Repository navigation
Development - #411
Merged
Merged
Development#411
Conversation
chore: sync open-core licensing split from private repo
- url-extractor: replace backtracking-prone /<[^>]+>/g tag stripper with a linear single-pass scan (polynomial ReDoS on unclosed '<'). - billing-controller checkRegion: reject non-IP values from client-controlled x-forwarded-for / x-real-ip headers and encodeURIComponent the value before building the outbound geolocation URL (SSRF / URL injection). - client-portal-auth forgot-password: pass user email as a console.error argument instead of interpolating it into the format string. - frontend/client-portal: strip HTML via the DOM parser / DOMPurify instead of a single-pass regex (incomplete multi-character sanitization). Adds stripHtmlTags() to sanitizeInput and stripHtml() to escapeHtml.
- billing: derive LKR charge amount/currency from server-side pricing in payWithCard instead of trusting client-supplied values; reject unsupported plans/currencies before charging or activating a subscription (CWE-602) - url-extractor: preserve trailing text after an unterminated '<' so URLs following a stray bracket are still extracted - sanitizeInput: correct the inaccurate regex example in stripHtmlTags docs
- billing: JSON.stringify client-supplied amount/plan before logging (CWE-117) - client-portal auth: strip CR/LF from email before logging in forgotPassword (CWE-117) - url-extractor: keep literal '>' that appears outside a tag so URL matches terminate correctly - sanitizeInput: stripHtmlTags returns decoded text (R&D) instead of serialized entities (R&D)
fix(security): address CodeQL findings from PR #409
|
Important Review skippedToo many files! This PR contains 1628 files, which is 1328 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (12)
📒 Files selected for processing (1628)
You can disable this status message by setting the |
| } | ||
| next(); | ||
| }, | ||
| safeControllerFunction(BillingController.handleCardAddResponse) |
| // Authentication routes (no authentication required) | ||
| router.get("/invitation/validate", safeControllerFunction(ClientPortalAuthController.validateInvitation)); | ||
| router.get("/invitation/validate/:slug", safeControllerFunction(ClientPortalAuthController.validateInvitationBySlug)); | ||
| router.post("/invitation/accept", safeControllerFunction(ClientPortalAuthController.acceptInvitation)); |
| router.get("/invitation/validate", safeControllerFunction(ClientPortalAuthController.validateInvitation)); | ||
| router.get("/invitation/validate/:slug", safeControllerFunction(ClientPortalAuthController.validateInvitationBySlug)); | ||
| router.post("/invitation/accept", safeControllerFunction(ClientPortalAuthController.acceptInvitation)); | ||
| router.post("/auth/login", safeControllerFunction(ClientPortalAuthController.clientLogin)); |
| router.get("/invitation/validate/:slug", safeControllerFunction(ClientPortalAuthController.validateInvitationBySlug)); | ||
| router.post("/invitation/accept", safeControllerFunction(ClientPortalAuthController.acceptInvitation)); | ||
| router.post("/auth/login", safeControllerFunction(ClientPortalAuthController.clientLogin)); | ||
| router.post("/auth/refresh", safeControllerFunction(ClientPortalAuthController.refreshClientToken)); |
| customColumnsApiRouter.get("/:id", CustomcolumnsController.getById); | ||
| customColumnsApiRouter.put("/:id", CustomcolumnsController.update); | ||
| customColumnsApiRouter.delete("/:id", CustomcolumnsController.deleteById); | ||
| customColumnsApiRouter.post("/", verifyNonGuestProjectAccess('body', 'project_id'), CustomcolumnsController.create); |
| customColumnsApiRouter.get("/", verifyProjectAccess('query', 'project_id'), CustomcolumnsController.get); | ||
| customColumnsApiRouter.get("/project/:project_id/columns", verifyProjectAccess('params', 'project_id'), CustomcolumnsController.getProjectColumns); | ||
| customColumnsApiRouter.get("/:id", verifyCustomColumnAccess('params', 'id'), CustomcolumnsController.getById); | ||
| customColumnsApiRouter.put("/:id", verifyNonGuestCustomColumnAccess('params', 'id'), CustomcolumnsController.update); |
| @@ -23,4 +21,12 @@ | |||
| projectMembersApiRouter.get("/invitation-link/validate/:token", safeControllerFunction(ProjectMembersController.validateProjectInvitationLink)); | |||
| projectMembersApiRouter.post("/invitation-link/accept/:token", safeControllerFunction(ProjectMembersController.acceptProjectInvitationByLink)); | |||
|
|
|||
| // Guest members management routes | |||
| projectMembersApiRouter.get("/guests", teamOwnerOrAdminValidator, safeControllerFunction(ProjectMembersController.getGuestMembers)); | |||
| projectMembersApiRouter.patch("/guests/deactivate/:id", teamOwnerOrAdminValidator, safeControllerFunction(ProjectMembersController.toggleGuestStatus)); | |||
| // Guest members management routes | ||
| projectMembersApiRouter.get("/guests", teamOwnerOrAdminValidator, safeControllerFunction(ProjectMembersController.getGuestMembers)); | ||
| projectMembersApiRouter.patch("/guests/deactivate/:id", teamOwnerOrAdminValidator, safeControllerFunction(ProjectMembersController.toggleGuestStatus)); | ||
| projectMembersApiRouter.delete("/guests/:id", teamOwnerOrAdminValidator, safeControllerFunction(ProjectMembersController.deleteGuest)); |
|
|
||
| const taskDuplicateApiRouter = express.Router(); | ||
|
|
||
| taskDuplicateApiRouter.post("/duplicate", taskDuplicateBodyValidator, verifyTaskAccess('body', 'task_id'), safeControllerFunction(TaskDuplicateController.duplicate)); | ||
| taskDuplicateApiRouter.post("/duplicate", taskDuplicateBodyValidator, verifyNonGuestTaskAccess('body', 'task_id'), safeControllerFunction(TaskDuplicateController.duplicate)); |
Focused pass over the real (non-noise) CodeQL alerts open on development: - regex-injection: escape user-supplied mention names before building RegExp in task/project comment controllers (new escapeRegExp helper) - request-forgery (SSRF): validate the user-supplied JIRA domain and reject localhost / private / link-local / cloud-metadata hosts, both at credential-validation time and inside jira-provider (new shared/ssrf-guard.ts) - type-confusion-through-parameter-tampering: coerce array/scalar query params to strings in password-strength check and reporting date-range export; strict YYYY-MM-DD validation before interpolating dates - loop-bound-injection: cap CSV parse input length - polynomial-redos: replace anchored trailing-punctuation regex in the URL extractor with a linear scan - incomplete-multi-character-sanitization / bad-tag-filter / incomplete-url-scheme-check: replace hand-rolled regex HTML stripping with sanitize-html (backend validation-helpers, email plaintext, project-files XML validator) and DOMPurify stripHtmlTags (frontend notification body, comment edit) - tainted-format-string: pass interpolated values as separate console args instead of into the format string - xss-through-dom: decode HTML entities without assigning untrusted input to innerHTML - incomplete-url-substring-sanitization / identity-replacement: use a proper hostname suffix check and fix the no-op worklenz.com replace Backend tsc and frontend build both pass.
fix(security): address CodeQL findings on development
# Conflicts: # manage.sh # worklenz-backend/src/ee/middlewares/validators/slack-validators.ts # worklenz-backend/src/ee/tests/subscription-limits.spec.ts # worklenz-frontend/src/ee/api/project-finance-ratecard/project-finance-rate-cards.api.service.ts # worklenz-frontend/src/ee/components/LicenseExpiredModal/LicenseExpiredModal.css # worklenz-frontend/src/ee/components/LicenseExpiredModal/LicenseExpiredModal.tsx # worklenz-frontend/src/ee/components/admin-center/billing/CurrentBill.tsx # worklenz-frontend/src/ee/components/admin-center/billing/account-storage/account-storage.tsx # worklenz-frontend/src/ee/components/admin-center/billing/billing-tables/charges-table.tsx # worklenz-frontend/src/ee/components/admin-center/billing/billing-tables/lkr-payment-history-table.tsx # worklenz-frontend/src/ee/components/admin-center/billing/current-bill.css # worklenz-frontend/src/ee/components/admin-center/billing/current-plan-details/CurrentPlanDetails.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/redeem-code-drawer/redeem-code-drawer.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans-lkr/upgrade-plans-lkr.css # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans-lkr/upgrade-plans-lkr.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/UpgradePlans.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/components/AppSumoAlert.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/components/BusinessTrialCard.css # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/components/BusinessTrialCard.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/components/PlanCard.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/components/PlanCardSkeleton.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/components/PlanFeature.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/components/PlanPriceDisplay.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/components/PlanRibbon.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/components/PlanSelectionControls.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/components/index.ts # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/constants.ts # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/hooks/index.ts # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/hooks/useBusinessTrial.ts # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/hooks/usePaddleCheckout.ts # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/hooks/usePlanFeatures.tsx # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/hooks/usePricingCalculations.ts # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/hooks/useTeamSizeOptions.ts # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/types.ts # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/upgrade-plans.css # worklenz-frontend/src/ee/components/admin-center/billing/drawers/upgrade-plans/utils.ts # worklenz-frontend/src/ee/components/admin-center/billing/pricing-calculator/index.ts # worklenz-frontend/src/ee/components/admin-center/billing/pricing-calculator/pricing-calculator.css # worklenz-frontend/src/ee/components/admin-center/billing/pricing-calculator/pricing-calculator.tsx # worklenz-frontend/src/ee/components/admin-center/billing/pricing-model-selector/index.ts # worklenz-frontend/src/ee/components/admin-center/billing/pricing-model-selector/pricing-model-selector.css # worklenz-frontend/src/ee/components/admin-center/billing/pricing-model-selector/pricing-model-selector.tsx # worklenz-frontend/src/ee/components/client-portal/AddClientDrawer.tsx # worklenz-frontend/src/ee/components/client-portal/AddInvoiceDrawer.tsx # worklenz-frontend/src/ee/components/client-portal/ClientDetailsDrawer.tsx # worklenz-frontend/src/ee/components/client-portal/ClientPortalClientsSettingsDrawer.tsx # worklenz-frontend/src/ee/components/client-portal/ClientSettingsDrawer.tsx # worklenz-frontend/src/ee/components/client-portal/ClientTeamsDrawer.tsx # worklenz-frontend/src/ee/components/client-portal/EditClientDrawer.tsx # worklenz-frontend/src/ee/components/client-portal/EnhancedClientPortalStatusTags.tsx # worklenz-frontend/src/ee/components/client-portal/InviteLinkModal.tsx # worklenz-frontend/src/ee/components/client-portal/NewChatModal.tsx # worklenz-frontend/src/ee/components/projects/integrations/SlackProjectQuickAddModal.tsx # worklenz-frontend/src/ee/components/projects/project-finance/finance-drawer/FinanceDrawer.tsx # worklenz-frontend/src/ee/components/projects/project-finance/finance-table/FinanceTable.tsx # worklenz-frontend/src/ee/components/projects/project-finance/finance-table/finance-table.css # worklenz-frontend/src/ee/components/projects/project-finance/rate-card-drawer/RateCardDrawer.tsx # worklenz-frontend/src/ee/components/projects/project-ratecard/RateCardAssigneeSelector.tsx # worklenz-frontend/src/ee/components/settings/integrations/slack/SlackChannelFormModal.tsx # worklenz-frontend/src/ee/components/settings/integrations/slack/SlackChannelTable.tsx # worklenz-frontend/src/ee/components/settings/integrations/slack/SlackConnectedCard.tsx # worklenz-frontend/src/ee/components/settings/integrations/slack/SlackDisconnectedCard.tsx # worklenz-frontend/src/ee/components/settings/integrations/slack/SlackManageModal.tsx # worklenz-frontend/src/ee/components/settings/integrations/slack/index.ts # worklenz-frontend/src/ee/lib/client-portal/client-portal-constants.ts # worklenz-frontend/src/ee/pages/admin-center/billing/BillingSection.tsx # worklenz-frontend/src/ee/pages/client-portal/chats/chat-container/chat-list.tsx # worklenz-frontend/src/ee/pages/client-portal/chats/client-portal-chats.tsx # worklenz-frontend/src/ee/pages/client-portal/clients/ClientPortalClients.tsx # worklenz-frontend/src/ee/pages/client-portal/clients/ClientsTable.tsx # worklenz-frontend/src/ee/pages/client-portal/clients/clients-table.css # worklenz-frontend/src/ee/pages/client-portal/invoices/client-portal-invoices.tsx # worklenz-frontend/src/ee/pages/client-portal/invoices/invoice-builder/invoice-builder.css # worklenz-frontend/src/ee/pages/client-portal/invoices/invoice-builder/invoice-builder.tsx # worklenz-frontend/src/ee/pages/client-portal/invoices/invoice-details/client-portal-invoice-details.tsx # worklenz-frontend/src/ee/pages/client-portal/invoices/invoice-details/invoice-preview-modal.tsx # worklenz-frontend/src/ee/pages/client-portal/requests/client-portal-requests.tsx # worklenz-frontend/src/ee/pages/client-portal/requests/request-details/client-portal-request-details.tsx # worklenz-frontend/src/ee/pages/client-portal/requests/request-details/request-chat-wrapper.tsx # worklenz-frontend/src/ee/pages/client-portal/services/ServicesTable.tsx # worklenz-frontend/src/ee/pages/client-portal/services/add-service/ClientPortalAddServices.tsx # worklenz-frontend/src/ee/pages/client-portal/services/add-service/add-service-stepper.css # worklenz-frontend/src/ee/pages/client-portal/services/add-service/modal-stepper/PreviewAndSubmitStep.tsx # worklenz-frontend/src/ee/pages/client-portal/services/add-service/modal-stepper/RequestFormStep.tsx # worklenz-frontend/src/ee/pages/client-portal/services/add-service/modal-stepper/ServiceDetailsStep.tsx # worklenz-frontend/src/ee/pages/client-portal/services/client-portal-services.tsx # worklenz-frontend/src/ee/pages/client-portal/services/edit-service/client-portal-edit-service.tsx # worklenz-frontend/src/ee/pages/client-portal/services/edit-service/edit-preview-and-submit-step.tsx # worklenz-frontend/src/ee/pages/client-portal/services/edit-service/edit-service-stepper.css # worklenz-frontend/src/ee/pages/client-portal/settings/ClientPortalSettings.tsx # worklenz-frontend/src/ee/pages/license-expired/LicenseExpired.tsx # worklenz-frontend/src/ee/pages/settings/slack-integration/slack-integration.tsx # worklenz-frontend/src/ee/types/project/project-finance.types.ts # worklenz-frontend/src/ee/utils/subscription-utils.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.