Release/v3.32.0 #3761
Open
Release/v3.32.0 #3761
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 30 commits
May 16, 2024 12:09
…inks and metadata
added 24 commits
June 12, 2024 13:29
…DOUT_MAX_SIZE error for wide csvs
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| if (window.location.origin.startsWith('http://localhost')) { | ||
| // If we are running on localhost, we want to use the local server for authentication | ||
| sessionStorage.setItem(this.user.username, this.user.password); |
Check failure
Code scanning / CodeQL
Clear text storage of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 11 days ago
To fix the problem, we need to ensure that the password is encrypted before storing it in sessionStorage. We can use the Web Crypto API to encrypt the password. This will involve generating a key, encrypting the password, and then storing the encrypted password in sessionStorage.
Suggested changeset
1
online-survey-app/src/app/core/auth/_components/login/login.component.ts
| @@ -40,3 +40,4 @@ | ||
| // If we are running on localhost, we want to use the local server for authentication | ||
| sessionStorage.setItem(this.user.username, this.user.password); | ||
| const encryptedPassword = await this.encryptPassword(this.user.password); | ||
| sessionStorage.setItem(this.user.username, encryptedPassword); | ||
| this.router.navigate([this.returnUrl]); | ||
| @@ -52,2 +53,22 @@ | ||
| } | ||
|
|
||
| async encryptPassword(password: string): Promise<string> { | ||
| const encoder = new TextEncoder(); | ||
| const data = encoder.encode(password); | ||
| const key = await crypto.subtle.generateKey( | ||
| { name: "AES-GCM", length: 256 }, | ||
| true, | ||
| ["encrypt", "decrypt"] | ||
| ); | ||
| const iv = crypto.getRandomValues(new Uint8Array(12)); | ||
| const encrypted = await crypto.subtle.encrypt( | ||
| { name: "AES-GCM", iv: iv }, | ||
| key, | ||
| data | ||
| ); | ||
| const encryptedArray = new Uint8Array(encrypted); | ||
| const ivArray = Array.from(iv); | ||
| const encryptedPassword = ivArray.concat(Array.from(encryptedArray)); | ||
| return btoa(String.fromCharCode(...encryptedPassword)); | ||
| } | ||
|
|
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
[What is the business, user experience or technical problem? What is the motivation or context? Any Dependencies required for the change? e.g
tangy-formsversion etc][List the issues fixed and any other relevant issues]
Type of Change
[Please delete irrelevant options]
Proposed Solution
[Please give a description of the solution proposed in the PR]
Limitations and Trade-offs
[Optional. What are the limitations of the proposed solution? What are the potential edge cases that one should be aware of? What are some of the tradeoffs? What are some of the approaches considered and not used? Why were they not used? ]
Security considerations
Screenshots/Videos
[Optional. Post screenshots or videos to explain this change visually.]
Tests
[How you tested (or have not tested) this PR and what where those steps.]
Notices, Regressions, Breaking Changes
[Optional. Impacts to developers, project or structure that is required to be communicated.]
TODOS/enhancements
[Optional. List out the remaining tasks that would complete this pull request.]