sudacode/metrics
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Fix CodeQL log injections (#95)

Browse Source
This commit is contained in:
Simon Lecoq
2021-02-03 23:34:59 +01:00
committed by GitHub
parent c42b9a2228
commit 96d59e94c1
2 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
source/app/metrics/index.mjs
View File

@@ -10,6 +10,7 @@
try { try {
//Debug //Debug
login = login.replace(/[\n\r]/g, "")
console.debug(`metrics/compute/${login} > start`) console.debug(`metrics/compute/${login} > start`)
console.debug(util.inspect(q, {depth:Infinity, maxStringLength:256})) console.debug(util.inspect(q, {depth:Infinity, maxStringLength:256}))

2
source/app/web/instance.mjs
View File

@@ -140,7 +140,7 @@
//Metrics //Metrics
app.get("/:login", ...middlewares, async (req, res) => { app.get("/:login", ...middlewares, async (req, res) => {
//Request params //Request params
const {login} = req.params const login = req.params.login?.replace(/[\n\r]/g, "")
if ((restricted.length)&&(!restricted.includes(login))) { if ((restricted.length)&&(!restricted.includes(login))) {
console.debug(`metrics/app/${login} > 403 (not in whitelisted users)`) console.debug(`metrics/app/${login} > 403 (not in whitelisted users)`)
return res.sendStatus(403) return res.sendStatus(403)