Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix code scanning alert no. 2: Server-side request forgery #6

Merged
merged 1 commit into from
Oct 21, 2024
Merged

Fix code scanning alert no. 2: Server-side request forgery #6

merged 1 commit into from
Oct 21, 2024

Conversation

srnovus
Copy link
Contributor

@srnovus srnovus commented Oct 21, 2024

Fixes https://github.com/fedired-dev/fedired/security/code-scanning/2

To fix the SSRF vulnerability, we need to implement stricter validation of the url parameter. Specifically, we should:

  1. Use an allow-list of permitted hostnames or domains to ensure that the url parameter can only point to trusted destinations.
  2. Ensure that the isSafeUrl function is robust and covers all potential edge cases.
  3. Avoid using user input directly in the got.stream method without thorough validation.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

@srnovus @github-advanced-security
Fix code scanning alert no. 2: Server-side request forgery
51fb5df 
Beta code commit

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Javier Caceres <[email protected]>
@srnovus srnovus marked this pull request as ready for review October 21, 2024 18:47
@srnovus srnovus merged commit 6801954 into main Oct 21, 2024
@srnovus srnovus deleted the alert-autofix-2 branch October 23, 2024 02:57
srnovus added a commit that referenced this pull request Oct 30, 2024
@srnovus
resolver issue #6
934600c
srnovus added a commit that referenced this pull request Oct 30, 2024
@srnovus
nvus rama (#23)
a7c48d9 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6
srnovus added a commit that referenced this pull request Oct 31, 2024
@srnovus
Nvus (#24)
18af9ef 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update
srnovus added a commit that referenced this pull request Oct 31, 2024
@srnovus
Nvus (#25)
c05d5de 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code
srnovus added a commit that referenced this pull request Oct 31, 2024
@srnovus
Nvus (#26)
5b04fe9 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update
srnovus added a commit that referenced this pull request Oct 31, 2024
@srnovus
Nvus (#27)
32203f2 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Oct 31, 2024
@srnovus
Nvus (#28)
ad0e4b8 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Oct 31, 2024
@srnovus
Nvus (#29)
0c1202e 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Oct 31, 2024
@srnovus
Nvus (#30)
04f273b 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Oct 31, 2024
@srnovus
Nvus (#31)
0ff6a27 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Oct 31, 2024
@srnovus
Nvus (#32)
88f47bb 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Oct 31, 2024
@srnovus
Nvus (#33)
28a4073 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Oct 31, 2024
@srnovus
Nvus (#34)
c45a5eb 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Oct 31, 2024
@srnovus
Nvus (#35)
583d33b 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

* update

* update

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Nov 6, 2024
@srnovus
Nvus (#36)
a693987 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

* update

* update

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Nov 6, 2024
@srnovus
Nvus (#37)
422efaf 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

* update

* update

* update v

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Nov 7, 2024
@srnovus
Fusión de la rama nvus a main - Corregido el idioma de estado.status.…
13039ae 
…language (#38)

* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

* update

* update

* update v

* update language

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Nov 7, 2024
@srnovus
Nvus (#39)
0e5abd0 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

* update

* update

* update v

* update language

* update about

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Nov 7, 2024
@srnovus
Nvus (#40)
265a963 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

* update

* update

* update v

* update language

* update about

* update about

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Nov 7, 2024
@srnovus
Nvus (#41)
cd9ab61 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

* update

* update

* update v

* update language

* update about

* update about

* update

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Nov 7, 2024
@srnovus
Nvus (#42)
b46d2e8 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

* update

* update

* update v

* update language

* update about

* update about

* update

* up

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Nov 7, 2024
@srnovus
Nvus (#43)
74903cb 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

* update

* update

* update v

* update language

* update about

* update about

* update

* up

* a

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Nov 7, 2024
@srnovus
Nvus (#44)
e78d037 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

* update

* update

* update v

* update language

* update about

* update about

* update

* up

* a

* a

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Nov 7, 2024
@srnovus
Nvus (#45)
8d22b1d 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

* update

* update

* update v

* update language

* update about

* update about

* update

* up

* a

* a

* update postgresql

---------

Signed-off-by: Javier Caceres <[email protected]>
srnovus added a commit that referenced this pull request Nov 7, 2024
@srnovus
Nvus (#46)
b3ff266 
* add ci

* add github yml

* update ci

* update ci

* update error ci

* update

* resolver issue #6

* ci

* udpate ci

* update ci

* a

* add github integration and update mknote

* update

* update code

* update

* update

* update integrations

* update locales

* update

* update

* update

* q

* a

* update

* update

* update v

* update language

* update about

* update about

* update

* up

* a

* a

* update postgresql

* update

---------

Signed-off-by: Javier Caceres <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@srnovus