You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.
Type of change
Bug fix
New feature
Enhancement
Refactoring
Documentation
Other ( please specify )
How Has This Been Tested?
Please describe the tests that you ran to verify your changes. Please also note any relevant details for your test configuration.
Test A
Test B
Checklist:
My code follows the style guidelines of this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
My changes generate no new warnings
Any dependent changes have been merged and published in downstream modules
@drtechie and @ravishanigarapu
As you can see there is a codeql error in FetosenseServiceImpl-> generatePDF method. As a fix , I given condition to check the protocol in the reportPath for sanitization. But still codeql error is coming.
Can we make this as a false positive case ? Pls suggest on this.
@devikasuresh20 As far as I understand, CodeQL has detected reportPathas a user provided input.
If you check the paths for this error, it looks like reportPath is coming via an API.
This URL is in turn used to initiate a connection - the reason for this security error.
I am not sure of the context, if the report is in an external system and if you know the domain of the reportPath, then add that as a criterion (see the example code provided in the issue).
@drtechie
I added condition to check the domain of reportPath , but still same issue. Here I am comparing the domain using "contains()", because reportPath is different for each record.
@drtechie As discussed, I added host name check also. But still same error from codeql.
In HWC API, the same logic is working fine without any domain check.
#35)
* Corrected the properties variable name for ANC fetosense test
* Corrected partner fetosense Id variable name in FeotalMonitorData
* Corrected GeneratePDF from reportPath
* Added protocol check condition to identify invalid protocol
* Added condition to check filepath
* Added new URL inside condition check
* Added hostname comparison in foetalMonitor update
* fetosense update api - generate pdf changes
---------
Co-authored-by: Devika <[email protected]>
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Description
Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.
Type of change
How Has This Been Tested?
Please describe the tests that you ran to verify your changes. Please also note any relevant details for your test configuration.
Checklist: