Skip to content
This repository has been archived by the owner on May 10, 2024. It is now read-only.

Fix #7702: OpenSearch issues - [hackerone 2057565] #7721

Merged
merged 5 commits into from
Jul 12, 2023

Conversation

soner-yuksel
Copy link
Contributor

Summary of Changes

This pull request fixes #7702

This pull request handles multitude of problems and security concerns

  • Prevent custom search engine be added more than once
  • If Show Search Suggestions off, do not send request with Search Suggestions API
  • Show both search template and suggestion template URL on the description alert
  • Not let custom search engine be added if search template or suggestion template is not having secure URL

Submitter Checklist:

  • Unit Tests are updated to cover new or changed functionality
  • User-facing strings use NSLocalizableString()
  • New or updated UI has been tested across:
    • Light & dark mode
    • Different size classes (iPhone, landscape, iPad)
    • Different dynamic type sizes

Test Plan:

  • Visit https://en.m.wikipedia.org/wiki/Main_Page
  • Click magnifier button and activate search
  • Click add custom search engine button over keyboard
  • Check both suggestion - search URL template is written on description on alert

Screenshots:

eroorcustomengine1

Reviewer Checklist:

  • Issues include necessary QA labels:
    • QA/(Yes|No)
    • bug / enhancement
  • Necessary security reviews have taken place.
  • Adequate unit test coverage exists to prevent regressions.
  • Adequate test plan exists for QA to validate (if applicable).
  • Issue and pull request is assigned to a milestone (should happen at merge time).

Copy link
Contributor

@stoletheminerals stoletheminerals left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @soner-yuksel

@soner-yuksel soner-yuksel added this to the 1.57 milestone Jul 12, 2023
@soner-yuksel soner-yuksel merged commit dd57a16 into development Jul 12, 2023
@soner-yuksel soner-yuksel deleted the fix/open-search-security branch July 12, 2023 18:31
@soner-yuksel soner-yuksel modified the milestones: 1.57, 1.56 Jul 12, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[hackerone] OpenSearch issues
3 participants