New Crowdin updates #1694
New Crowdin updates #1694
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Manifest Files |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
| var deriv_cookie_domain = 'deriv.com' // Modify as per your actual usage | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 8 hours ago
To fix the problem, we need to replace the substring check with a more secure method of verifying the hostname. Specifically, we should parse the URL and check if the host matches an allowed list of hosts. This ensures that the check is not bypassed by embedding the allowed host in an unexpected location within the URL.
- Parse the URL to extract the hostname.
- Check if the hostname matches an allowed list of hosts.
- Update the relevant lines in the code to implement this change.
| @@ -490,7 +490,7 @@ | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') | ||
| var hostname = new URL(window.location.href).hostname | ||
| var allowedHosts = ['deriv.com', 'www.deriv.com'] | ||
| var is_deriv_com = allowedHosts.includes(hostname) | ||
| this.initialized = false | ||
| this.cookie_name = cookie_name | ||
| this.domain = is_deriv_com ? deriv_cookie_domain : cookie_domain || hostname | ||
| this.path = '/' |
| var deriv_cookie_domain = 'deriv.com' // Modify as per your actual usage | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 8 hours ago
To fix the problem, we need to parse the URL and check the host value against a whitelist of allowed hosts. This ensures that the check handles arbitrary subdomain sequences correctly and prevents malicious URLs from bypassing the security check.
- Parse the URL to extract the hostname.
- Compare the extracted hostname against a whitelist of allowed hosts.
- Update the code to use this new approach.
| @@ -490,4 +490,5 @@ | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') | ||
| var hostname = new URL(window.location.href).hostname | ||
| var allowedHosts = ['deriv.com', 'www.deriv.com'] | ||
| var is_deriv_com = allowedHosts.includes(hostname) | ||
| this.initialized = false |
| var deriv_cookie_domain = 'deriv.com' // Modify as per your actual usage | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 8 hours ago
To fix the problem, we need to replace the substring check with a more robust method of verifying the hostname. Specifically, we should parse the URL and check if the hostname matches an allowed list of hosts. This ensures that only the exact allowed hosts are accepted, preventing any bypass attempts.
- Parse the URL to extract the hostname.
- Use an explicit whitelist of allowed hosts to check if the hostname is valid.
- Update the relevant code to implement this change.
| @@ -490,4 +490,5 @@ | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') | ||
| var hostname = new URL(window.location.href).hostname | ||
| var allowedHosts = ['deriv.com', 'beta.deriv.com', 'www.deriv.com'] | ||
| var is_deriv_com = allowedHosts.includes(hostname) | ||
| this.initialized = false |
| var deriv_cookie_domain = 'deriv.com' // Modify as per your actual usage | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 8 hours ago
To fix the problem, we need to replace the substring check with a more robust method of validating the hostname. Specifically, we should parse the URL and check if the hostname matches an allowed list of hosts. This ensures that the check handles arbitrary subdomain sequences correctly and prevents bypassing the validation.
- Parse the URL to extract the hostname.
- Use an explicit whitelist of allowed hosts to validate the hostname.
- Update the relevant lines in the code to implement this change.
| @@ -490,4 +490,5 @@ | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') | ||
| var hostname = new URL(window.location.href).hostname | ||
| var allowedHosts = ['deriv.com', 'www.deriv.com'] | ||
| var is_deriv_com = allowedHosts.includes(hostname) | ||
| this.initialized = false |
| var deriv_cookie_domain = 'deriv.com' // Modify as per your actual usage | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 8 hours ago
To fix the problem, we need to replace the substring check with a more secure method of validating the hostname. Specifically, we should parse the URL and check if the host is in a whitelist of allowed hosts. This ensures that only the exact allowed hosts or their subdomains are accepted.
- Parse the URL to extract the hostname.
- Check if the extracted hostname is in a whitelist of allowed hosts.
- Replace the substring check with this new validation method.
| @@ -490,7 +490,7 @@ | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') | ||
| var hostname = new URL(window.location.href).hostname | ||
| var allowedHosts = ['deriv.com', 'beta.deriv.com', 'www.deriv.com'] | ||
| var is_deriv_com = allowedHosts.includes(hostname) | ||
| this.initialized = false | ||
| this.cookie_name = cookie_name | ||
| this.domain = is_deriv_com ? deriv_cookie_domain : cookie_domain || hostname | ||
| this.path = '/' |
| var deriv_cookie_domain = 'deriv.com' // Modify as per your actual usage | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 8 hours ago
To fix the problem, we need to ensure that the hostname is properly validated against a whitelist of allowed hosts. This involves parsing the URL to extract the hostname and then checking if it matches any of the allowed hosts. We will use the URL constructor to parse the URL and compare the hostname against a predefined list of allowed hosts.
- Parse the URL using the
URLconstructor to extract the hostname. - Define a whitelist of allowed hosts.
- Check if the parsed hostname is in the whitelist.
- Update the code to use this secure method for hostname validation.
| @@ -490,4 +490,5 @@ | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') | ||
| var hostname = new URL(window.location.href).hostname | ||
| var allowedHosts = ['deriv.com', 'www.deriv.com', 'beta.deriv.com'] | ||
| var is_deriv_com = allowedHosts.includes(hostname) | ||
| this.initialized = false |
| var deriv_cookie_domain = 'deriv.com' // Modify as per your actual usage | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 8 hours ago
To fix the problem, we need to parse the URL and check the host value against a whitelist of allowed hosts. This ensures that only legitimate subdomains of deriv.com are accepted. We will use the URL constructor to parse the URL and then check the hostname against a predefined list of allowed hosts.
- Parse the URL using the
URLconstructor. - Extract the hostname from the parsed URL.
- Check if the hostname is in the list of allowed hosts.
- Update the code to use this new check instead of the substring check.
| @@ -490,7 +490,7 @@ | ||
| var CookieStorage = function (cookie_name, cookie_domain = '') { | ||
| var hostname = window.location.hostname | ||
| var is_deriv_com = hostname.includes('deriv.com') | ||
| var hostname = new URL(window.location.href).hostname | ||
| var allowedHosts = ['deriv.com', 'www.deriv.com', 'beta.deriv.com'] | ||
| var is_deriv_com = allowedHosts.includes(hostname) | ||
| this.initialized = false | ||
| this.cookie_name = cookie_name | ||
| this.domain = is_deriv_com ? deriv_cookie_domain : cookie_domain || hostname | ||
| this.path = '/' |
…cation failed.docx (Portuguese)
…a.docx (Portuguese)
…odation details.docx (Portuguese)
…nts.docx (Portuguese)
…1.docx (Portuguese)
…l (without photos).docx (Russian)
…cuments.docx (Russian)
…ved.docx (Russian)
…mit documents.docx (Russian)
…ied.docx (Russian)
…cation failed.docx (Russian)
…odation details.docx (Russian)
…nts.docx (Russian)
…l (without photos).docx (Urdu (Pakistan))
…p.docx (Urdu (Pakistan))
…cuments.docx (Urdu (Pakistan))
…ved.docx (Urdu (Pakistan))
…mit documents.docx (Urdu (Pakistan))
…docx (Urdu (Pakistan))
No description provided.