Pipeline for Maven #1953
Pipeline for Maven #1953
Conversation
Signed-off-by: Chin Yeung Li <[email protected]>
Signed-off-by: Chin Yeung Li <[email protected]>
Signed-off-by: Chin Yeung Li <[email protected]>
Signed-off-by: Chin Yeung Li <[email protected]>
- Update format Signed-off-by: Chin Yeung Li <[email protected]>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Signed-off-by: Chin Yeung Li <[email protected]>
| input_source_url = input_source.get("download_url", "") | ||
|
|
||
| parsed_url = urlparse(input_source_url) | ||
| if input_source_url and parsed_url.netloc.endswith("maven.org"): |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
To fix the problem, the code should validate the URL host more strictly by parsing the host and ensuring it matches a whitelist of allowed hosts for Maven repositories. The safest approach is to define a set of permitted Maven repository hostnames (such as repo1.maven.org or search.maven.org) and check the parsed hostname against this whitelist. This change should be made in the relevant block in the get_pom_url_list function (lines 594–601). Additional context: ensure case-insensitive comparison and that the check only acts on the hostname portion (already parsed as parsed_url.netloc or parsed_url.hostname). You may need to replace .endswith("maven.org") with an exact match or a match on known subdomains (e.g., using in with a whitelist).
In terms of implementation, you may need to:
- Define an allowed hostnames list (e.g.,
{"repo1.maven.org", "search.maven.org"}). - Use
parsed_url.hostnamefor comparison. - Do a strict compare (
in allowed_hosts), rather than a substring or suffix check. - No additional imports are needed.
Edit only the code shown in file scanpipe/pipes/resolve.py, lines 575–613.
| @@ -592,7 +592,8 @@ | ||
| input_source_url = input_source.get("download_url", "") | ||
|
|
||
| parsed_url = urlparse(input_source_url) | ||
| if input_source_url and parsed_url.netloc.endswith("maven.org"): | ||
| allowed_hosts = {"repo1.maven.org", "search.maven.org"} | ||
| if input_source_url and parsed_url.hostname and parsed_url.hostname.lower() in allowed_hosts: | ||
| base_url = input_source_url.rsplit("/", 1)[0] | ||
| pom_url = ( | ||
| base_url + "/" + "-".join(base_url.rstrip("/").split("/")[-2:]) + ".pom" |
Issue: #1763
Create a pipeline for Maven package