-
Notifications
You must be signed in to change notification settings - Fork 698
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Security] Fix graphql server path injection #4809
base: master
Are you sure you want to change the base?
Conversation
61b02d3
to
67fadc1
Compare
67fadc1
to
4718dfa
Compare
4718dfa
to
d920302
Compare
Signed-off-by: Jaeyeon Park <[email protected]>
Signed-off-by: Jaeyeon Park <[email protected]>
Signed-off-by: Jaeyeon Park <[email protected]>
Signed-off-by: Jaeyeon Park <[email protected]>
91b2cad
to
4af4f67
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
@@ -320,6 +337,34 @@ func ChaosHubIconHandler() gin.HandlerFunc { | |||
responseStatusCode int | |||
) | |||
|
|||
if c.Param("projectId") != sanitize.PathName(c.Param("projectId")) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we add constants for the different params? @moggaa
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
Proposed changes
sanitize.PathName
function to ensure a formatted, compliant path name, addressing the vulnerability.Types of changes
What types of changes does your code introduce to Litmus? Put an
x
in the boxes that applyChecklist
Put an
x
in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your code.Dependency
Special notes for your reviewer: