Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: xss vulnerability patch for 4.3.1 #7340

Closed
wants to merge 2 commits into from
Closed

fix: xss vulnerability patch for 4.3.1 #7340

wants to merge 2 commits into from

Conversation

bartoszherba
Copy link
Collaborator

@bartoszherba bartoszherba requested a review from a team as a code owner December 2, 2024 08:56
@changeset-bot changeset-bot
Copy link

changeset-bot bot commented Dec 2, 2024 •
edited
Loading

⚠️ No Changeset found

Latest commit: 2c34cdf

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@bartoszherba bartoszherba requested a review from jagoral December 2, 2024 08:56
Fifciu
Fifciu reviewed Dec 2, 2024
View reviewed changes
packages/middleware/src/handlers/validateParams/index.ts
return (req: Request, res: Response, next: NextFunction) => {
// Validate & sanitize the request params
Object.entries(req.params).forEach(([key, value]) => {
req.params[key] = typeof value === "string" ? xss(value) : value;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't it always string?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is the same logic as we have in new version that you have already approved there

@bartoszherba bartoszherba force-pushed the feat/xss-vulnerability-patch-for-4.3.1 branch from f00b483 to 29df9a0 Compare December 2, 2024 10:36
@github-actions
ci: release (#7342)
2c34cdf 
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented Dec 2, 2024

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@bartoszherba
Copy link
Collaborator Author

It is already reviewed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Fifciu Fifciu Fifciu left review comments

@lsliwaradioluz lsliwaradioluz lsliwaradioluz approved these changes

@jagoral jagoral Awaiting requested review from jagoral

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@bartoszherba @Fifciu @lsliwaradioluz