Fix CodeQL log injections (#95)

This commit is contained in:
Simon Lecoq
2021-02-03 23:34:59 +01:00
committed by GitHub
parent c42b9a2228
commit 96d59e94c1
2 changed files with 2 additions and 1 deletions

View File

@@ -10,6 +10,7 @@
try {
//Debug
login = login.replace(/[\n\r]/g, "")
console.debug(`metrics/compute/${login} > start`)
console.debug(util.inspect(q, {depth:Infinity, maxStringLength:256}))

View File

@@ -140,7 +140,7 @@
//Metrics
app.get("/:login", ...middlewares, async (req, res) => {
//Request params
const {login} = req.params
const login = req.params.login?.replace(/[\n\r]/g, "")
if ((restricted.length)&&(!restricted.includes(login))) {
console.debug(`metrics/app/${login} > 403 (not in whitelisted users)`)
return res.sendStatus(403)