Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: bpt_dmvschool 🚑 Fix some errors, and refactor code #851

Merged
merged 3 commits into from
Sep 30, 2024
Merged

Conversation

bitpredator
Copy link
Owner

Fixes #[issue_no]

All Submissions:

  • Have you followed the guidelines in our Contributing document?
  • Have you checked to ensure there aren't other open Pull Requests for the same update/change?
  • Have you added an explanation of what your changes do and why you'd like us to include them?
  • Does your submission pass tests?

Please describe the changes this PR makes and why it should be merged:

Discord username (if different from GitHub):

break;
}
}
$(oneRow).appendTo('#transactions-container');

Check failure

Code scanning / CodeQL

Client-side cross-site scripting High

Cross-site scripting vulnerability due to
user-provided value
.

Copilot Autofix AI about 1 month ago

To fix the cross-site scripting vulnerability, we need to ensure that any user-provided data is properly sanitized or escaped before being inserted into the DOM. The best way to fix this issue is to use a library like DOMPurify to sanitize the HTML content before appending it to the DOM.

  1. Import the DOMPurify library.
  2. Sanitize the oneRow HTML string before appending it to the DOM.
Suggested changeset 2
server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js b/server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js
--- a/server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js
+++ b/server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js
@@ -1 +1,2 @@
+import DOMPurify from 'dompurify';
 let LOADED = true;
@@ -435,3 +436,4 @@
 
-			$(oneRow).appendTo('#transactions-container');
+			const sanitizedRow = DOMPurify.sanitize(oneRow);
+			$(sanitizedRow).appendTo('#transactions-container');
 		}
EOF
@@ -1 +1,2 @@
import DOMPurify from 'dompurify';
let LOADED = true;
@@ -435,3 +436,4 @@

$(oneRow).appendTo('#transactions-container');
const sanitizedRow = DOMPurify.sanitize(oneRow);
$(sanitizedRow).appendTo('#transactions-container');
}
package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -3,2 +3,5 @@
     "eslint": "^9.11.1"
+  },
+  "dependencies": {
+    "dompurify": "^3.1.7"
   }
EOF
@@ -3,2 +3,5 @@
"eslint": "^9.11.1"
},
"dependencies": {
"dompurify": "^3.1.7"
}
This fix introduces these dependencies
Package Version Security advisories
dompurify (npm) 3.1.7 None
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
Comment on lines +449 to +452
`${this.language.moneyFormat.replace(
'__replaceData__',
newData.money,
)} `,

Check failure

Code scanning / CodeQL

Client-side cross-site scripting High

Cross-site scripting vulnerability due to
user-provided value
.

Copilot Autofix AI about 1 month ago

To fix the cross-site scripting vulnerability, we need to ensure that any user-provided data is properly sanitized or escaped before being inserted into the HTML. The best way to achieve this is by using a library like DOMPurify to sanitize the data.

  • General Fix: Use DOMPurify to sanitize the user-provided data before inserting it into the HTML.
  • Detailed Fix:
    • Import the DOMPurify library.
    • Use DOMPurify.sanitize to sanitize the newData.money and newData.bankMoney values before inserting them into the HTML.
Suggested changeset 2
server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js b/server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js
--- a/server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js
+++ b/server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js
@@ -1 +1,2 @@
+import DOMPurify from 'dompurify';
 let LOADED = true;
@@ -450,3 +451,3 @@
 					'__replaceData__',
-					newData.money,
+					DOMPurify.sanitize(newData.money),
 				)} `,
@@ -456,3 +457,3 @@
 					'__replaceData__',
-					newData.bankMoney,
+					DOMPurify.sanitize(newData.bankMoney),
 				)}`,
EOF
@@ -1 +1,2 @@
import DOMPurify from 'dompurify';
let LOADED = true;
@@ -450,3 +451,3 @@
'__replaceData__',
newData.money,
DOMPurify.sanitize(newData.money),
)} `,
@@ -456,3 +457,3 @@
'__replaceData__',
newData.bankMoney,
DOMPurify.sanitize(newData.bankMoney),
)}`,
package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -3,2 +3,5 @@
     "eslint": "^9.11.1"
+  },
+  "dependencies": {
+    "dompurify": "^3.1.7"
   }
EOF
@@ -3,2 +3,5 @@
"eslint": "^9.11.1"
},
"dependencies": {
"dompurify": "^3.1.7"
}
This fix introduces these dependencies
Package Version Security advisories
dompurify (npm) 3.1.7 None
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
Comment on lines +455 to +458
`${this.language.moneyFormat.replace(
'__replaceData__',
newData.bankMoney,
)}`,

Check failure

Code scanning / CodeQL

Client-side cross-site scripting High

Cross-site scripting vulnerability due to
user-provided value
.

Copilot Autofix AI about 1 month ago

To fix the cross-site scripting vulnerability, we need to ensure that any user-provided data is properly sanitized or escaped before being inserted into the HTML. One effective way to do this is by using a library like DOMPurify, which can sanitize HTML and prevent XSS attacks.

  • General Fix: Sanitize the newData before using it to update the HTML content.
  • Detailed Fix: Import the DOMPurify library and use it to sanitize the newData.money and newData.bankMoney values before inserting them into the HTML.
  • Files/Regions/Lines to Change: Modify the refresh method in the server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js file, specifically around lines 455 and 457.
  • Needed: Import the DOMPurify library, sanitize the newData values before using them in the replace method.
Suggested changeset 2
server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js b/server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js
--- a/server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js
+++ b/server-data/resources/[bpt_addons]/bpt_banking/html/scripts/app.js
@@ -1 +1,2 @@
+import DOMPurify from 'dompurify';
 let LOADED = true;
@@ -450,3 +451,3 @@
 					'__replaceData__',
-					newData.money,
+					DOMPurify.sanitize(newData.money),
 				)} `,
@@ -456,3 +457,3 @@
 					'__replaceData__',
-					newData.bankMoney,
+					DOMPurify.sanitize(newData.bankMoney),
 				)}`,
EOF
@@ -1 +1,2 @@
import DOMPurify from 'dompurify';
let LOADED = true;
@@ -450,3 +451,3 @@
'__replaceData__',
newData.money,
DOMPurify.sanitize(newData.money),
)} `,
@@ -456,3 +457,3 @@
'__replaceData__',
newData.bankMoney,
DOMPurify.sanitize(newData.bankMoney),
)}`,
package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -3,2 +3,5 @@
     "eslint": "^9.11.1"
+  },
+  "dependencies": {
+    "dompurify": "^3.1.7"
   }
EOF
@@ -3,2 +3,5 @@
"eslint": "^9.11.1"
},
"dependencies": {
"dompurify": "^3.1.7"
}
This fix introduces these dependencies
Package Version Security advisories
dompurify (npm) 3.1.7 None
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
@bitpredator bitpredator merged commit 6738678 into main Sep 30, 2024
5 of 9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant