search

fecgov / fecfile-web-api

Back-end API for FECfile application
Other
8 stars 2 forks source link

[Snyk] Investigate and resolve possible Path Traversal vulnerabilities #1171

Open exalate-issue-sync[bot] opened 3 weeks ago

exalate-issue-sync[bot] commented 3 weeks ago

Snyk has identified two possible “Path Traversal” vulnerabilities. We need to investigate them, and if necessary make code changes to resolve them.

image-20241104-214016.png

image-20241104-214026.png

QA Notes

null

DEV Notes

null

Design

null

See full ticket and images here: FECFILE-1754

exalate-issue-sync[bot] commented 3 weeks ago

Elaine Krauss commented: These warnings were determined to be non-threatening, and no code changes have been made.

exalate-issue-sync[bot] commented 2 weeks ago

Todd Lees commented: I think you’re right that risk is low with these being in helper scripts that aren’t run by the app. I’d actually recommend moving these out of the deployed api codebase and into the validator repo with the other utility scripts are, especially since the schemas are in that repo

exalate-issue-sync[bot] commented 2 weeks ago

Todd Lees commented: Passes CR moving to QA

https://app.circleci.com/pipelines/github/fecgov/fecfile-web-api/4536/workflows/e0d51f6f-013d-4d9e-83fe-7ee57f5a9565/jobs/13100

exalate-issue-sync[bot] commented 1 week ago

Shelly Wise commented: QA review verified test passing for this ticket per DEV.

!image-20241113-170718.png|width=1377,height=618,alt="image-20241113-170718.png"!

QA Review Completed. Moved to Stage Ready.