Skip to content

Commit 8d4f738

Browse files
dogusatas7ab059789
authored andcommitted
fix(amazonq): security: disable auto linkify of text links in chat aws#6449
## Problem - Links incoming from Q responses can redirect to a vulnerable site depending on the used context from the files. ## Solution - Linkify strategy is updated to only accept links with `[TEXT](URL)` format. (through MynahUI version [4.21.6](https://github.com/aws/mynah-ui/releases/tag/v4.21.6)) MynahUI PR: aws/mynah-ui#226
1 parent c9595fa commit 8d4f738

File tree

3 files changed

+9
-5
lines changed

3 files changed

+9
-5
lines changed

package-lock.json

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"type": "Bug Fix",
3+
"description": "For security reasons, disabled auto linkify for link texts coming in markdown other than [TEXT](URL) format"
4+
}

packages/core/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -510,7 +510,7 @@
510510
"@aws-sdk/property-provider": "3.46.0",
511511
"@aws-sdk/smithy-client": "^3.46.0",
512512
"@aws-sdk/util-arn-parser": "^3.46.0",
513-
"@aws/mynah-ui": "^4.21.5",
513+
"@aws/mynah-ui": "^4.21.6",
514514
"@gerhobbelt/gitignore-parser": "^0.2.0-9",
515515
"@iarna/toml": "^2.2.5",
516516
"@smithy/middleware-retry": "^2.3.1",

0 commit comments

Comments
 (0)