-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Improve input validation #587
Comments
Important: this should only happen jointly with the FE team - the backend team was already tasked to update the pattern in the last sprint review and to make sure that it fits with FE validations. |
Description
Validate the input (especially urls) being passed and omit those that use a different protocol than https, contain query or fragment or navigational elements (like '../..') in the path
Also make sure that the application does convert "dangerous" characters into safe equivalents (HTML entities or Unicode characters)
Examples of dangerous characters:
< >
Introduction of HTML or JavaScript code tags
' " &
Manipulating the content of SQL queries
{ } $ %
Embedding executable code in HTML server templates
Additionally, look into restricting the number of files that can be uploaded by the user.
Important: needs to be approached jointly with eclipse-tractusx/portal-frontend#672
The text was updated successfully, but these errors were encountered: