feat: new kms api example module branch#6119
feat: new kms api example module branch#6119mtexeira-simtlix wants to merge 13 commits intomasterfrom
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| // parse request | ||
| try { | ||
| console.log('POST /key', req.body); |
Check warning
Code scanning / CodeQL
Log injection Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the issue, we need to sanitize the user-provided input (req.body) before logging it. Specifically:
- Remove any newline (
\n) or carriage return (\r) characters from the input to prevent log injection. - Clearly mark the user input in the log entry to distinguish it from other log data.
This can be achieved by using JSON.stringify to serialize the req.body object and then replacing newline and carriage return characters with an empty string. This ensures that the logged data is safe and does not introduce unintended log entries.
| @@ -88,3 +88,4 @@ | ||
| try { | ||
| console.log('POST /key', req.body); | ||
| const sanitizedBody = JSON.stringify(req.body).replace(/[\n\r]/g, ''); | ||
| console.log('POST /key', sanitizedBody); | ||
| ZodPostKeySchema.parse(req.body); |
| return; | ||
| } | ||
|
|
||
| const { prv, pub, coin, source, type, userKeyProvider, backupKeyProvider } = req.body; |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the issue, we should remove the unused variable backupKeyProvider from the destructuring assignment on line 97. This will eliminate the unnecessary variable and improve code clarity and maintainability. No other changes are required, as the removal of this variable does not affect the functionality of the code.
| @@ -96,3 +96,3 @@ | ||
|
|
||
| const { prv, pub, coin, source, type, userKeyProvider, backupKeyProvider } = req.body; | ||
| const { prv, pub, coin, source, type, userKeyProvider } = req.body; | ||
|
|
|
Closing this branch as all the changes were moved to another repo. Thanks. |
2 participants
Ticket: WP-4379