search

DevOps-zhuang / copilot-metric-saver

call github copilot usage and seat API, then save fetched data to file or mysql for persistent save, then anlyze it.
2 stars 3 forks source link

Fix code scanning alert no. 4: Uncontrolled data used in path expression #11

Closed DevOps-zhuang closed 3 weeks ago

DevOps-zhuang commented 3 weeks ago

Fixes https://github.com/DevOps-zhuang/copilot-metric-saver/security/code-scanning/4

To fix the problem, we need to ensure that the constructed file paths are contained within a safe root directory. This can be achieved by normalizing the paths using path.resolve and then verifying that the normalized paths start with the root directory.

  1. Normalize the constructed file paths using path.resolve.
  2. Check that the normalized paths start with the root directory.
  3. If the paths do not start with the root directory, handle the error appropriately (e.g., log an error, throw an exception, or return an error response).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.