Kaynağa Gözat

[+] CodeQL Report Fix log injection vulnerability in useSyncStore

Severity : High
Sanitize the 'res' object before logging it in the 'check' method of useSyncStore to prevent log injection attacks.
The 'res' object is now sanitized by extracting only the necessary properties ('status', 'statusText', and 'headers') and logging the sanitized object instead.
This ensures that only safe and expected data is logged, mitigating the risk of log injection vulnerabilities.
B0zal 1 yıl önce
ebeveyn
işleme
605dd72354
1 değiştirilmiş dosya ile 6 ekleme ve 1 silme
  1. 6 1
      app/store/sync.ts

+ 6 - 1
app/store/sync.ts

@@ -56,7 +56,12 @@ export const useSyncStore = createPersistStore(
           method: "PROFIND",
           method: "PROFIND",
           headers: this.headers(),
           headers: this.headers(),
         });
         });
-        console.log(res);
+        const sanitizedRes = {
+          status: res.status,
+          statusText: res.statusText,
+          headers: res.headers,
+        };
+        console.log(sanitizedRes);
         return res.status === 207;
         return res.status === 207;
       } catch (e) {
       } catch (e) {
         console.error("[Sync] ", e);
         console.error("[Sync] ", e);