mbland / custom-links

98%

master: 98%

LAST BUILD ON BRANCH fix-search-short-links

branch: fix-search-short-links

CHANGE BRANCH

x

Reset

• fix-search-short-links
• master
• my-links
• empty-hash-view
• codeclimate-token
• cc-test-reporter
• urlp-to-cl
• focus-element
• remove-tabindex
• show-view-promise
• my-links-e2e
• my-links-buttons
• delete-link
• extract-flash
• extract-api-helpers
• fixups
• dialog
• do-operation
• style-touchups
• view-and-backend
• dialog-data
• stabilize-e2e
• backend-delete
• count-links
• create-unknown-link
• rename-url-to-link
• rename-redirectdb-to-linkdb
• rename-location-to-target
• create-and-update-stamps
• create-link-view
• my-links-landing-page
• show-timestamps
• fix-error-response
• show-view-handle-rejection
• api-json
• edit-link
• count-to-clicks
• edit-view-support
• edit-link-nonfunctional
• make-api-call
• create-click-handler
• refactor
• launch-redis
• readme
• docker
• alpine-fix
• env-config-override
• config-redis
• wait-for-redis
• redis-shutdown
• save-on-exit
• log
• headless-chrome
• cla-#147
• add-okta
• update-npms
• v0.1.0
• dockerize
• downcase-ids
• v0.1.1
• downcase-users-domains
• jsdoc
• search-links
• travis-ci-fix
• autocomplete-and-target-search
• fix-smoke-test-flakiness
• deindex-and-reindex
• redis-refactor
• search-on-target-link
• update-packages
• add-api-for-search
• target-index-sets
• migrate-autocomplete-target-url-indexes
• search-ui
• v0.2.0
• v0.1.2
• v0.2.1
• autocomplete-api
• autocomplete-ui
• bump-npms-and-dockerfile
• v0.3.0
• transfer-ownership

Build # 683

Build Type

push

travis-ci

Committed by mbland

Commit Message

LinkDb: Fix searchShortLinks, return object

The first problem with the previous implementation (other than we forgot
to test it) was that the underlying RedisClient.searchShortLinks() was
already returning linkInfo objects. Consequently, the call to
RedisClient.fetchLinkData() was not only superflouous, but causing
server errors, because it expects an array of strings, not an array of
objects.

The second problem was that it returned an array, passed through the API
as a JSON array, which has presented various security vulnerabilities
over time (do a quick search on "json array security"). Wrapping arrays
in an object is still recommended by OWASP:

https://www.owasp.org/index.php/AJAX_Security_Cheat_Sheet#Always_return_JSON_with_an_Object_on_the_outside

Run Details

317 of 346 branches covered (91.62%)

Branch coverage included in aggregate %.

2872 of 2901 relevant lines covered (99.0%)

21.84 hits per line