feat: support to start compose mock proxy servers #670
Conversation
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| h.metrics.RecordRequest(req.URL.Path) | ||
| memLogger.Info("receiving mock request", "name", h.item.Name, "method", req.Method, "path", req.URL.Path, | ||
| "encoder", h.item.Response.Encoder) | ||
|
|
Check warning
Code scanning / CodeQL
Reflected cross-site scripting Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
To fix the issue, we need to ensure that any user-controlled data written to the HTTP response is properly sanitized or escaped to prevent XSS vulnerabilities. Specifically:
- Use the
html.EscapeStringfunction from thehtmlpackage to escape any user-controlled data before writing it to the response. - Apply this escaping to the
h.item.Response.BodyDatabefore it is passed to thewriteResponsefunction.
The changes will be made in the handle method of the advanceHandler struct, ensuring that the h.item.Response.BodyData is sanitized before being written to the response.
| @@ -26,2 +26,3 @@ | ||
| "net/http" | ||
| "html" | ||
| "strings" | ||
| @@ -392,3 +393,5 @@ | ||
|
|
||
| writeResponse(w, h.item.Response.BodyData, err) | ||
| // Escape user-controlled data to prevent XSS | ||
| escapedBodyData := []byte(html.EscapeString(string(h.item.Response.BodyData))) | ||
| writeResponse(w, escapedBodyData, err) | ||
| } |
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferences |
|
There are 1 test cases, failed count 0:
Reported by api-testing. |
1 participant
What type of PR is this?
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes #