Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[do-not-merge]: Quickstarts Internationalisation #10484

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

harishsundar-okta
Copy link
Contributor

No description provided.

<% var i=0; _.forEach(connections, function(article) { %>
<% if (article.connection) { %>
<% if (article.public !== false) { %>
<a class="connection connection-public" href="<%- article.url %>">

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link %>'. You may also consider setting the Content Security Policy (CSP) header.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by var-in-href.

You can view more details about this finding in the Semgrep AppSec Platform.

<% var i=0; _.forEach(connections, function(article) { %>
<% if (article.connection) { %>
<% if (article.public !== false) { %>
<a class="connection connection-public" href="<%- article.url %>">

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: href='/<%= link %>'. You may also consider setting the Content Security Policy (CSP) header.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by var-in-href.

You can view more details about this finding in the Semgrep AppSec Platform.

@BcnCarlos BcnCarlos self-assigned this Jan 15, 2025
@BcnCarlos BcnCarlos self-requested a review January 15, 2025 12:36
BcnCarlos
BcnCarlos previously approved these changes Jan 15, 2025
@harishsundar-okta harishsundar-okta marked this pull request as ready for review January 15, 2025 12:38
@harishsundar-okta harishsundar-okta force-pushed the quickstart-internationalisation branch from 74a6465 to e9e53e5 Compare January 15, 2025 13:39
@BcnCarlos BcnCarlos mentioned this pull request Jan 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants