirect Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 6 days ago
To fix the problem, we need to ensure that the resourceSlug used in the URL construction is validated against a list of authorized values. This can be achieved by maintaining a list of allowed resourceSlug values and checking if the user-provided resourceSlug is in this list before constructing the URL.
- Create a list of authorized
resourceSlugvalues. - Validate the
resourceSlugagainst this list before using it to construct the URL. - If the
resourceSlugis not authorized, handle the error appropriately (e.g., redirect to a default page or show an error message).
| @@ -246,3 +246,4 @@ | ||
| const posthog = usePostHog(); | ||
| const resourceSlug = router?.query?.resourceSlug || account?.currentTeam; | ||
| const authorizedResourceSlugs = ['team1', 'team2', 'team3']; // Example list of authorized slugs | ||
| const resourceSlug = authorizedResourceSlugs.includes(router?.query?.resourceSlug) ? router?.query?.resourceSlug : account?.currentTeam; | ||
| const currentOrg = account?.orgs?.find(o => o.id === account?.currentOrg); |
| ) && | ||
| !isMe && ( | ||
| <a | ||
| href={`/${resourceSlug}/${isOrg ? 'org' : 'team'}/${member._id}/edit`} |
Check warning
Code scanning / CodeQL
Client-side URL redirect Medium
| @@ -186,15 +178,13 @@ | |||
| {!compact && ( | |||
| <Link | |||
| className='text-sm font-semibold leading-6 text-gray-900' | |||
| href={`/${resourceSlug}/models`} | |||
| > | |||
| href={`/${resourceSlug}/models`}> | |||
Check warning
Code scanning / CodeQL
Client-side URL redirect Medium
| {showButton && ( | ||
| <> | ||
| {slug && ( | ||
| <>{buttonText ? href ? <Link href={`/${resourceSlug}${href}`}>{b}</Link> : b : null}</> |
Check warning
Code scanning / CodeQL
Client-side URL redirect Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 6 days ago
To fix the problem, we need to ensure that the resourceSlug value is validated against a list of authorized slugs before constructing the URL for redirection. This can be achieved by maintaining a list of authorized slugs and checking if the resourceSlug value is in this list before using it in the URL.
- Create a list of authorized slugs.
- Check if
resourceSlugis in the list of authorized slugs. - Only construct the URL if the
resourceSlugis authorized.
| @@ -30,3 +30,4 @@ | ||
| const { teamName, account, csrf } = accountContext as any; | ||
| const resourceSlug = router?.query?.resourceSlug || account?.currentTeam; | ||
| const authorizedSlugs = ['team1', 'team2', 'team3']; // Example list of authorized slugs | ||
| const resourceSlug = authorizedSlugs.includes(router?.query?.resourceSlug) ? router?.query?.resourceSlug : account?.currentTeam; | ||
|
|
||
| @@ -59,3 +60,3 @@ | ||
| {slug && ( | ||
| <>{buttonText ? href ? <Link href={`/${resourceSlug}${href}`}>{b}</Link> : b : null}</> | ||
| <>{buttonText ? href ? <Link href={`/${resourceSlug ? `/${resourceSlug}${href}` : href}`}>{b}</Link> : b : null}</> | ||
| )} |
| console.log(datasources); | ||
|
|
||
| const goToDatasourcePage = (id: string) => { | ||
| router.push(`/${resourceSlug}/connections/${id}`); |
Check warning
Code scanning / CodeQL
Client-side URL redirect Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 6 days ago
To fix the problem, we should avoid using user-provided values directly in constructing URLs for redirection. Instead, we can maintain a list of authorized redirects and choose from that list based on the user input. This ensures that only safe, predefined URLs are used for redirection.
In this specific case, we can create a mapping of valid resourceSlug values to their corresponding paths. Before performing the redirection, we can check if the provided resourceSlug is in the list of valid values. If it is, we proceed with the redirection; otherwise, we handle the error appropriately.
| @@ -22,2 +22,8 @@ | ||
|
|
||
| const validResourceSlugs = { | ||
| 'slug1': '/slug1/connections/', | ||
| 'slug2': '/slug2/connections/', | ||
| // Add other valid slugs here | ||
| }; | ||
|
|
||
| const columns = ['Name', 'Source', 'Destination', 'Status', 'Sync', 'Actions']; | ||
| @@ -26,3 +32,9 @@ | ||
| const goToDatasourcePage = (id: string) => { | ||
| router.push(`/${resourceSlug}/connections/${id}`); | ||
| const path = validResourceSlugs[resourceSlug]; | ||
| if (path) { | ||
| router.push(`${path}${id}`); | ||
| } else { | ||
| console.error('Invalid resource slug'); | ||
| // Handle the error appropriately, e.g., show an error message to the user | ||
| } | ||
| }; |
| ))} | ||
| </div> | ||
| <Link | ||
| href={`/${resourceSlug}/app/add`} |
Check warning
Code scanning / CodeQL
Client-side URL redirect Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 6 days ago
To fix the problem, we should avoid using user input directly in the URL redirection. Instead, we can maintain a list of authorized redirects and validate the resourceSlug against this list before constructing the URL. This ensures that only safe and predefined slugs are used for redirection.
