Mastodon Feed: Post

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

I, for one, think it is extremely awesome and high tech that we get AI suggestions to add multiple slightly different, single-use functions defined in place in the same location in every pull request now.

particularly since it's trying to 'protect' against a thing that if it were to be exploited would mean that the entire server was already pwned.

sure yeah why not define getSafeExternalUrl and sanitizeExternalUrl ... twice ... in the ... footer component ... to sanitize constants

https://github.com/NeuromatchAcademy/mastodon/pull/90#discussion%5Fr3700733027

[[A variable statusPageUrl is used as the href in a link] @github-advanced-security Severity: High CodeQL / DOM text reinterpreted as HTML: DOM text is reinterpreted as HTML without escaping meta-characters. A proposed fix, getSafeExternalUrl defines at the top of the link_footer.tsx file that casts it to a URL object and returns href if the protocol is http or https
[A variable source_url is used as the href in a link] @github-advanced-security Severity: High CodeQL / DOM text reinterpreted as HTML: DOM text is reinterpreted as HTML without escaping meta-characters. [A very similar but slightly different proposed fix, sanitizeExternalUrl defines at the top of the link_footer.tsx file that casts it to a URL object and returns toString() if the protocol is http or https]