decentraland / decentraland-gatsby / 29945298968
56%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 88
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 56.068% (+0.09%) from 55.975%
29945298968

push

github

web-flow 
fix: escape image and url metadata values in replaceHelmetMetadata (#1327)

* fix: escape image and url metadata values in replaceHelmetMetadata

replaceHelmetMetadata escaped title and description before interpolating
them into `<meta content="...">` attributes, but injected the `image` and
`url` values raw and then reparsed the result as html. a value such as
`https://x"><script>...</script>` therefore broke out of the attribute
and became live markup in `<head>` — a stored-xss / defacement vector for
any consumer that renders attacker-controlled image/url metadata (e.g. the
places social/opengraph endpoint).

escape `image` and `url` with the same helper used for the other fields so
every metadata branch is contextually encoded before html insertion.

* fix: escape metadata keys in replaceHelmetMetadata

the default branch interpolated the metadata key raw into the `name` /
`property` attribute while only escaping the value, so a caller-supplied
key such as `x"><script>...</script><meta name="y` could break out of the
attribute even when the value was safe.

escape the key with the same helper used for the value in both the `name`
and `og:`/`property` branches, and add regression tests for each.

508 of 1115 branches covered (45.56%)

Branch coverage included in aggregate %.

10 of 10 new or added lines in 1 file covered. (100.0%)

1266 of 2049 relevant lines covered (61.79%)

11.79 hits per line

Jobs
ID Job ID Ran Files Coverage
1 29945298968.1 176
58.4
 GitHub Action Run
Source Files on build 29945298968