style: Format all files with Prettier#16
Conversation
- Run prettier --write on all files - Fix formatting issues in 42 files - Ensure consistent code style across project
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| <p className="text-sm text-muted-foreground mt-2"> | ||
| <strong>Alternative:</strong> Check{" "} | ||
| <a | ||
| href={`https://pypistats.org/packages/${packageInfo?.info?.name || packageName}`} |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
To fix the problem, sanitize and validate any user-supplied data before interpolating it into the anchor tag’s href attribute. Since the external service only expects package names that match a well-defined format (typically, a valid package name for npm or PyPI), we should ensure packageName and packageInfo?.info?.name are valid package names before constructing URLs with them. A simple way is to define a function that strips or restricts disallowed characters (i.e., only allow valid package name characters: alphanumerics, dashes, underscores, periods), and use it to sanitize the names before constructing the href URL. As the code only shows the anchor interpolation region, the best fix is to wrap the interpolated value with a sanitizer. Implement the function in the same file (since only app/page.tsx is shown), and use it at the link construction site.
| @@ -27,6 +27,12 @@ | ||
|
|
||
| type PackageManager = "npm" | "pypi"; | ||
|
|
||
| // Sanitize package names by stripping unsafe characters | ||
| function sanitizePackageName(pkgName: string): string { | ||
| // Accept alphanumeric, underscore, dash, dot; remove everything else | ||
| return (pkgName || "").replace(/[^a-zA-Z0-9._-]/g, ""); | ||
| } | ||
|
|
||
| export default function Home() { | ||
| const [packageManager, setPackageManager] = useState<PackageManager>("npm"); | ||
| const [packageName, setPackageName] = useState(""); | ||
| @@ -699,7 +705,7 @@ | ||
| <p className="text-sm text-muted-foreground mt-2"> | ||
| <strong>Alternative:</strong> Check{" "} | ||
| <a | ||
| href={`https://pypistats.org/packages/${packageInfo?.info?.name || packageName}`} | ||
| href={`https://pypistats.org/packages/${sanitizePackageName(packageInfo?.info?.name || packageName)}`} | ||
| target="_blank" | ||
| rel="noopener noreferrer" | ||
| className="text-primary hover:underline" |
1 participant
Description
Type of Change
Related Issues
Closes #
Changes Made
Screenshots (if applicable)
Testing
Checklist
Additional Notes