Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix code scanning alert no. 111: Incomplete URL substring sanitization #12305

Merged
merged 3 commits into from
Jan 2, 2025

Conversation

laipz8200
Copy link
Member

Fixes https://github.com/langgenius/dify/security/code-scanning/111

To fix the problem, we need to parse the URL and ensure that the host is correctly validated. Instead of using startswith and endswith, we will use the urlparse function from the urllib.parse module to extract the hostname and validate it.

  1. Parse the URL using urlparse.
  2. Check if the hostname is "github.com".
  3. Ensure the path ends with ".yml" or ".yaml".
  4. Replace the URL parts to convert it to the raw GitHub URL if the checks pass.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@laipz8200 laipz8200 marked this pull request as ready for review January 2, 2025 08:38
@dosubot dosubot bot added size:XS This PR changes 0-9 lines, ignoring generated files. 🐞 bug Something isn't working labels Jan 2, 2025
@dosubot dosubot bot added the lgtm This PR has been approved by a maintainer label Jan 2, 2025
@laipz8200 laipz8200 merged commit 0e63176 into main Jan 2, 2025
8 checks passed
@laipz8200 laipz8200 deleted the alert-autofix-111 branch January 2, 2025 08:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🐞 bug Something isn't working lgtm This PR has been approved by a maintainer size:XS This PR changes 0-9 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants