kyma-project / busola / 35082090614

25%

main: 25%

push

github

fix: Validate pending kubeconfig ID read from localStorage (#5283)

* fix(security): validate pending kubeconfig ID read from localStorage

Adds a safe-character check in consumePendingKubeconfigId() so that
only values matching /^[\w.-]+$/ are returned. Any value outside that
set — e.g. javascript: schemes or encoded payloads — is discarded and
null is returned instead. This eliminates the SAST-flagged taint path
from localStorage to window.location.href in ssoDataAtom.tsx.

* refactor: use URL-encode round-trip to validate pending kubeconfig ID

Replaces the allowlist regex in consumePendingKubeconfigId() with an
encodeURIComponent round-trip check, per review feedback.

2434 of 12104 branches covered (20.11%)

Branch coverage included in aggregate %.

0 of 3 new or added lines in 1 file covered. (0.0%)

4872 of 16888 relevant lines covered (28.85%)

25.59 hits per line