Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix code scanning alert no. 6: Incomplete string escaping or encoding #3481

Merged
merged 1 commit into from
Oct 23, 2024

Conversation

tdonohue
Copy link
Member

@tdonohue tdonohue commented Oct 18, 2024

(NOTE: This PR was autogenerated by Copilot Autofix. I did not write the text below, nor the code changes in this PR)

Fixes https://github.com/DSpace/dspace-angular/security/code-scanning/6

To fix the problem, we need to ensure that backslashes in the inputKey are properly escaped before constructing the regular expression. This can be done by adding an additional replace call to escape backslashes. The best way to fix this without changing existing functionality is to modify the line where the regular expression is constructed.

  • Modify the line where inputKeyRegex is defined to include an additional replace call for escaping backslashes.
  • Ensure that the replace method uses a regular expression with the global flag to replace all occurrences of backslashes.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@tdonohue tdonohue added bug 1 APPROVAL pull request only requires a single approval to merge port to dspace-7_x This PR needs to be ported to `dspace-7_x` branch for next bug-fix release port to dspace-8_x This PR needs to be ported to `dspace-8_x` branch for next bug-fix release labels Oct 18, 2024
@tdonohue tdonohue marked this pull request as ready for review October 22, 2024 19:06
@tdonohue tdonohue added this to the 9.0 milestone Oct 22, 2024
Copy link
Member Author

@tdonohue tdonohue left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 As noted above, I didn't write this code. It was written by GitHub AutoPilot. However, I think this code looks reasonable...it just adds a new .replace() to handle backslashes properly. This also passes our detailed automated tests in metadata.utils.spec.ts.

(Technically, I don't think it should be possible to pass backslashes into this regex. But, it's better to be safe. So, I think this looks reasonable.)

Copy link
Member Author

@tdonohue tdonohue left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 Tested locally and found no changes in behavior. This is primarily used in import (via external sources) and object display. Tested those and everything seems to work well.

@tdonohue tdonohue merged commit abd0d69 into main Oct 23, 2024
16 checks passed
@tdonohue tdonohue deleted the alert-autofix-6 branch October 23, 2024 17:24
@tdonohue tdonohue restored the alert-autofix-6 branch October 23, 2024 17:25
@dspace-bot
Copy link
Contributor

Successfully created backport PR for dspace-7_x:

@dspace-bot
Copy link
Contributor

Successfully created backport PR for dspace-8_x:

@tdonohue tdonohue removed port to dspace-7_x This PR needs to be ported to `dspace-7_x` branch for next bug-fix release port to dspace-8_x This PR needs to be ported to `dspace-8_x` branch for next bug-fix release labels Oct 23, 2024
@tdonohue tdonohue deleted the alert-autofix-6 branch October 23, 2024 18:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
1 APPROVAL pull request only requires a single approval to merge bug
Projects
Status: ✅ Done
Development

Successfully merging this pull request may close these issues.

2 participants