feat: add ui extension point #801
Conversation
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferences |
|
There are 1 test cases, failed count 0:
Reported by api-testing. |
|
hi @yuluo-yx this PR is still working on. And I need to do more tests. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if err == nil { | ||
| h.item.Response.Header[util.ContentLength] = fmt.Sprintf("%d", len(h.item.Response.BodyData)) | ||
| w.Header().Set(util.ContentLength, h.item.Response.Header[util.ContentLength]) | ||
| } |
Check warning
Code scanning / CodeQL
Reflected cross-site scripting Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
To fix the reflected XSS vulnerability, all user-controlled data that may be rendered into an HTTP response must be properly escaped for the context in which it appears. The best way to do this is to ensure that any user input (such as route parameters from mux.Vars(req)) is HTML-escaped before being included in the response body, if the response is of a type that could be interpreted as HTML by browsers.
The most robust fix is to HTML-escape all route parameters when they are added to h.item.Param, so that any template rendering or direct output will use the escaped values. This can be done by wrapping the values with html.EscapeString from the Go standard library. You will need to import the html package.
Files/regions/lines to change:
- In
pkg/mock/in_memory.go, in the loop at lines 436-438, wrap each value frommux.Vars(req)withhtml.EscapeStringbefore assigning toh.item.Param. - Add an import for
"html"if not already present.
| @@ -23,2 +23,3 @@ | ||
| "fmt" | ||
| "html" | ||
| "io" | ||
| @@ -436,3 +437,3 @@ | ||
| for k, v := range mux.Vars(req) { | ||
| h.item.Param[k] = v | ||
| h.item.Param[k] = html.EscapeString(v) | ||
| } |
|
What type of PR is this?
What this PR does / why we need it:
See #204
Which issue(s) this PR fixes:
Fixes #