Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Resolve CodeQL alert 15 "Potentially unsafe external link" #6261

Closed
wants to merge 4 commits into from
Closed

Resolve CodeQL alert 15 "Potentially unsafe external link" #6261

wants to merge 4 commits into from

Conversation

das-mittel
Copy link
Member

Fixes #6049

What changes did you make?

  • Changed line 81 code's a href to include rel="noopener noreferrer"
  • Test viewed the communities-of-practice.html page in Docker

Why did you make the changes (we will use this info to test)?

  • The changes were administered to resolve CodeQL alert 15 "potentially unsafe external link"

Screenshots of Proposed Changes Of The Website (if any, please do not screen shot code changes)

  • Not applicable

@das-mittel
Update 2FA.html
b3517b8 
Changed line 26 code and test viewed the 2FA.html page in Docker
@das-mittel
Merge remote-tracking branch 'upstream/gh-pages' into gh-pages
1ff3ab0
@das-mittel
Revert "Merge remote-tracking branch 'upstream/gh-pages' into gh-pages"
6cd428d 
This reverts commit 1ff3ab0, reversing
changes made to b3517b8.
@das-mittel
Resolve CodeQL alert 15 "potentially unsafe external link"
333d1d5 
Added rel="noopener noreferrer" to fix CodeQL alert 15
@github-actions GitHub Actions
Copy link

github-actions bot commented Feb 6, 2024

Want to review this pull request? Take a look at this documentation for a step by step guide!

From your project repository, check out a new branch and test the changes.

git checkout -b das-mittel-gh-pages gh-pages
git pull https://github.com/das-mittel/website.git gh-pages

Note that CONTRIBUTING.md cannot previewed locally; rather it should be previewed at this URL:

https://github.com/das-mittel/website/blob/gh-pages/CONTRIBUTING.md

@github-actions github-actions bot added good first issue Good for newcomers role: front end Tasks for front end developers role: back end/devOps Tasks for back-end developers P-Feature: Communities of Practice https://www.hackforla.org/communities-of-practice ready for dev lead Issues that tech leads or merge team members need to follow up on size: 0.25pt Can be done in 0.5 to 1.5 hours Feature: Code Alerts labels Feb 6, 2024
github-advanced-security[bot]
github-advanced-security bot found potential problems Feb 6, 2024
View reviewed changes
_layouts/project.html
{% else %}
<p class='leader-description-field'><strong>Name: </strong><a href='{{ item.links.slack }}'target='_blank' title='Slack Direct Message' rel="noopener noreferrer">{{ item.name }}</a></p>
<p class='leader-description-field'><strong>Name: </strong><a href='{{ item.links.slack }}' target='_blank' title='Slack Direct Message'>{{ item.name }}</a></p>

Check warning

Code scanning / CodeQL

Potentially unsafe external link Medium

External links without noopener/noreferrer are a potential security risk.
_layouts/project.html
{% elsif page.status == "Completed" %}
<p class='leader-description-field'><strong>Name: </strong><a href='{{ item.links.github }}' target='_blank' title='GitHub Profile' rel="noopener noreferrer">{{ item.name }}</a></p>
<p class='leader-description-field'><strong>Name: </strong><a href='{{ item.links.github }}' target='_blank' title='GitHub Profile'>{{ item.name }}</a></p>

Check warning

Code scanning / CodeQL

Potentially unsafe external link Medium

External links without noopener/noreferrer are a potential security risk.
_layouts/project.html
@@ -152,11 +152,11 @@
<a href='{{ item.links.github }}' target='_blank' title='GitHub Profile'><img class='leader-img' src='{{ item.picture }}'></a>
<div class='leader-description'>
{% if page.status == "Completed" and item.links.linkedin %}
<p class='leader-description-field'></p><strong>Name: </strong><a href='{{ item.links.linkedin }}' target='_blank' title='Linkedin Profile' rel="noopener noreferrer">{{ item.name }}</a></p>
<p class='leader-description-field'></p><strong>Name: </strong><a href='{{ item.links.linkedin }}' target='_blank' title='Linkedin Profile'>{{ item.name }}</a></p>

