Skip to content

Conversation

@leplatrem
Copy link
Contributor

No description provided.

foo = Service(name="foo", path="/foo", cors_origins=("mozilla.org",))
foo.add_view("GET", _stub, cors_origins=("lolnet.org",))

self.assertTrue("mozilla.org" in foo.cors_origins_for("GET"))

Check failure

Code scanning / CodeQL

Incomplete URL substring sanitization High test

The string
mozilla.org
may be at an arbitrary position in the sanitized URL.
foo.add_view("GET", _stub, cors_origins=("lolnet.org",))

self.assertTrue("mozilla.org" in foo.cors_origins_for("GET"))
self.assertTrue("lolnet.org" in foo.cors_origins_for("GET"))

Check failure

Code scanning / CodeQL

Incomplete URL substring sanitization High test

The string
lolnet.org
may be at an arbitrary position in the sanitized URL.
self.assertTrue("lolnet.org" in foo.cors_origins_for("GET"))

foo.add_view("POST", _stub)
self.assertFalse("lolnet.org" in foo.cors_origins_for("POST"))

Check failure

Code scanning / CodeQL

Incomplete URL substring sanitization High test

The string
lolnet.org
may be at an arbitrary position in the sanitized URL.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants