Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix XSS via missing Binding syntax validation #34

Closed
wants to merge 11 commits into from
Closed

Fix XSS via missing Binding syntax validation #34

wants to merge 11 commits into from

Commits on Jan 23, 2023

  1. implement query signature verification 

    add support for sha1 & sha512

add tests

use query sign in redirect

implement review feedback

- Return error if signature is unsupported
- wrap errors

Co-authored-by: Ieva <ieva.vasiljeva@grafana.com>
Co-authored-by: Orgad Shaneh <orgads@gmail.com>
    @Jguer @IevaVasiljeva @orgads
    3 people committed Jan 23, 2023
    Configuration menu
    Copy the full SHA
    3b6b1ec View commit details
    Browse the repository at this point in the history

Commits on Feb 3, 2023

  1. Fix reading compressed XML document

    @alexanderzobnin
    alexanderzobnin committed Feb 3, 2023
    Configuration menu
    Copy the full SHA
    b75d97a View commit details
    Browse the repository at this point in the history

  2. Don't fail if signature provided in query string, but not in the message

    @alexanderzobnin
    alexanderzobnin committed Feb 3, 2023
    Configuration menu
    Copy the full SHA
    8197ae7 View commit details
    Browse the repository at this point in the history

  3. Only fail if no signature present at all

    @alexanderzobnin
    alexanderzobnin committed Feb 3, 2023
    Configuration menu
    Copy the full SHA
    5f476db View commit details
    Browse the repository at this point in the history

Commits on Mar 31, 2023

  1. Update README example to use displayName attribute (crewjam#486)

    @mattb18 @mgyongyosi
    mattb18 authored and mgyongyosi committed Mar 31, 2023
    Configuration menu
    Copy the full SHA
    87afeba View commit details
    Browse the repository at this point in the history

  2. Merge pull request from GHSA-5mqj-xc49-246p 

    GHSA-5mqj-xc49-246p
    @crewjam @mgyongyosi
    crewjam authored and mgyongyosi committed Mar 31, 2023
    Configuration menu
    Copy the full SHA
    67cbfa0 View commit details
    Browse the repository at this point in the history

Commits on Aug 23, 2023

  1. change how the list of namespaces that apply to an element is constru… 

    …cted
    @IevaVasiljeva
    IevaVasiljeva committed Aug 23, 2023
    Configuration menu
    Copy the full SHA
    70af345 View commit details
    Browse the repository at this point in the history

  2. remove a comment

    @IevaVasiljeva
    IevaVasiljeva committed Aug 23, 2023
    Configuration menu
    Copy the full SHA
    b301dc9 View commit details
    Browse the repository at this point in the history

  3. add comments and a test

    @IevaVasiljeva
    IevaVasiljeva committed Aug 23, 2023
    Configuration menu
    Copy the full SHA
    9900411 View commit details
    Browse the repository at this point in the history

Commits on Oct 11, 2023

  1. Add cacheDuration, validUntil to RoleDescriptors (grafana#33)

    @mgyongyosi
    mgyongyosi authored Oct 11, 2023
    Configuration menu
    Copy the full SHA
    94154cb View commit details
    Browse the repository at this point in the history

Commits on Oct 18, 2023

  1. Merge pull request from GHSA-267v-3v32-g6q5 

    (cherry picked from commit b07b16c)
    @crewjam @witekest
    crewjam authored and witekest committed Oct 18, 2023
    Configuration menu
    Copy the full SHA
    bad0489 View commit details
    Browse the repository at this point in the history