-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(security): add injection prevention #139
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good idea! Works well to stop the kind of injections you mention in #137 and I tried my best at breaking it and it seems robust. I added a test suite to it.
Since the code is rather short, some of my comments are borderline bikeshedding.
Once again great feedback! I applied some changes. |
I changed some more stuff based on review. Should be ready now? 🤞 |
Fix the merge conflicts and it's ready to go |
d34dbc2
to
ae807aa
Compare
…athy/ftrack-javascript into feature/injection-prevention
Alright, should be good to go now! |
* feat(security): add injection prevention * Update session.ts * Add tests for template tag * Add the prepared import to the test * fix: review changes * chore: rename `prepared` to `expression` * fix: conflict fixes * fix: compile errors --------- Co-authored-by: Lars Johansson <gismya@gmail.com>
Changes
I have added a new
prepared
tagged template literal, which helps protect against injection. I'll need confirmation on whether or not this is enough. See #137.Test
An example of how to use it: