[_] Run yarn format #899
[_] Run yarn format #899
Conversation
TamaraFinogina
temporarily deployed
to
development
GitHub Actions
Inactive
TamaraFinogina
temporarily deployed
to
development
GitHub Actions
Inactive
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| console.log(rawClient, rawVersion) | ||
| console.log(rawClient, rawVersion); |
Check failure
Code scanning / CodeQL
Use of externally-controlled format string High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 14 hours ago
In general, to fix format-string issues, avoid using untrusted data as the format string itself. Instead, use a constant format string (for example, "%s") and pass untrusted data as subsequent arguments, or sanitize/escape % characters in the untrusted input.
In this specific case, we can keep the same logging behavior while ensuring user input does not become the format string by introducing a static, literal format string and passing both rawClient and rawVersion as values for %s placeholders. For example, replace console.log(rawClient, rawVersion); with console.log('internxt headers: client=%s version=%s', rawClient, rawVersion);. This preserves logging of both values and prevents rawClient from being interpreted as a format string, because the format string is now the trusted literal 'internxt headers: client=%s version=%s'.
Only one line in src/lib/newrelic.interceptor.ts needs to change, and no new imports or helper methods are required.
| @@ -37,7 +37,7 @@ | ||
| ); | ||
| } | ||
|
|
||
| console.log(rawClient, rawVersion); | ||
| console.log('internxt headers: client=%s version=%s', rawClient, rawVersion); | ||
|
|
||
| return next.handle(); | ||
| } |
|
Style changes after running yarn format