[comp] Production Deploy #1336
Merged
[comp] Production Deploy #1336
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Included handling for the 'DEQUEUED' state in the OnboardingTracker component to improve onboarding status management. - Removed the previous handling of 'DEQUEUED' from the error case to ensure proper state representation.
[dev] [Marfuen] mariano/fix-policies
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
- Added `generateRiskMitigation` and `generateVendorMitigation` tasks to handle risk and vendor mitigation processes. - Introduced fan-out functionality for both risk and vendor mitigations to process multiple items concurrently. - Created helper functions for generating risk mitigation comments and managing associated policies. - Updated onboarding process to trigger these new tasks for improved organizational risk management.
…ality - Introduced `RiskActions` and `VendorActions` components for triggering risk and vendor mitigation regeneration. - Implemented server actions `regenerateRiskMitigationAction` and `regenerateVendorMitigationAction` to handle regeneration requests. - Updated `RiskPage` and `VendorPage` to include action components in the header for improved user interaction. - Enhanced the `generateRiskMitigation` and `generateVendorMitigation` tasks to include path revalidation after mitigation generation.
- Implemented a confirmation dialog for deleting comments to enhance user experience and prevent accidental deletions. - Refactored the delete comment logic to manage loading state and handle API calls more effectively. - Updated the dropdown menu to trigger the dialog instead of directly deleting the comment.
[dev] [Marfuen] mariano/risk-mitigation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| <BreadcrumbPage>{item.label}</BreadcrumbPage> | ||
| ) : ( | ||
| <BreadcrumbLink asChild> | ||
| <Link href={item.href || '#'}>{item.label}</Link> |
Check warning
Code scanning / CodeQL
Client-side URL redirect Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
To fix the client-side URL redirect vulnerability, we should ensure that only safe, internal URLs are used in the href prop of the Link component. The best way to do this is to validate that all href values are relative paths (i.e., they do not start with a protocol like http:// or https://, nor with //). This can be done by introducing a utility function (e.g., sanitizeHref) that checks the href value and returns a safe fallback (such as '#') if the value is not a safe relative path. This function should be used wherever a potentially tainted href is passed to a Link component, specifically on lines 98, 111, and 126 in PageWithBreadcrumb.tsx.
The required changes are:
- Add a
sanitizeHreffunction toPageWithBreadcrumb.tsx. - Use
sanitizeHrefto validate allhrefvalues before passing them toLink.
Suggested changeset
1
apps/app/src/components/pages/PageWithBreadcrumb.tsx
| @@ -18,6 +18,20 @@ | ||
| import React from 'react'; | ||
| import PageCore from './PageCore.tsx'; | ||
|
|
||
| // Only allow relative URLs (no protocol, no leading //) | ||
| function sanitizeHref(href?: string): string { | ||
| if ( | ||
| typeof href !== 'string' || | ||
| href.trim() === '' || | ||
| href.startsWith('http://') || | ||
| href.startsWith('https://') || | ||
| href.startsWith('//') | ||
| ) { | ||
| return '#'; | ||
| } | ||
| return href; | ||
| } | ||
|
|
||
| interface BreadcrumbDropdownItem { | ||
| label: string; | ||
| href: string; | ||
| @@ -95,7 +109,7 @@ | ||
| <DropdownMenuContent align="start" className="max-h-[300px]"> | ||
| {item.dropdown.map((dropdownItem) => ( | ||
| <DropdownMenuItem key={dropdownItem.href} asChild> | ||
| <Link href={dropdownItem.href}> | ||
| <Link href={sanitizeHref(dropdownItem.href)}> | ||
| {dropdownItem.label.length > maxLabelLength | ||
| ? `${dropdownItem.label.slice(0, maxLabelLength)}...` | ||
| : dropdownItem.label} | ||
| @@ -108,7 +122,7 @@ | ||
| <BreadcrumbPage>{item.label}</BreadcrumbPage> | ||
| ) : ( | ||
| <BreadcrumbLink asChild> | ||
| <Link href={item.href || '#'}>{item.label}</Link> | ||
| <Link href={sanitizeHref(item.href)}>{item.label}</Link> | ||
| </BreadcrumbLink> | ||
| )} | ||
| </BreadcrumbItem> | ||
| @@ -123,7 +137,7 @@ | ||
| <DropdownMenuContent align="start"> | ||
| {hiddenItems.map((hiddenItem) => ( | ||
| <DropdownMenuItem key={hiddenItem.label} asChild> | ||
| <Link href={hiddenItem.href || '#'}>{hiddenItem.label}</Link> | ||
| <Link href={sanitizeHref(hiddenItem.href)}>{hiddenItem.label}</Link> | ||
| </DropdownMenuItem> | ||
| ))} | ||
| </DropdownMenuContent> |
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
Contributor
|
🎉 This PR is included in version 1.51.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.