show stats for specific organizations or repositories #1
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| renderError( | ||
| "Something went wrong", | ||
| "Username, repository or owner contains unsafe characters", | ||
| { | ||
| title_color, | ||
| text_color, | ||
| bg_color, | ||
| border_color, | ||
| theme, | ||
| }, | ||
| ), |
Check failure
Code scanning / CodeQL
Reflected cross-site scripting High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 17 days ago
To fix the issue, we need to sanitize or encode the user-provided values before embedding them into the SVG markup. The best approach is to use an HTML encoding function to ensure that any special characters in the user input are safely escaped. This prevents malicious scripts from being executed in the browser.
The encodeHTML function already exists in src/common/utils.js and can be used for this purpose. We will apply this function to all user-provided values (title_color, text_color, bg_color, border_color, etc.) before they are used in the renderError function.
| @@ -381,8 +381,13 @@ | ||
| // returns theme based colors with proper overrides and defaults | ||
| const { titleColor, textColor, bgColor, borderColor } = getCardColors({ | ||
| title_color, | ||
| text_color, | ||
| const { | ||
| titleColor, | ||
| textColor, | ||
| bgColor, | ||
| borderColor | ||
| } = getCardColors({ | ||
| title_color: encodeHTML(title_color), | ||
| text_color: encodeHTML(text_color), | ||
| icon_color: "", | ||
| bg_color, | ||
| border_color, | ||
| bg_color: encodeHTML(bg_color), | ||
| border_color: encodeHTML(border_color), | ||
| ring_color: "", |
| renderStatsCard( | ||
| stats, | ||
| { | ||
| hide: parseArray(hide), | ||
| show_icons: parseBoolean(show_icons), | ||
| hide_title: parseBoolean(hide_title), | ||
| hide_border: parseBoolean(hide_border), | ||
| card_width: parseInt(card_width, 10), | ||
| hide_rank: parseBoolean(hide_rank), | ||
| include_all_commits: parseBoolean(include_all_commits), | ||
| line_height, | ||
| title_color, | ||
| ring_color, | ||
| icon_color, | ||
| text_color, | ||
| text_bold: parseBoolean(text_bold), | ||
| bg_color, | ||
| theme, | ||
| custom_title, | ||
| border_radius, | ||
| border_color, | ||
| number_format, | ||
| locale: locale ? locale.toLowerCase() : null, | ||
| disable_animations: parseBoolean(disable_animations), | ||
| rank_icon, | ||
| show: showStats, | ||
| }, | ||
| username, | ||
| repositories, | ||
| organizations, | ||
| ), |
Check failure
Code scanning / CodeQL
Reflected cross-site scripting High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 17 days ago
To fix the issue, we need to sanitize or encode the user-provided input before incorporating it into the SVG response. The best approach is to use a library like escape-html to ensure that any potentially malicious characters in the input are properly escaped. This will prevent the execution of injected scripts or other malicious content.
Steps to fix:
- Import the
escape-htmllibrary inapi/index.js. - Apply
escape-htmlto all user-provided inputs that are passed torenderStatsCard, includingtitle_color,ring_color,icon_color,text_color,bg_color,border_color, and other relevant parameters. - Ensure that all inputs are sanitized before being used in the SVG response.
| @@ -1,2 +1,3 @@ | ||
| import { renderStatsCard } from "../src/cards/stats-card.js"; | ||
| import escapeHtml from "escape-html"; | ||
| import { blacklist } from "../src/common/blacklist.js"; | ||
| @@ -141,16 +142,16 @@ | ||
| line_height, | ||
| title_color, | ||
| ring_color, | ||
| icon_color, | ||
| text_color, | ||
| title_color: escapeHtml(title_color), | ||
| ring_color: escapeHtml(ring_color), | ||
| icon_color: escapeHtml(icon_color), | ||
| text_color: escapeHtml(text_color), | ||
| text_bold: parseBoolean(text_bold), | ||
| bg_color, | ||
| theme, | ||
| custom_title, | ||
| border_radius, | ||
| border_color, | ||
| number_format, | ||
| locale: locale ? locale.toLowerCase() : null, | ||
| bg_color: escapeHtml(bg_color), | ||
| theme: escapeHtml(theme), | ||
| custom_title: escapeHtml(custom_title), | ||
| border_radius: escapeHtml(border_radius), | ||
| border_color: escapeHtml(border_color), | ||
| number_format: escapeHtml(number_format), | ||
| locale: locale ? escapeHtml(locale.toLowerCase()) : null, | ||
| disable_animations: parseBoolean(disable_animations), | ||
| rank_icon, | ||
| rank_icon: escapeHtml(rank_icon), | ||
| show: showStats, |
| @@ -68,3 +68,4 @@ | ||
| "upgrade": "^1.1.0", | ||
| "word-wrap": "^1.2.5" | ||
| "word-wrap": "^1.2.5", | ||
| "escape-html": "^1.0.3" | ||
| }, |
| Package | Version | Security advisories |
| escape-html (npm) | 1.0.3 | None |
| renderError( | ||
| "Something went wrong", | ||
| "Username or repository contains unsafe characters", | ||
| { | ||
| title_color, | ||
| text_color, | ||
| bg_color, | ||
| border_color, | ||
| theme, | ||
| }, | ||
| ), |
Check failure
Code scanning / CodeQL
Reflected cross-site scripting High
| include_issues_commented = false, | ||
| ) => { | ||
| let owner = username; | ||
| if (reponame && reponame.includes("/")) { |
Check failure
Code scanning / CodeQL
Type confusion through parameter tampering Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 17 days ago
To fix the issue, the type of the repo parameter should be explicitly checked to ensure it is a string before performing any operations on it. This can be done by adding a type check (typeof repo === 'string') in api/pin.js before passing repo to fetchRepo. Additionally, similar type checks should be added in src/fetchers/repo-fetcher.js to ensure reponame is a string before performing operations like includes and split.
| @@ -82,3 +82,3 @@ | ||
| let owner = username; | ||
| if (reponame && reponame.includes("/")) { | ||
| if (reponame && typeof reponame === 'string' && reponame.includes("/")) { | ||
| const [parsed_owner, parsed_repo] = reponame.split("/"); |
| @@ -65,3 +65,3 @@ | ||
| (username && !safePattern.test(username)) || | ||
| (repo && !safePattern.test(repo)) | ||
| (repo && (typeof repo !== 'string' || !safePattern.test(repo))) | ||
| ) { |
see upstream PR