-
Notifications
You must be signed in to change notification settings - Fork 91
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ETQ tech: je veux publier les fichiers opendata selon les bonnes pratiques de data.gouv #11100
base: main
Are you sure you want to change the base?
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #11100 +/- ##
==========================================
- Coverage 84.35% 77.00% -7.36%
==========================================
Files 1176 1186 +10
Lines 25942 26703 +761
Branches 4896 4848 -48
==========================================
- Hits 21884 20562 -1322
- Misses 4058 6141 +2083 ☔ View full report in Codecov by Sentry. |
fa02bd0
to
72004a0
Compare
a232d00
to
aae1858
Compare
1c96411
to
035a21b
Compare
dfab2f4
to
40bb9a0
Compare
40bb9a0
to
e235152
Compare
|
||
url = JSON.parse(response.body)["url"] | ||
|
||
response = Typhoeus.get(url) |
Check failure
Code scanning / CodeQL
Server-side request forgery Critical
user-provided value
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 22 days ago
To fix the problem, we need to ensure that the URL extracted from the response.body
is validated before being used in the subsequent HTTP request. One way to do this is to check that the URL belongs to a trusted domain. We can use the URI
module to parse the URL and verify its host.
- Add a method to validate the URL.
- Use this method to check the URL before making the HTTP request on line 28.
-
Copy modified line R2 -
Copy modified line R27 -
Copy modified lines R96-R103
@@ -1,3 +1,3 @@ | ||
# frozen_string_literal: true | ||
|
||
require 'uri' | ||
class APIDatagouv::API | ||
@@ -26,2 +26,3 @@ | ||
url = JSON.parse(response.body)["url"] | ||
validate_url(url) | ||
|
||
@@ -94,2 +95,10 @@ | ||
end | ||
private | ||
|
||
def validate_url(url) | ||
uri = URI.parse(url) | ||
raise "Invalid URL" unless uri.host == "www.data.gouv.fr" | ||
rescue URI::InvalidURIError | ||
raise "Invalid URL" | ||
end | ||
end |
e235152
to
87c86c7
Compare
6d6cf8e
to
137797a
Compare
137797a
to
4a3cf07
Compare
Dans le dataset "utilisation de DS" : https://www.data.gouv.fr/fr/datasets/utilisation-du-service-demarches-simplifiees/
Aujourd'hui, on ajoute chaque mois une nouvelle resource par type de données :
Ceci ne suit pas les bonnes pratiques de data.gouv pour faciliter la réutilisation.
Il est préférable de maintenir à jour, chaque mois, une même resource par type de données. Cela revient à ajouter de nouvelles lignes aux mêmes fichiers.
PR en draft, cas d'usage sur "Nombre de comptes créés par mois"