Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Spike/images inslides #410

Draft
wants to merge 32 commits into
base: main
Choose a base branch
from
Draft

Spike/images inslides #410

wants to merge 32 commits into from
+4,160 −12

Conversation

tomwisecodes
Copy link
Contributor

Description

@vercel Vercel
Copy link

vercel bot commented Nov 28, 2024 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
oak-ai-lesson-assistant ✅ Ready (Inspect) Visit Preview 💬 Add feedback Jan 13, 2025 10:06am

github-advanced-security[bot]
github-advanced-security bot found potential problems Nov 28, 2024
View reviewed changes
packages/api/src/router/imageSearch.ts

return compatibleDomains.some((domain) => {
const matchRegex = new RegExp(
`https?://([^/]*\\.)?${domain.replace(/\./g, "\\.")}`,

Check failure

Code scanning / CodeQL

Incomplete string escaping or encoding High

This does not escape backslash characters in the input.

Copilot Autofix AI about 1 month ago

To fix the problem, we need to ensure that all special characters, including backslashes, are properly escaped in the domain string before it is used to construct the regular expression. The best way to achieve this is to use a well-tested sanitization library or to manually escape all special characters using a regular expression with the global flag.

In this case, we will manually escape all special characters, including backslashes, in the domain string. This involves replacing each special character with its escaped counterpart.

Suggested changeset 1
packages/api/src/router/imageSearch.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/packages/api/src/router/imageSearch.ts b/packages/api/src/router/imageSearch.ts
--- a/packages/api/src/router/imageSearch.ts
+++ b/packages/api/src/router/imageSearch.ts
@@ -181,4 +181,5 @@
     return compatibleDomains.some((domain) => {
+      const escapedDomain = domain.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&');
       const matchRegex = new RegExp(
-        `https?://([^/]*\\.)?${domain.replace(/\./g, "\\.")}`,
+        `https?://([^/]*\\.)?${escapedDomain}`,
         "i",
EOF
@@ -181,4 +181,5 @@
return compatibleDomains.some((domain) => {
const escapedDomain = domain.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&');
const matchRegex = new RegExp(
`https?://([^/]*\\.)?${domain.replace(/\./g, "\\.")}`,
`https?://([^/]*\\.)?${escapedDomain}`,
"i",
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
@github-actions GitHub Actions
Copy link

github-actions bot commented Nov 28, 2024 •
edited
Loading

Playwright test results

passed  14 passed
flaky  1 flaky
skipped  1 skipped

Details

report  Open report ↗︎
stats  16 tests across 15 suites
duration  2 minutes, 32 seconds
commit  73eb125

Flaky tests

No persona › tests/modifiy-lesson.test.ts › Modify a lesson plan › Modify a lesson resource

Skipped tests

No persona › tests/auth.test.ts › authenticate through Clerk UI

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Failed Quality Gate failed

Failed conditions
1 Security Hotspot
5.0% Duplication on New Code (required ≤ 3%)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@tomwisecodes