- Create a list of authorized
resourceSlugvalues. - Validate the
resourceSlugagainst this list before using it in the URL. - If the
resourceSlugis not in the list, handle the error appropriately (e.g., redirect to a default page or show an error message).
| @@ -198,2 +198,4 @@ | ||
| const { resourceSlug } = router.query; | ||
| const authorizedSlugs = ['slug1', 'slug2', 'slug3']; // Replace with actual authorized slugs | ||
| const isValidSlug = authorizedSlugs.includes(resourceSlug); | ||
| const [state, dispatch] = useState<AppsDataReturnType>(props); | ||
| @@ -341,8 +343,12 @@ | ||
|
|
||
| <Link | ||
| href={`/${resourceSlug}/app/add`} | ||
| className='flex items-center gap-2 bg-gradient-to-r from-[#4F46E5] to-[#612D89] text-white py-2.5 px-4 rounded-lg cursor-pointer'> | ||
| <CirclePlus width={14} /> | ||
| <p className='font-semibold text-sm'>New App</p> | ||
| </Link> | ||
| {isValidSlug ? ( | ||
| <Link | ||
| href={`/${resourceSlug}/app/add`} | ||
| className='flex items-center gap-2 bg-gradient-to-r from-[#4F46E5] to-[#612D89] text-white py-2.5 px-4 rounded-lg cursor-pointer'> | ||
| <CirclePlus width={14} /> | ||
| <p className='font-semibold text-sm'>New App</p> | ||
| </Link> | ||
| ) : ( | ||
| <p className='text-red-500'>Invalid resource slug</p> | ||
| )} | ||
| </div> |
| <h1 className='font-semibold text-2xl text-foreground'>Connections</h1> | ||
|
|
||
| <button | ||
| onClick={() => router.push(`/${resourceSlug}/connections/add`)} |
Check warning
Code scanning / CodeQL
Client-side URL redirect Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 6 days ago
To fix the problem, we need to ensure that the resourceSlug value is validated against a list of authorized slugs before constructing the URL for redirection. This can be achieved by maintaining a list of valid resourceSlug values and checking the user-provided value against this list.
- Create a list of authorized
resourceSlugvalues. - Validate the
resourceSlugvalue against this list before using it to construct the URL. - If the
resourceSlugis not valid, handle the error appropriately (e.g., show an error message or redirect to a default page).
| @@ -30,2 +30,3 @@ | ||
| const { resourceSlug } = router.query; | ||
| const authorizedSlugs = ['slug1', 'slug2', 'slug3']; // Replace with actual authorized slugs | ||
| const [state, dispatch] = useState<Partial<DatasourcesDataReturnType>>(props); | ||
| @@ -118,3 +119,9 @@ | ||
| <button | ||
| onClick={() => router.push(`/${resourceSlug}/connections/add`)} | ||
| onClick={() => { | ||
| if (authorizedSlugs.includes(resourceSlug)) { | ||
| router.push(`/${resourceSlug}/connections/add`); | ||
| } else { | ||
| toast.error('Invalid resource slug'); | ||
| } | ||
| }} | ||
| className='flex items-center gap-2 bg-gradient-to-r from-[#4F46E5] to-[#612D89] text-white py-2.5 px-4 rounded-lg'> |
| })); | ||
| toast('Deleted session'); | ||
| if (router.asPath.includes(`/session/${sessionId}`)) { | ||
| return router.push(`/${resourceSlug}/apps`); |
Check warning
Code scanning / CodeQL
Client-side URL redirect Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 6 days ago
To fix the problem, we should avoid using user input directly in the URL redirection. Instead, we can maintain a list of authorized redirects and choose from that list based on the user input. This ensures that only predefined, safe URLs are used for redirection.
- Create a list of authorized redirects.
- Validate the
resourceSlugagainst this list before performing the redirection. - If the
resourceSlugis not in the list, handle the error appropriately (e.g., redirect to a default safe page or show an error message).
| @@ -72,4 +72,7 @@ | ||
| toast('Deleted session'); | ||
| if (router.asPath.includes(`/session/${sessionId}`)) { | ||
| const authorizedRedirects = ['team1', 'team2', 'team3']; // Example list of authorized slugs | ||
| if (router.asPath.includes(`/session/${sessionId}`) && authorizedRedirects.includes(resourceSlug)) { | ||
| return router.push(`/${resourceSlug}/apps`); | ||
| } else { | ||
| return router.push('/defaultPage'); // Redirect to a default safe page | ||
| } |
| <h3 className='pl-2 font-semibold text-gray-900 dark:text-white'>Edit Team Member</h3> | ||
| <h3 className='pl-2 text-sm font-medium text-gray-500 dark:text-white align-middle'> | ||
| <span | ||
| onClick={() => router.push(`/${resourceSlug}/team`)} |
Check warning
Code scanning / CodeQL
Client-side URL redirect Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 6 days ago
To fix the problem, we should avoid using user input directly in constructing the redirect URL. Instead, we can maintain a list of authorized redirects and choose from that list based on the user input. This ensures that only safe, predefined URLs are used for redirection.
- Create a list of authorized redirects.
- Validate the
resourceSlugagainst this list before constructing the URL. - If the
resourceSlugis not in the list, handle the error appropriately (e.g., show an error message or redirect to a default safe page).
| @@ -12,2 +12,4 @@ | ||
|
|
||
| const authorizedRedirects = ['team1', 'team2', 'team3']; // Example list of authorized redirects | ||
|
|
||
| export default function EditTeamMember(props) { | ||
| @@ -33,2 +35,10 @@ | ||
|
|
||
| const handleRedirect = () => { | ||
| if (authorizedRedirects.includes(resourceSlug)) { | ||
| router.push(`/${resourceSlug}/team`); | ||
| } else { | ||
| setError('Unauthorized redirect attempt'); | ||
| } | ||
| }; | ||
|
|
||
| return ( | ||
| @@ -44,3 +54,3 @@ | ||
| <span | ||
| onClick={() => router.push(`/${resourceSlug}/team`)} | ||
| onClick={handleRedirect} | ||
| className="cursor-pointer text-gray-600 hover:text-blue-600" |
|
Minimum allowed coverage is Generated by 🐒 cobertura-action against 4297fb0 |
No description provided.