Skip to content

56437#2

Open
metodikamikaelnilsson wants to merge 1 commit intomasterfrom
56437
Open

56437#2
metodikamikaelnilsson wants to merge 1 commit intomasterfrom
56437

Conversation

@metodikamikaelnilsson
Copy link

@metodikamikaelnilsson metodikamikaelnilsson commented Apr 1, 2025

No description provided.

github-advanced-security[bot]
github-advanced-security bot found potential problems Apr 1, 2025
View reviewed changes
src/http.ts
if (typeof body === 'string') {
// Remove any extra characters that appear before or after the SOAP envelope.
const regex = /(?:<\?[^?]*\?>[\s]*)?<([^:]*):Envelope([\S\s]*)<\/\1:Envelope>/i;
const match = body.replace(/<!--[\s\S]*?-->/, '').match(regex);

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
Loading
that depends on
library input
Loading
may run slow on strings starting with '<!--' and with many repetitions of '<!--'.
src/http.ts
if (typeof body === 'string') {
// Remove any extra characters that appear before or after the SOAP envelope.
const regex = /(?:<\?[^?]*\?>[\s]*)?<([^:]*):Envelope([\S\s]*)<\/\1:Envelope>/i;
const match = body.replace(/<!--[\s\S]*?-->/, '').match(regex);

Check failure

Code scanning / CodeQL

Incomplete multi-character sanitization High

This string may still contain
<!--
Loading
, which may cause an HTML element injection vulnerability.

Copilot Autofix

AI 11 months ago

To fix the problem, we need to ensure that all occurrences of HTML comments are removed from the body string. The best way to achieve this is to apply the regular expression replacement repeatedly until no more replacements can be performed. This ensures that all instances of the targeted pattern are removed.

We will modify the handleResponse method to repeatedly apply the regular expression replacement until the body string no longer changes. This approach guarantees that all HTML comments are removed, preventing any potential injection vulnerabilities.

Suggested changeset 1
src/http.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/http.ts b/src/http.ts
--- a/src/http.ts
+++ b/src/http.ts
@@ -175,3 +175,8 @@
       const regex = /(?:<\?[^?]*\?>[\s]*)?<([^:]*):Envelope([\S\s]*)<\/\1:Envelope>/i;
-      const match = body.replace(/<!--[\s\S]*?-->/, '').match(regex);
+      let previous;
+      do {
+        previous = body;
+        body = body.replace(/<!--[\s\S]*?-->/g, '');
+      } while (body !== previous);
+      const match = body.match(regex);
       if (match) {
EOF
@@ -175,3 +175,8 @@
const regex = /(?:<\?[^?]*\?>[\s]*)?<([^:]*):Envelope([\S\s]*)<\/\1:Envelope>/i;
const match = body.replace(/<!--[\s\S]*?-->/, '').match(regex);
let previous;
do {
previous = body;
body = body.replace(/<!--[\s\S]*?-->/g, '');
} while (body !== previous);
const match = body.match(regex);
if (match) {
Copilot is powered by AI and may make mistakes. Always verify output.
src/wsdl/index.ts
if (~ns.indexOf('http://www.w3.org/')) {
continue;
}
if (~ns.indexOf('http://xml.apache.org/')) {

Check failure

Code scanning / CodeQL

Incomplete URL substring sanitization High

'
http://xml.apache.org/
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Copilot Autofix

AI 11 months ago

To fix the problem, we need to replace the substring check with a more robust method that parses the URL and verifies the host explicitly. This involves using the url module to parse the URL and then checking the host against a whitelist of allowed hosts.

  • Parse the URL using the url module to extract the host.
  • Check if the host is in a predefined list of allowed hosts.
  • Replace the substring check with this new method.
Suggested changeset 1
src/wsdl/index.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/wsdl/index.ts b/src/wsdl/index.ts
--- a/src/wsdl/index.ts
+++ b/src/wsdl/index.ts
@@ -1346,3 +1346,5 @@
       }
-      if (~ns.indexOf('http://xml.apache.org/')) {
+      const parsedUrl = url.parse(ns);
+      const allowedHosts = ['xml.apache.org'];
+      if (allowedHosts.includes(parsedUrl.host)) {
         continue;
EOF
@@ -1346,3 +1346,5 @@
}
if (~ns.indexOf('http://xml.apache.org/')) {
const parsedUrl = url.parse(ns);
const allowedHosts = ['xml.apache.org'];
if (allowedHosts.includes(parsedUrl.host)) {
continue;
Copilot is powered by AI and may make mistakes. Always verify output.
test/server-receive-complex-type.js
before(function (done) {

server = http.createServer(function(request,response) {
response.end('404: Not Found: ' + request.url);

Check failure

Code scanning / CodeQL

Reflected cross-site scripting High test

Cross-site scripting vulnerability due to a
user-provided value
Loading
.

Copilot Autofix

AI 11 months ago

To fix the reflected cross-site scripting vulnerability, we need to sanitize the request.url before including it in the response. The best way to do this is by using a well-known library for escaping HTML, such as escape-html. This will ensure that any potentially malicious content in the URL is properly escaped and cannot be executed as a script in the user's browser.

We will:

  1. Import the escape-html library.
  2. Use the escape function from the escape-html library to sanitize the request.url before including it in the response.
Suggested changeset 2
test/server-receive-complex-type.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/test/server-receive-complex-type.js b/test/server-receive-complex-type.js
--- a/test/server-receive-complex-type.js
+++ b/test/server-receive-complex-type.js
@@ -1,8 +1,9 @@
-'use strict';
-
-var assert = require('assert');
-var http = require('http');
-var soap = require('..');
-var server;
-var url;
+'use strict';
+
+var assert = require('assert');
+var http = require('http');
+var escape = require('escape-html');
+var soap = require('..');
+var server;
+var url;
 
@@ -77,5 +78,5 @@
 
-    server = http.createServer(function(request,response) {
-      response.end('404: Not Found: ' + request.url);
-    });
+    server = http.createServer(function(request,response) {
+      response.end('404: Not Found: ' + escape(request.url));
+    });
     
EOF
@@ -1,8 +1,9 @@
'use strict';

var assert = require('assert');
var http = require('http');
var soap = require('..');
var server;
var url;
'use strict';

var assert = require('assert');
var http = require('http');
var escape = require('escape-html');
var soap = require('..');
var server;
var url;

@@ -77,5 +78,5 @@

server = http.createServer(function(request,response) {
response.end('404: Not Found: ' + request.url);
});
server = http.createServer(function(request,response) {
response.end('404: Not Found: ' + escape(request.url));
});

package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -18,3 +18,4 @@
     "whatwg-mimetype": "4.0.0",
-    "xml-crypto": "^6.0.1"
+    "xml-crypto": "^6.0.1",
+    "escape-html": "^1.0.3"
   },
EOF
@@ -18,3 +18,4 @@
"whatwg-mimetype": "4.0.0",
"xml-crypto": "^6.0.1"
"xml-crypto": "^6.0.1",
"escape-html": "^1.0.3"
},
This fix introduces these dependencies
Package Version Security advisories
escape-html (npm) 1.0.3 None
Copilot is powered by AI and may make mistakes. Always verify output.
test/server-style-mix-test.js
before(function (done) {

server = http.createServer(function (request, response) {
response.end('404: Not Found: ' + request.url);

Check failure

Code scanning / CodeQL

Reflected cross-site scripting High test

Cross-site scripting vulnerability due to a
user-provided value
Loading
.

Copilot Autofix

AI 11 months ago

To fix the reflected cross-site scripting vulnerability, we need to sanitize the user input before incorporating it into the response. The best way to do this is by using a library that provides HTML escaping functionality. In this case, we can use the escape-html library to escape the request.url before including it in the response.

  1. Install the escape-html library.
  2. Import the escape-html library in the file.
  3. Use the escape function from the escape-html library to sanitize the request.url before concatenating it into the response.
Suggested changeset 2
test/server-style-mix-test.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/test/server-style-mix-test.js b/test/server-style-mix-test.js
--- a/test/server-style-mix-test.js
+++ b/test/server-style-mix-test.js
@@ -7,2 +7,3 @@
 const { default: axios } = require('axios');
+var escape = require('escape-html');
 var server;
@@ -43,3 +44,3 @@
         server = http.createServer(function (request, response) {
-            response.end('404: Not Found: ' + request.url);
+            response.end('404: Not Found: ' + escape(request.url));
         });
EOF
@@ -7,2 +7,3 @@
const { default: axios } = require('axios');
var escape = require('escape-html');
var server;
@@ -43,3 +44,3 @@
server = http.createServer(function (request, response) {
response.end('404: Not Found: ' + request.url);
response.end('404: Not Found: ' + escape(request.url));
});
package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -18,3 +18,4 @@
     "whatwg-mimetype": "4.0.0",
-    "xml-crypto": "^6.0.1"
+    "xml-crypto": "^6.0.1",
+    "escape-html": "^1.0.3"
   },
EOF
@@ -18,3 +18,4 @@
"whatwg-mimetype": "4.0.0",
"xml-crypto": "^6.0.1"
"xml-crypto": "^6.0.1",
"escape-html": "^1.0.3"
},
This fix introduces these dependencies
Package Version Security advisories
escape-html (npm) 1.0.3 None
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@metodikamikaelnilsson