Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WIP: migrate typhoon to new-mock #1488

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

WIP: migrate typhoon to new-mock #1488

wants to merge 1 commit into from

Conversation

jannisvisser
Copy link
Contributor

No description provided.

@jannisvisser jannisvisser marked this pull request as draft March 25, 2024 15:50
@jannisvisser
Copy link
Contributor Author

@arsforza FYI: I did some quick initial work on migrating typhoon to new mock, but I'm going to quit it now. Just so you know, whenever you get to it.

Base automatically changed from feat.floods-leadtime-event to master May 21, 2024 15:13
github-advanced-security[bot]
github-advanced-security bot found potential problems Sep 23, 2024
View reviewed changes
services/API-service/src/scripts/mock-helper.service.ts
trackFileName = `${filePath}/typhoon-track-no-landfall-yet.json`;
}

const trackRaw = fs.readFileSync(trackFileName, 'utf-8');

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
Loading
.
This path depends on a
user-provided value
Loading
.
This path depends on a
user-provided value
Loading
.
This path depends on a
user-provided value
Loading
.

Copilot Autofix AI 3 months ago

To fix the problem, we need to ensure that the constructed file path is contained within a safe root directory. This can be achieved by normalizing the path using path.resolve and then checking that the normalized path starts with the root directory. If the path is not within the root directory, we should reject the request.

  1. Import the path module.
  2. Define a constant for the root directory.
  3. Normalize the constructed file path using path.resolve.
  4. Check if the normalized path starts with the root directory.
  5. If the path is valid, proceed with reading the file; otherwise, handle the error appropriately.
Suggested changeset 1
services/API-service/src/scripts/mock-helper.service.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/services/API-service/src/scripts/mock-helper.service.ts b/services/API-service/src/scripts/mock-helper.service.ts
--- a/services/API-service/src/scripts/mock-helper.service.ts
+++ b/services/API-service/src/scripts/mock-helper.service.ts
@@ -1,2 +1,3 @@
 import fs from 'fs';
+import path from 'path';
 import { Injectable } from '@nestjs/common';
@@ -296,9 +297,14 @@
   ) {
-    const filePath = `./src/scripts/mock-data/${DisasterType.Typhoon}/${countryCodeISO3}/${scenarioName}/${event.eventName}`;
-    let trackFileName = `${filePath}/typhoon-track.json`;
+    const ROOT_DIR = path.resolve('./src/scripts/mock-data');
+    const filePath = path.resolve(ROOT_DIR, `${DisasterType.Typhoon}/${countryCodeISO3}/${scenarioName}/${event.eventName}`);
+    let trackFileName = path.resolve(filePath, 'typhoon-track.json');
     // TODO: Implement the following scenarios
     if (scenarioName === TyphoonScenario.EventNoLandfall) {
-      trackFileName = `${filePath}/typhoon-track-no-landfall.json`;
+      trackFileName = path.resolve(filePath, 'typhoon-track-no-landfall.json');
     } else if (scenarioName === TyphoonScenario.EventNoLandfallYet) {
-      trackFileName = `${filePath}/typhoon-track-no-landfall-yet.json`;
+      trackFileName = path.resolve(filePath, 'typhoon-track-no-landfall-yet.json');
+    }
+
+    if (!trackFileName.startsWith(ROOT_DIR)) {
+      throw new Error('Invalid file path');
     }
EOF
@@ -1,2 +1,3 @@
import fs from 'fs';
import path from 'path';
import { Injectable } from '@nestjs/common';
@@ -296,9 +297,14 @@
) {
const filePath = `./src/scripts/mock-data/${DisasterType.Typhoon}/${countryCodeISO3}/${scenarioName}/${event.eventName}`;
let trackFileName = `${filePath}/typhoon-track.json`;
const ROOT_DIR = path.resolve('./src/scripts/mock-data');
const filePath = path.resolve(ROOT_DIR, `${DisasterType.Typhoon}/${countryCodeISO3}/${scenarioName}/${event.eventName}`);
let trackFileName = path.resolve(filePath, 'typhoon-track.json');
// TODO: Implement the following scenarios
if (scenarioName === TyphoonScenario.EventNoLandfall) {
trackFileName = `${filePath}/typhoon-track-no-landfall.json`;
trackFileName = path.resolve(filePath, 'typhoon-track-no-landfall.json');
} else if (scenarioName === TyphoonScenario.EventNoLandfallYet) {
trackFileName = `${filePath}/typhoon-track-no-landfall-yet.json`;
trackFileName = path.resolve(filePath, 'typhoon-track-no-landfall-yet.json');
}

if (!trackFileName.startsWith(ROOT_DIR)) {
throw new Error('Invalid file path');
}
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@jannisvisser