Conversation
✅ Deploy Preview for authentik-storybook ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-docs canceled.
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
✅ All tests successful. No failed tests found. Additional details and impacted files@@ Coverage Diff @@
## main #13754 +/- ##
==========================================
- Coverage 92.97% 92.24% -0.74%
==========================================
Files 831 831
Lines 44226 44226
==========================================
- Hits 41119 40795 -324
- Misses 3107 3431 +324
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
379cb99 to
e3f2ed0
Compare
e3f2ed0 to
77bcc9d
Compare
✅ Deploy Preview for authentik-integrations canceled.
|
web/src/elements/router/utils.ts
Outdated
| if (!match) continue; | ||
|
|
||
| console.debug( | ||
| `authentik/router: matched route ${route.pattern} to ${pathname} with params`, |
Check failure
Code scanning / CodeQL
Use of externally-controlled format string
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
To fix the issue, we will ensure that the untrusted pathname is not directly interpolated into the template literal. Instead, we will use a %s specifier in the format string and pass pathname as a separate argument. This approach ensures that the untrusted input is treated as a string and avoids any unintended behavior.
| @@ -29,3 +29,5 @@ | ||
| console.debug( | ||
| `authentik/router: matched route ${route.pattern} to ${pathname} with params`, | ||
| "authentik/router: matched route %s to %s with params", | ||
| route.pattern, | ||
| pathname, | ||
| match.pathname.groups, | ||
| @@ -39,3 +41,3 @@ | ||
|
|
||
| console.debug(`authentik/router: no route matched ${pathname}`); | ||
| console.debug("authentik/router: no route matched %s", pathname); | ||
|
|
77bcc9d to
01ff1e1
Compare
| render(): TemplateResult { | ||
| return this.route.render(this.arguments); | ||
| console.debug( | ||
| `authentik/router: matched route ${route.pattern} to ${pathname} with params`, |
Check failure
Code scanning / CodeQL
Use of externally-controlled format string High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
To fix the issue, we will ensure that the untrusted pathname value is not directly interpolated into the format string. Instead, we will use a %s specifier in the format string and pass the pathname as a separate argument. This approach ensures that the pathname is treated as a string and prevents any unintended format specifiers from being processed.
The changes will be made in the matchRoute function in RouteMatch.ts. Specifically, the console.debug statement on line 30 will be updated to use a safe format string.
| @@ -29,3 +29,5 @@ | ||
| console.debug( | ||
| `authentik/router: matched route ${route.pattern} to ${pathname} with params`, | ||
| "authentik/router: matched route %s to %s with params", | ||
| route.pattern, | ||
| pathname, | ||
| match.pathname.groups, |
Details
This PR preps the client-side router for hash-less routes, partially getting our parameter logic into a more compatible format. This PR also...
Checklist
ak test authentik/)make lint-fix)If an API change has been made
make gen-build)If changes to the frontend have been made
make web)If applicable
make website)