search

GSA / smartpay-website

SmartPay website
https://federalist-ab31a10d-375d-4040-9324-1ae94e8a36b9.sites.pages.cloud.gov/site/gsa/smartpay-website/
3 stars 0 forks source link

Code Scanning Alert: Incomplete String Escaping or Encoding #559

Open JennaySDavis opened 4 months ago

JennaySDavis commented 4 months ago

Sanitizing untrusted input is a common technique for preventing injection attacks such as SQL injection or cross-site scripting. Usually, this is done by escaping meta-characters such as quotes in a domain-specific way so that they are treated as normal characters.

john-labbate commented 4 months ago

This is inherited from a dev-only dependency of USWDS. The code base is not under our control. If and when it is updated in the package we will update as needed.