decentraland / decentraland-gatsby
56%

DEFAULT BRANCH: master
Repo Added
Files 88
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: SELECT
CHANGE BRANCH
x

coverage: 56.068% (+0.09%) from 55.975%
29945298968

push

github

web-flow 
fix: escape image and url metadata values in replaceHelmetMetadata (#1327)

* fix: escape image and url metadata values in replaceHelmetMetadata

replaceHelmetMetadata escaped title and description before interpolating
them into `<meta content="...">` attributes, but injected the `image` and
`url` values raw and then reparsed the result as html. a value such as
`https://x"><script>...</script>` therefore broke out of the attribute
and became live markup in `<head>` — a stored-xss / defacement vector for
any consumer that renders attacker-controlled image/url metadata (e.g. the
places social/opengraph endpoint).

escape `image` and `url` with the same helper used for the other fields so
every metadata branch is contextually encoded before html insertion.

* fix: escape metadata keys in replaceHelmetMetadata

the default branch interpolated the metadata key raw into the `name` /
`property` attribute while only escaping the value, so a caller-supplied
key such as `x"><script>...</script><meta name="y` could break out of the
attribute even when the value was safe.

escape the key with the same helper used for the value in both the `name`
and `og:`/`property` branches, and add regression tests for each.

508 of 1115 branches covered (45.56%)

Branch coverage included in aggregate %.

10 of 10 new or added lines in 1 file covered. (100.0%)

1266 of 2049 relevant lines covered (61.79%)

11.79 hits per line

Relevant lines Covered
2049 RELEVANT LINES 1266 COVERED LINES
11.79 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
29945298968 master fix: escape image and url metadata values in replaceHelmetMetadata (#1327) * fix: escape image and url metadata values in replaceHelmetMetadata replaceHelmetMetadata escaped title and description before interpolating them into `<meta content="..... push web-flow github
56.07
29942773182 fix/escape-helmet-image-url Merge ae5b442d5 into 308458459 Pull #1327 web-flow github
56.07
29941017435 fix/escape-helmet-image-url Merge c8230c769 into 308458459 Pull #1327 web-flow github
56.02
28124693452 master fix: release timed-out response bodies in API.fetch (#1326) * fix: release timed-out response bodies in API.fetch When `API.fetch` races the request against its timeout, a slow request can still settle with a real `Response` after the timeout ha... push web-flow github
55.97
28123875026 fix/api-fetch-timeout-body-leak Merge c6e26767f into f3212d6ad Pull #1326 web-flow github
55.97
28120973276 fix/api-fetch-timeout-body-leak Merge 1e4a2e424 into f3212d6ad Pull #1326 web-flow github
55.97
27965673957 master fix: remove the bun job from the release workflow (#1325) The Release workflow ran a standalone `bun` job (setup-bun + `bun install` + `bun test`) with `continue-on-error: true`. It gated nothing (the `node` job that runs the actual lint/test/bui... push web-flow github
55.91
27963799572 ci/remove-bun-from-release Merge 625981cf0 into f1e52e2ca Pull #1325 web-flow github
55.91
27963649941 master refactor: use @dcl http-server and crypto-middleware to drop node-fetch (#1321) * refactor: use @dcl http-server and crypto-middleware to drop node-fetch replace @well-known-components/http-server and decentraland-crypto-middleware with their na... push web-flow github
55.91
27962355413 refactor/drop-node-fetch Merge 0ad4c7892 into 81fc35897 Pull #1321 web-flow github
55.91
See All Builds (1653)