Check warning

Code scanning / CodeQL

Potentially unsafe external link Medium

External links without noopener/noreferrer are a potential security risk.
_layouts/project.html
{% assign counter = counter | minus:1 %}
{% elsif counter > 1 %}
<a target="_blank" href='{{ item.url }}' rel="noopener noreferrer">{{ item.name }}</a>{% if forloop.last == false %}, {% endif %}
<a target="_blank" href='{{ item.url }}'>{{ item.name }}</a>{% if forloop.last == false %}, {% endif %}

Check warning

Code scanning / CodeQL

Potentially unsafe external link Medium

External links without noopener/noreferrer are a potential security risk.
_layouts/project.html
@@ -42,10 +42,10 @@
<strong>Links: </strong>
{% for item in page.links %}
{% if counter == 1 %}
<a target="_blank" href='{{ item.url }}' rel="noopener noreferrer"> {{ item.name }}</a>
<a target="_blank" href='{{ item.url }}'> {{ item.name }}</a>

Check warning

Code scanning / CodeQL

Potentially unsafe external link Medium

External links without noopener/noreferrer are a potential security risk.
_layouts/default-markdown.html
<script src="https://cdnjs.cloudflare.com/ajax/libs/babel-standalone/6.26.0/babel.js"
integrity="sha384-5eDs4qg7Mm6lRIqLmB5k7P/GV+iEWdlzONR7lOdXJ/hquF3S4n4Z2u0rbhx8OYXs" crossorigin="anonymous">
</script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/babel-standalone/6.26.0/babel.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
_layouts/default.html
<script src="https://cdnjs.cloudflare.com/ajax/libs/babel-standalone/6.26.0/babel.js"
integrity="sha384-5eDs4qg7Mm6lRIqLmB5k7P/GV+iEWdlzONR7lOdXJ/hquF3S4n4Z2u0rbhx8OYXs" crossorigin="anonymous">
</script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/babel-standalone/6.26.0/babel.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
github-actions/trigger-schedule/github-data/contributors-data.js
@@ -94,7 +84,7 @@
since: date,
per_page: 100,
page: pageNum
});
})

Check notice

Code scanning / CodeQL

Semicolon insertion Note

Avoid automated semicolon insertion (94% of all statements in
the enclosing function
Loading
have an explicit semicolon).
@Thinking-Panda Thinking-Panda self-requested a review February 6, 2024 22:24
@LRenDO
Copy link
Member

LRenDO commented Feb 7, 2024

Hi @das-mittel!

Thanks for taking on this issue! It looks like you have done your work on the gh-pages branch. Pull requests must be made from a branch that you create. It's name should describe the issue you worked on and include the issue number. You will need to sync your fork's gh-pages to the Hack for LA gh-pages. Then pull your origin gh-pages locally. Once your local gh-pages matches the Hack For LA gh-pages, you will need to create a feature branch and complete the work for this issue on the feature branch, push it to your forked repo and create a new pull request. Please see the steps on the How to Contribute to Hack for LA wiki page (Part 2, and 2.7 in particular).

I'm closing this PR since you will need to open a new one on a different branch. Please feel free to ping me here or on Slack if you need help or any clarification.

Thanks!

@LRenDO
Copy link
Member

LRenDO commented Feb 7, 2024

Closing will need to create a new PR on a separate feature branch.

@LRenDO LRenDO closed this Feb 7, 2024
@Thinking-Panda Thinking-Panda removed their request for review February 7, 2024 19:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
Feature: Code Alerts good first issue Good for newcomers P-Feature: Communities of Practice https://www.hackforla.org/communities-of-practice ready for dev lead Issues that tech leads or merge team members need to follow up on role: back end/devOps Tasks for back-end developers role: front end Tasks for front end developers size: 0.25pt Can be done in 0.5 to 1.5 hours
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Resolve CodeQL alert 15 "Potentially unsafe external link"
2 participants
@das-mittel @LRenDO