JanssenProject / jans

An open source enterprise digital identity platform for CIAM or workforce... Janssen is a distribution of standards-based, developer friendly, components that are engineered to work together in any cloud. #OAuth #OpenID #FIDO
https://docs.jans.io
Apache License 2.0
478 stars 75 forks source link

fix(jans-cli-tui): display error for session search #10251

Closed devrimyatar closed 14 hours ago

devrimyatar commented 2 days ago

Closes #10250

dryrunsecurity[bot] commented 2 days ago

DryRun Security Summary

The provided patch updates the error message handling in the search_sessions_coroutine() function of the Sessions class to include the response text, which can provide more detailed information to the user for troubleshooting and debugging purposes, without introducing any significant security concerns.

Expand for full summary
**Summary:** The code change in the provided patch is related to the handling of error messages in the `search_sessions_coroutine()` function of the `Sessions` class. The update includes the response text in the error message, which provides more detailed information to the user for troubleshooting and debugging purposes. From an application security perspective, this change does not introduce any significant security concerns, as displaying the response text as part of the error message is a common and expected behavior. However, it's important to ensure that the content of the response text does not contain any potentially sensitive or malicious information that could be displayed to the user, especially if the application is handling user-supplied input or interacting with external systems. **Files Changed:** - `jans-cli-tui/cli_tui/plugins/010_auth_server/sessions.py`: The changes in this file update the error message handling in the `search_sessions_coroutine()` function. The original code used `common_data.app.show_message()` to display the error message, passing the error response status code and the string representation of the response object. The updated code now includes the response text in the error message, using the expression `str(response) + ':' + response.text`. This change ensures that the error message provides more detailed information to the user, which can be helpful for troubleshooting and debugging purposes.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

:green_circle: Risk threshold not exceeded.

View PR in the DryRun Dashboard.

sonarcloud[bot] commented 2 days ago

Quality Gate Passed Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud