Small Security Fixes #82
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if 'github.com' in markdown_file.front_matter['external_url']: | ||
| external_url = str(markdown_file.front_matter['external_url']) | ||
|
|
||
| if external_url.startswith('https://github.com'): |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
To fix the issue, we should parse the external_url using urlparse and validate its hostname explicitly. This ensures that the URL is properly interpreted and avoids substring-based checks, which are prone to errors. Specifically, we will extract the hostname from the parsed URL and verify that it matches github.com or a subdomain of github.com. This approach is more secure and aligns with best practices for URL validation.
| @@ -113,3 +113,4 @@ | ||
|
|
||
| if external_url.startswith('https://github.com'): | ||
| parsed_url = urlparse(external_url) | ||
| if parsed_url.hostname and (parsed_url.hostname == 'github.com' or parsed_url.hostname.endswith('.github.com')): | ||
| return self._inject_github_repository_information( |
There was a problem hiding this comment.
I don't think the statement may be at an arbitrary position works as you do startswith 🤷
There was a problem hiding this comment.
Anyway, the proposed solution seems easy to understand and if it passes CodeQL validation it won't do any harm .
Fixes issues: