[PR #143] [MERGED] Fix code scanning alert no. 12: Full server-side request forgery #233

New issue

Closed

opened 2026-03-02 23:34:43 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 23:34:43 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/AJaySi/ALwrity/pull/143
Author: @AJaySi
Created: 1/5/2025
Status: ✅ Merged
Merged: 1/14/2025
Merged by: @AJaySi

Base: main ← Head: alert-autofix-12

📝 Commits (2)

35061c0 Fix code scanning alert no. 12: Full server-side request forgery
02c642c Merge branch 'main' into alert-autofix-12

📊 Changes

1 file changed (+8 additions, -0 deletions)

View changed files

📝 lib/ai_seo_tools/wordcloud.py (+8 -0)

📄 Description

Fixes https://github.com/AJaySi/AI-Writer/security/code-scanning/12

To fix the problem, we need to validate the user-provided URL to ensure it only allows requests to authorized domains. One way to achieve this is by maintaining a list of allowed domains and checking if the user-provided URL belongs to one of these domains before making the request.

Add a list of authorized domains.
Parse the user-provided URL and check if its domain is in the list of authorized domains.
If the domain is not authorized, display an error message and stop the execution.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/AJaySi/ALwrity/pull/143 **Author:** [@AJaySi](https://github.com/AJaySi) **Created:** 1/5/2025 **Status:** ✅ Merged **Merged:** 1/14/2025 **Merged by:** [@AJaySi](https://github.com/AJaySi) **Base:** `main` ← **Head:** `alert-autofix-12` --- ### 📝 Commits (2) - [`35061c0`](https://github.com/AJaySi/ALwrity/commit/35061c0213f7b83eb840d9e4dd874b7536128f20) Fix code scanning alert no. 12: Full server-side request forgery - [`02c642c`](https://github.com/AJaySi/ALwrity/commit/02c642c81bde3411a90a60cf9f0ecdcc302288e1) Merge branch 'main' into alert-autofix-12 ### 📊 Changes **1 file changed** (+8 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `lib/ai_seo_tools/wordcloud.py` (+8 -0) </details> ### 📄 Description Fixes [https://github.com/AJaySi/AI-Writer/security/code-scanning/12](https://github.com/AJaySi/AI-Writer/security/code-scanning/12) To fix the problem, we need to validate the user-provided URL to ensure it only allows requests to authorized domains. One way to achieve this is by maintaining a list of allowed domains and checking if the user-provided URL belongs to one of these domains before making the request. - Add a list of authorized domains. - Parse the user-provided URL and check if its domain is in the list of authorized domains. - If the domain is not authorized, display an error message and stop the execution. _Suggested fixes powered by Copilot Autofix. Review carefully before merging._ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>