Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[backend] Fix Server-Side Request Forgery #2136

Merged
merged 2 commits into from
Jan 9, 2025
Merged

[backend] Fix Server-Side Request Forgery #2136

merged 2 commits into from
Jan 9, 2025

Conversation

RomuDeuxfois
Copy link
Member

@RomuDeuxfois RomuDeuxfois commented Dec 30, 2024 •
edited
Loading

@github-actions github-actions bot added the filigran team use to identify PR from the Filigran team label Dec 30, 2024
@codecov Codecov
Copy link

codecov bot commented Dec 30, 2024 •
edited
Loading

Codecov Report

Attention: Patch coverage is 0% with 19 lines in your changes missing coverage. Please review.

Project coverage is 35.08%. Comparing base (24a7d24) to head (81b56c9).

Files with missing lines Patch % Lines
...api/src/main/java/io/openbas/utils/AgentUtils.java 0.00% 9 Missing ⚠️
...ain/java/io/openbas/rest/executor/ExecutorApi.java 0.00% 6 Missing ⚠️
...ain/java/io/openbas/rest/injector/InjectorApi.java 0.00% 4 Missing ⚠️
Additional details and impacted files 
@@             Coverage Diff              @@
##             master    #2136      +/-   ##
============================================
- Coverage     35.12%   35.08%   -0.05%     
  Complexity     1418     1418              
============================================
  Files           535      536       +1     
  Lines         16189    16208      +19     
  Branches       1037     1039       +2     
============================================
  Hits           5686     5686              
- Misses        10209    10228      +19     
  Partials        294      294

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

antoinemzs
antoinemzs reviewed Dec 31, 2024
View reviewed changes
openbas-api/src/main/java/io/openbas/rest/executor/ExecutorApi.java
@@ -143,6 +145,13 @@ public Executor registerExecutor(
produces = MediaType.APPLICATION_OCTET_STREAM_VALUE)
public @ResponseBody ResponseEntity<byte[]> getOpenBasAgentExecutable(
@PathVariable String platform, @PathVariable String architecture) throws IOException {
if (!AVAILABLE_PLATFORMS.contains(platform)) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given the string collections are constructed with case-lowered names, is it ok to require callers to use lower case path parts as well?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I made the changes

antoinemzs
antoinemzs approved these changes Dec 31, 2024
View reviewed changes
Copy link
Contributor

@antoinemzs antoinemzs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cheers for the docs

@RomuDeuxfois RomuDeuxfois changed the base branch from master to release/1.11.0 January 9, 2025 16:42
@RomuDeuxfois RomuDeuxfois merged commit 5fe4b1a into release/1.11.0 Jan 9, 2025
4 checks passed
@RomuDeuxfois RomuDeuxfois deleted the issue/1782 branch January 9, 2025 16:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@antoinemzs antoinemzs antoinemzs approved these changes

Assignees
No one assigned
Labels
filigran team use to identify PR from the Filigran team
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[security] Cross-site Scripting (XSS) [security] Server-Side Request Forgery
2 participants
@RomuDeuxfois @antoinemzs