Closed LucaCinquini closed 7 years ago
Now the query value is validated directly on the CoG front-end before being submitted to the ESGF back-end for searching. The validation rules are exactly the same that apply to the 'text' field in the main search page.
@LucaCinquini You'll have to explain how this commit resolves this ticket.
https://github.com/EarthSystemCoG/COG/commit/5a191cccb60e590fbe12a2d6518fd0c013f64f54 Seems just an error message addition.
there was more to the commit than I could see. code looks good.
Who: NOAA security scan
The datacart has a text widget that allows to sub-select files. Any value entered in this widget is not properly validated, although it must be noted that the ESGF search back-end does URL-escape all values before submitting them to Solr for querying.