6474555273
84%
master: 85%

Ran 10 Oct 2023 08:38PM UTC

Jobs 1

Files 49

Run time 2s

Badge

Embed ▾

Committed 10 Oct 2023 08:34PM UTC coverage: 84.197% (-0.05%) from 84.242%

Build # 6474555273

Build Type

Pull #1681

github

Committed by

paskal

Commit Message

limit TitleExtractor to allow only Remark42 whitelisted domains

Allowed domains consist of `REMARK_URL` second-level domain (or whole IP in case it's IP like 127.0.0.1) and `ALLOWED_HOSTS`. That is needed to prevent Remark42 from asking arbitrary servers and storing the page title as the comment.PostTitle.

Previous behaviour allowed the caller of the API to create a comment
with an arbitrary URL and learn the title of the page, which might be
accessible to the server Remark42 is installed on but not to the user
outside that network (CWE-918).

Pull Request Pull Request #1681: Limit TitleExtractor to allow only Remark42 whitelisted domains

Run Details

5834 of 6929 relevant lines covered (84.2%)

32.5 hits per line

Uncovered Existing Lines

Lines	Coverage	∆	File
15	78.95	-1.7%	backend/app/store/service/title.go
110	82.9	-0.13%	backend/app/cmd/server.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	6474555273.1	10 Oct 2023 08:38PM UTC	49	84.2	GitHub Action Run

umputun / remark42 / 6474555273
84%
master: 85%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Uncovered Existing Lines

Jobs

Source Files on build 6474555273

umputun / remark42 / 6474555273 84% master: 85%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Uncovered Existing Lines

Jobs

Source Files on build 6474555273

umputun / remark42 / 6474555273
84%
master: 85%

README BADGES
x