GSA / smartpay-training

Prototype for new GSA SmartPay training quizzes
8 stars 4 forks source link

Dependabot Alert: Follow Redirects improperly handles URLs in the url.parse() function #474

Open JennaySDavis opened 5 months ago

JennaySDavis commented 5 months ago

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

JennaySDavis commented 5 months ago

#474 Acceptance Criteria

Pass/Fail Description
Pass Smoke Testing of Training app.

Comments/Additional Notes Performance score will increase when https://github.com/orgs/GSA/projects/43/views/1?pane=issue&itemId=46203471 is completed. A Link checker was completed on the app - no broken links.

ADA Compliance (Automated scan via Chrome Lighthouse) Criteria Score
Performance 96*
Accessibility 100
Best Practices 100

*average several scans were completed

Passed 02/2/2024 - JSD

LoraBradford commented 5 months ago

Thank you! Approved with the understanding that #455 will increase score. Moving to done!