Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: sanitize statusMessage of disallowed chars #357

Merged
merged 4 commits into from
Mar 15, 2023
Merged

Conversation

danielroe
Copy link
Member

πŸ”— Linked issue

❓ Type of change

  • πŸ“– Documentation (updates to the documentation or readme)
  • 🐞 Bug fix (a non-breaking change that fixes an issue)
  • πŸ‘Œ Enhancement (improving an existing functionality like performance)
  • ✨ New feature (a non-breaking change that adds functionality)
  • 🧹 Chore (updates to the build process or auxiliary tools and libraries)
  • ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

πŸ“š Description

It will break the response if we set any of these characters by accident (e.g. if a user includes in an error message).

Related: nuxt/nuxt#14688

πŸ“ Checklist

  • I have linked an issue or discussion.
  • I have updated the documentation accordingly.

@danielroe danielroe added the bug Something isn't working label Mar 15, 2023
@danielroe danielroe requested a review from pi0 March 15, 2023 16:42
@codecov
Copy link

codecov bot commented Mar 15, 2023

Codecov Report

Merging #357 (6ef3696) into main (a5e9fcd) will decrease coverage by 0.36%.
The diff coverage is 44.44%.

❗ Current head 6ef3696 differs from pull request most recent head 7117b79. Consider uploading reports for the commit 7117b79 to get more accurate results

@@            Coverage Diff             @@
##             main     #357      +/-   ##
==========================================
- Coverage   74.61%   74.25%   -0.36%     
==========================================
  Files          25       25              
  Lines        2336     2362      +26     
  Branches      368      368              
==========================================
+ Hits         1743     1754      +11     
- Misses        593      608      +15     
Impacted Files Coverage Ξ”
src/utils/request.ts 85.04% <28.57%> (-13.80%) ⬇️
src/error.ts 77.35% <100.00%> (+0.73%) ⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

// Allowed characters: horizontal tabs, spaces or visible ascii characters: https://www.rfc-editor.org/rfc/rfc7230#section-3.1.2
event.node.res.statusMessage = text.replace(
// eslint-disable-next-line no-control-regex
/[^\u0009\u0020-\u007E]/g,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to mention for future we might extend the scaped for XSS as well (we had report of similar issues with ipx fixed by JSON.stringify and removing more chars)

Copy link
Member

@pi0 pi0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks ❀️

@pi0 pi0 merged commit 40aa8b5 into main Mar 15, 2023
@pi0 pi0 deleted the fix/sanitize-status branch March 15, 2023 17:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants