[PR #86] [MERGED] Incomplete URL substring sanitization #89

New issue

Closed

opened 2026-02-27 14:57:15 +03:00 by kerem · 0 comments

kerem commented

2026-02-27 14:57:15 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/netbootxyz/webapp/pull/86
Author: @antonym
Created: 2/13/2025
Status: ✅ Merged
Merged: 2/13/2025
Merged by: @antonym

Base: master ← Head: url-sanitization

📝 Commits (1)

f098d94 Incomplete URL substring sanitization

📊 Changes

1 file changed (+7 additions, -1 deletions)

View changed files

📝 app.js (+7 -1)

📄 Description

Potential fix for https://github.com/netbootxyz/webapp/security/code-scanning/1

To fix the problem, we need to parse the URL and check the host value explicitly. This involves using the url module to parse the URL and then comparing the host against a whitelist of allowed hosts. This approach ensures that the check is not bypassed by embedding the allowed host in an unexpected location.

Import the url module at the beginning of the file.
Parse the URL to extract the host value.
Compare the host value against a whitelist of allowed hosts.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netbootxyz/webapp/pull/86 **Author:** [@antonym](https://github.com/antonym) **Created:** 2/13/2025 **Status:** ✅ Merged **Merged:** 2/13/2025 **Merged by:** [@antonym](https://github.com/antonym) **Base:** `master` ← **Head:** `url-sanitization` --- ### 📝 Commits (1) - [`f098d94`](https://github.com/netbootxyz/webapp/commit/f098d94cd4e782cfd433db70be39c57072fa1509) Incomplete URL substring sanitization ### 📊 Changes **1 file changed** (+7 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `app.js` (+7 -1) </details> ### 📄 Description Potential fix for [https://github.com/netbootxyz/webapp/security/code-scanning/1](https://github.com/netbootxyz/webapp/security/code-scanning/1) To fix the problem, we need to parse the URL and check the host value explicitly. This involves using the `url` module to parse the URL and then comparing the host against a whitelist of allowed hosts. This approach ensures that the check is not bypassed by embedding the allowed host in an unexpected location. 1. Import the `url` module at the beginning of the file. 2. Parse the URL to extract the host value. 3. Compare the host value against a whitelist of allowed hosts. _Suggested fixes powered by Copilot Autofix. Review carefully before merging._ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>