Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(client): add Go client for notices #297
feat(client): add Go client for notices #297
Changes from 8 commits
7fbc993
79bed4e
1b5f188
a973de6
313c894
70f8a7d
41bd09b
fde015f
f462099
709ac37
31b6bb7
a555411
acde18d
b0e88f8
7c7a143
54036a2
8ab3981
c4c6429
f1263d3
4d25e3c
de13c72
85efd41
29cf984
286b0fd
6383cae
49e2a86
1fa3639
580a95a
7840544
403be41
f69171d
b715b16
01dd5ee
eeaaae0
32a1540
File filter
Filter by extension
Conversations
Jump to
There are no files selected for viewing
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Commenting here to avoid mixing with the unrelated thread below.
Taking a raw string from the outside world and blindly appending it to the GET path with zero validation is anxiety inducing. This is the kind of thing that can be exploited in an application we have no visibility over and become an actual hack.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I can see what you're saying, but I'm not so sure. Go will safely and properly percent-escape any disallowed characters, and the server will unescape (and will not find the notice).
However, I've added a simple client-side validation -- that's slightly more permissive than the integers we produce now for future-proofing -- see what you think.
If you think this is a good approach, I can create a PR to do something similar in
client/changes.go
, where we do the same thing.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've opened #318 to track that.