Production Release (#708)

felder101 · web-flow · commit d3cb254979f9 · 2024-12-06T09:17:15.000-05:00
Sprint 44 Issues: December 2024 Separation Report - Remove User #702 Static Code Vulnerability: js/incomplete-URL-substring-sanitization #698
diff --git a/requirements.txt b/requirements.txt
@@ -10,4 +10,4 @@ alembic==1.10.2
 PyMuPDF==1.21.1
 pydantic-settings==2.0.2
 email-validator==2.0.0.post2
-python-multipart==0.0.7
+python-multipart==0.0.18
diff --git a/training-front-end/src/plugins/uswds_links.js b/training-front-end/src/plugins/uswds_links.js
@@ -18,8 +18,11 @@ export function processLinksPlugin() {
           // these will all be local, so ignore
           return
         }
-
-        if (!(domain.hostname === 'gsa.gov' || domain.hostname === 'www.gsa.gov'|| domain.protocol === 'mailto:')) {
+        const internalHost = [
+          'gsa.gov',
+          'www.gsa.gov'
+        ]
+        if (!(internalHost.includes(domain.hostname) || domain.protocol === 'mailto:')) {
           properties.className += ' usa-link--external'
         }
 

Original file line number	Diff line number	Diff line change
`@@ -18,8 +18,11 @@ export function processLinksPlugin() {`
`18`	`18`	`// these will all be local, so ignore`
`19`	`19`	`return`
`20`	`20`	`}`
`21`		`-`
`22`		`- if (!(domain.hostname === 'gsa.gov' \|\| domain.hostname === 'www.gsa.gov'\|\| domain.protocol === 'mailto:')) {`
	`21`	`+ const internalHost = [`
	`22`	`+ 'gsa.gov',`
	`23`	`+ 'www.gsa.gov'`
	`24`	`+ ]`
	`25`	`+ if (!(internalHost.includes(domain.hostname) \|\| domain.protocol === 'mailto:')) {`
`23`	`26`	`properties.className += ' usa-link--external'`
`24`	`27`	`}`
`25`	`28`