Code Scanning security alert fixes #129

arpitjain099 · 2024-10-20T04:38:49Z

Purpose

These alerts were identified and fixed using CodeQL extended query suite. Th

Does this introduce a breaking change?

[ ] Yes
[X] No

Pull Request Type

What kind of change does this Pull Request introduce?

[X] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[X] Other... Please describe: Patch security based coding issues in the codebase.

How to Test

Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

Test the code

What to Check

Verify that the following are valid

...

Other Information

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

…ting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 2: DOM text reinterpreted as HTML

Fix code scanning alert no. 9: Reflected server-side cross-site scripting

Fix code scanning alert no. 49: Information exposure through an exception

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

arpitjain099 · 2024-10-20T04:39:12Z

Please review @kristapratico @luisquintanilla @colombod

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 51: Information exposure through an exception

Fix code scanning alert no. 63: Information exposure through an exception

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

…ting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

…pting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 66: Information exposure through an exception

Fix code scanning alert no. 45: Information exposure through an exception

Fix code scanning alert no. 39: Information exposure through an exception

Fix code scanning alert no. 38: Information exposure through an exception

Fix code scanning alert no. 42: Information exposure through an exception

Fix code scanning alert no. 41: Information exposure through an exception

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 24: Information exposure through an exception

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 67: Information exposure through an exception

Fix code scanning alert no. 65: Information exposure through an exception

Fix code scanning alert no. 38: Information exposure through an exception

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 22: Full server-side request forgery

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 18: Full server-side request forgery

Fix code scanning alert no. 22: Full server-side request forgery

arpitjain099 · 2024-11-11T00:34:24Z

Hi @kristapratico @luisquintanilla @colombod
Please review this PR when you can. Thank you!!

arpitjain099 · 2024-11-11T01:41:16Z

Thank you for approving the PR @colombod
Can you please also merge it if possible.

arpitjain099 · 2024-11-13T07:26:43Z

Hi @kristapratico @luisquintanilla @colombod
This PR has been approved, can you please merge when possible. Thank you!!

kristapratico · 2024-11-13T17:33:59Z

End_to_end_Solutions/AOAISearchDemo/app/backend/data_client/data_client.py

+from urllib.parse import urlparse
+from urllib.parse import urlparse, urljoin
+
+def _validate_base_uri(self, base_uri: str):
+    parsed_uri = urlparse(base_uri)
+    if parsed_uri.scheme not in ["http", "https"]:
+        raise ValueError("Invalid URI scheme")
+    if not parsed_uri.netloc:
+        raise ValueError("Invalid URI netloc")
+
+def _validate_base_uri(self, base_uri: str):
+    parsed_uri = urlparse(base_uri)
+    if parsed_uri.scheme not in ["http", "https"]:
+        raise ValueError("Invalid URI scheme")
+    if not parsed_uri.netloc:
+        raise ValueError("Invalid URI netloc")


Looks like we have duplicate code here

kristapratico · 2024-11-13T17:39:28Z

End_to_end_Solutions/AOAISearchDemo/app/backend/data_client/data_client.py

+    def _validate_base_uri(self, base_uri: str) -> str:
+        # Ensure the base_uri is a trusted URL
+        if not base_uri.startswith("https://trusted-domain.com"):
+            raise ValueError("Invalid base URI")
+        return base_uri
+
+    def _sanitize_path(self, path: str) -> str:
+        # Sanitize the path to prevent malicious input
+        if ".." in path or path.startswith("/"):
+            raise ValueError("Invalid path")
+        return path


Why do we need these? Can't we use the functions we defined above?

kristapratico · 2024-11-13T17:43:10Z

End_to_end_Solutions/AOAISearchDemo/app/data/app.py

@@ -273,11 +286,14 @@ def update_user_group(group_id: str):
        user_group = entities_manager.add_users_to_user_group(group_id, new_users)
        return Response(response=json.dumps(user_group.to_item()), status=200)
    except (TypeError, NullValueError, MissingPropertyError, ValueError) as e:
-        return Response(response=str(e), status=400)
+        logging.error("An error occurred while updating user group: %s", e, exc_info=True)
+        return Response(response="An internal error has occurred.", status=400)


Seems like this should say something about "bad request" for a 400

kristapratico · 2024-11-13T19:37:38Z

End_to_end_Solutions/InsightsGenerator/insights_generator/core/OAI_client.py

+    allowed_urls = ["https://api.openai.com/v1/embeddings", "https://another-trusted-url.com"]
    url = os.getenv("AOAI_ENDPOINT")
+    if not is_valid_url(url) or url not in allowed_urls:
+        raise ValueError("The provided URL is not allowed.")


I don't think this change will work. A user needs to be able to pass their specific endpoint.

arpitjain099 and others added 11 commits October 20, 2024 13:16

Update CONTRIBUTING.md

631666b

Fix code scanning alert no. 27: Information exposure through an excep…

e128466

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 3: DOM text reinterpreted as HTML

28ba282

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 57: Information exposure through an excep…

3e2e469

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 49: Information exposure through an excep…

091e80a

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 9: Reflected server-side cross-site scrip…

86c2346

…ting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 2: DOM text reinterpreted as HTML

fd98ac4

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Merge pull request #18 from arpitjain099/alert-autofix-2

ef5c46d

Fix code scanning alert no. 2: DOM text reinterpreted as HTML

Merge pull request #17 from arpitjain099/alert-autofix-9

cf24ac2

Fix code scanning alert no. 9: Reflected server-side cross-site scripting

Merge pull request #16 from arpitjain099/alert-autofix-49

75d1e85

Fix code scanning alert no. 49: Information exposure through an exception

Fix code scanning alert no. 56: Information exposure through an excep…

e40c6cf

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

arpitjain099 and others added 18 commits October 20, 2024 13:40

Fix code scanning alert no. 63: Information exposure through an excep…

a45d967

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 51: Information exposure through an excep…

