Closed sophia-massie closed 1 year ago
Adding a recommendation to strip out ".sh" extensions as well if we're doing .exe
Everything seems to be working, but I noticed that instances of .exe on my test record are making it through on form submit.
Updated to prevent this. All input fields will be checked on these pages now. Also added in .sh to prevented expressions
Overview
The purpose of this hotfix is to still allow special characters that users may use but restricting invalid characters on form submissions. Your thoroughness of testing is really appreciated! I know it's tedious. Using Django or React utilities in place of this band-aid is the long term goal once the fire is put out.
Related
Changes
The checkForBlankInputs javascript was changed using whitelist methods to allow characters in input. At the same time, the script blacklists some explicit scripting character patterns. This is a front end change to prevent bad characters from making it to the server. The DB utils remove bad characters server side in apcd_database.py.
Testing
UI
User input:
On change, text is changed to :