search

GSA / 889-tool

Web service for determining 889 compliance of vendors
1 stars 0 forks source link

Dependabot Alert: Follow Redirects improperly handles URLs in the url.parse() function #163

Open JennaySDavis opened 5 months ago

JennaySDavis commented 5 months ago

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

JennaySDavis commented 5 months ago

#163 Acceptance Criteria

Pass/Fail Description
Pass Execute Search; sam.gov returns results to 889 Tool

Comments/Additional Notes *A minor issue with aria labels was located, affecting the accessibility score. See https://github.com/orgs/GSA/projects/116/views/3?pane=issue&itemId=51527311

ADA Compliance (Automated scan via Chrome Lighthouse) Criteria Score
Performance 95
Accessibility 96
Best Practices 93

Passed 01/29/2024 - JSD

LoraBradford commented 5 months ago

Reviewed 889 tool, did not see any issues. Story #185 will fix the accessibility score. Thank you! Moving to done!