055a78b

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Merge pull request #20 from arpitjain099/alert-autofix-51

91f1919

Fix code scanning alert no. 51: Information exposure through an exception

Merge pull request #19 from arpitjain099/alert-autofix-63

760c74a

Fix code scanning alert no. 63: Information exposure through an exception

Fix code scanning alert no. 64: Information exposure through an excep…

df67a2e

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 8: Reflected server-side cross-site scrip…

61d6b9d

…ting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 10: Reflected server-side cross-site scri…

b2414ef

…pting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 11: Reflected server-side cross-site scri…

aebd8e8

…pting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 12: Reflected server-side cross-site scri…

8bf43ae

…pting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 13: Reflected server-side cross-site scri…

cde4d70

…pting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 14: Reflected server-side cross-site scri…

7611246

…pting Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 30: Information exposure through an excep…

238b125

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 32: Information exposure through an excep…

84948e2

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 33: Information exposure through an excep…

3b469ab

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 28: Information exposure through an excep…

163c963

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 31: Information exposure through an excep…

f9b0a70

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 29: Information exposure through an excep…

d9b5979

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 34: Information exposure through an excep…

59a4a6c

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

arpitjain099 and others added 25 commits October 20, 2024 14:11

Fix code scanning alert no. 38: Information exposure through an excep…

4f1b260

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 42: Information exposure through an excep…

d3640fd

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 41: Information exposure through an excep…

178266e

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Merge pull request #37 from arpitjain099/alert-autofix-66

332552f

Fix code scanning alert no. 66: Information exposure through an exception

Merge pull request #38 from arpitjain099/alert-autofix-45

8a8865e

Fix code scanning alert no. 45: Information exposure through an exception

Merge pull request #39 from arpitjain099/alert-autofix-39

b1a1327

Fix code scanning alert no. 39: Information exposure through an exception

Merge pull request #40 from arpitjain099/alert-autofix-38

2e19f99

Fix code scanning alert no. 38: Information exposure through an exception

Merge branch 'codeql' into alert-autofix-42

214ebd7

Merge pull request #41 from arpitjain099/alert-autofix-42

6c416f5

Fix code scanning alert no. 42: Information exposure through an exception

Merge branch 'codeql' into alert-autofix-41

f847274

Merge pull request #42 from arpitjain099/alert-autofix-41

00027f8

Fix code scanning alert no. 41: Information exposure through an exception

Fix code scanning alert no. 24: Information exposure through an excep…

f6456ee

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Merge pull request #43 from arpitjain099/alert-autofix-24

bc8c79f

Fix code scanning alert no. 24: Information exposure through an exception

Fix code scanning alert no. 67: Information exposure through an excep…

409e515

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 65: Information exposure through an excep…

0a9d856

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 38: Information exposure through an excep…

d8e6936

…tion Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Merge pull request #44 from arpitjain099/alert-autofix-67

18eebbf

Fix code scanning alert no. 67: Information exposure through an exception

Merge pull request #45 from arpitjain099/alert-autofix-65

1355a3a

Fix code scanning alert no. 65: Information exposure through an exception

Merge pull request #46 from arpitjain099/alert-autofix-38

0466d2c

Fix code scanning alert no. 38: Information exposure through an exception

Fix code scanning alert no. 22: Full server-side request forgery

cc58473

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Merge pull request #47 from arpitjain099/alert-autofix-22

97e6a6f

Fix code scanning alert no. 22: Full server-side request forgery

Fix code scanning alert no. 22: Full server-side request forgery

5a9bb05

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Fix code scanning alert no. 18: Full server-side request forgery

a9b392e

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Merge pull request #49 from arpitjain099/alert-autofix-18

5f4aa39

Fix code scanning alert no. 18: Full server-side request forgery

Merge pull request #48 from arpitjain099/alert-autofix-22

029a87f

Fix code scanning alert no. 22: Full server-side request forgery

colombod approved these changes Nov 11, 2024

View reviewed changes

kristapratico reviewed Nov 13, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Code Scanning security alert fixes #129

Code Scanning security alert fixes #129

arpitjain099 commented Oct 20, 2024

arpitjain099 commented Oct 20, 2024

arpitjain099 commented Nov 11, 2024

arpitjain099 commented Nov 11, 2024

arpitjain099 commented Nov 13, 2024

kristapratico Nov 13, 2024

kristapratico Nov 13, 2024

kristapratico Nov 13, 2024

kristapratico Nov 13, 2024

Code Scanning security alert fixes #129

Are you sure you want to change the base?

Code Scanning security alert fixes #129

Conversation

arpitjain099 commented Oct 20, 2024

Purpose

Does this introduce a breaking change?

Pull Request Type

How to Test

What to Check

Other Information

arpitjain099 commented Oct 20, 2024

arpitjain099 commented Nov 11, 2024

arpitjain099 commented Nov 11, 2024

arpitjain099 commented Nov 13, 2024

kristapratico Nov 13, 2024

Choose a reason for hiding this comment

kristapratico Nov 13, 2024

Choose a reason for hiding this comment

kristapratico Nov 13, 2024

Choose a reason for hiding this comment

kristapratico Nov 13, 2024

Choose a reason for hiding this comment