chore: add http proxy test #2433
Conversation
|
This PR will trigger no release when merged. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| try { | ||
| // Delete accept header due to nock conflict | ||
| delete req.headers.accept; | ||
| console.log('http proxy request', req.url); |
Check warning
Code scanning / CodeQL
Log injection Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 3 months ago
To fix the log injection issue, we need to sanitize the req.url before logging it. Specifically, we should remove any newline characters from the URL to prevent log injection attacks. This can be achieved using the String.prototype.replace method to strip out newline characters.
- General fix: Sanitize user input before logging it to prevent log injection.
- Detailed fix: Modify the code to replace newline characters in
req.urlwith an empty string before logging it. - Specific changes: Update the logging statements on lines 286 and 288 to sanitize
req.url. - Requirements: No additional methods or definitions are needed, but we will modify the existing logging statements.
| @@ -285,5 +285,6 @@ | ||
| delete req.headers.accept; | ||
| console.log('http proxy request', req.url); | ||
| const sanitizedUrl = req.url.replace(/\n|\r/g, ""); | ||
| console.log('http proxy request', sanitizedUrl); | ||
| const resp = await h1NoCache().fetch(req.url, {}); | ||
| console.log('http proxy response for', req.url, resp.status); | ||
| console.log('http proxy response for', sanitizedUrl, resp.status); | ||
| res.writeHead(resp.status, resp.headers.plain()); |
| delete req.headers.accept; | ||
| console.log('http proxy request', req.url); | ||
| const resp = await h1NoCache().fetch(req.url, {}); | ||
| console.log('http proxy response for', req.url, resp.status); |
Check warning
Code scanning / CodeQL
Log injection Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 3 months ago
To fix the log injection issue, we need to sanitize the req.url before logging it. Specifically, we should remove any newline characters from the URL to prevent log injection attacks. This can be done using the String.prototype.replace method to replace newline characters with an empty string.
| @@ -285,5 +285,6 @@ | ||
| delete req.headers.accept; | ||
| console.log('http proxy request', req.url); | ||
| const resp = await h1NoCache().fetch(req.url, {}); | ||
| console.log('http proxy response for', req.url, resp.status); | ||
| const sanitizedUrl = req.url.replace(/\n|\r/g, ""); | ||
| console.log('http proxy request', sanitizedUrl); | ||
| const resp = await h1NoCache().fetch(sanitizedUrl, {}); | ||
| console.log('http proxy response for', sanitizedUrl, resp.status); | ||
| res.writeHead(resp.status, resp.headers.plain()); |
No description provided.