Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Incomplete sanitization of text strings

See original GitHub issue

LGTM reports the following line does incomplete sanitization, introduced in 61cfe58.

https://github.com/amio/badgen-service/blob/8f703af7367d58670de39c2170a4e2949c382555/libs/serve-badge.js#L15

This line only replaces the first instance of <, which i’m guessing is not what you intended to do?

Would it not be better to handle this for both subject and status, and in the same way, making sure that any potential character which may mess up the SVG is escaped? (I forsee users wanting to e.g. use < or > characters to talk about version compatibility) This would probably be better handled in badgen than badgen-service right, so any other users of the library will also benefit.

Issue Analytics

State:
Created 5 years ago
Comments:6 (6 by maintainers)

Top GitHub Comments

1reaction

s0commented, Aug 30, 2018

Woah 20% drop is quite a bit… Did you use a benchmarking tool for this or was it just some simple tests?

It turns out this should be handled in badgen, or the width would be calculated as < other than <.

Ah yeah that would definitely be a problem, hmm.

0reactions

amiocommented, Sep 11, 2018

Fixed in 550a136

Top Results From Across the Web

Incomplete string escaping or encoding - CodeQL - GitHub

Incomplete string escaping or encoding¶ ... Sanitizing untrusted input is a common technique for preventing injection attacks such as SQL injection or cross-site ......

Incomplete string escaping or encoding - Stack Overflow

i ran a Code Scanning in Github in my repo , and this line in my JS file t.location.href.split("#")[0].replace(/<[^>]*>/g ...

How to Prevent Web Attacks Using Input Sanitization

However, incomplete sanitization is not much better. Here are a few of the possible attack paths to think about.

Top ten ways to clean your data - Microsoft Support

Misspelled words, stubborn trailing spaces, unwanted prefixes, improper cases, and nonprinting characters make a bad first impression.

SafeHtmlUtils (GWT Javadoc)

Returns a SafeHtml constructed from a safe string, i.e., without escaping the ... must end in "inner HTML" context and not contain incomplete...