Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

MAP-1600 Code injection #2362

Closed
wants to merge 2 commits into from
Closed

MAP-1600 Code injection #2362

wants to merge 2 commits into from

Conversation

tobyprivett
Copy link
Contributor

@tobyprivett tobyprivett commented Oct 8, 2024 •
edited
Loading

Jira link

MAP-1600

What?

Upgraded CodeQL to use V3.

Refactored controller method to initialize a GenericEvent class from the constant name rather than user input.

Why

https://github.com/ministryofjustice/hmpps-book-secure-move-api/security/code-scanning/3

@tobyprivett tobyprivett changed the title [MAP-1600] Code injection MAP-1600 Code injection Oct 8, 2024
@tobyprivett
Prefer CodeQL v3
6ec0409 
- v1 is way out of date
@tobyprivett tobyprivett force-pushed the MAP-1600-code-injection branch 2 times, most recently from bcf9350 to 68058c4 Compare October 8, 2024 16:04
@tobyprivett tobyprivett marked this pull request as ready for review October 8, 2024 16:08
@tobyprivett tobyprivett requested a review from a team as a code owner October 8, 2024 16:08
@tobyprivett tobyprivett marked this pull request as draft October 8, 2024 16:19
@tobyprivett
Copy link
Contributor Author

Closing this because the input params are validated before reaching this vulnerability:

hmpps-book-secure-move-api/app/services/generic_events/common_params_validator.rb

Line 23 in 0f8c697

validates_inclusion_of :eventable_type, in: EVENTABLE_TYPES, message: "'%{value}' is not a valid eventable type"

@tobyprivett tobyprivett marked this pull request as ready for review October 9, 2024 10:25
@tobyprivett tobyprivett closed this Oct 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@tobyprivett