search

treeverse / lakeFS

lakeFS - Data version control for your data lake | Git for data
https://docs.lakefs.io
Apache License 2.0
4.46k stars 355 forks source link

Pull Requests: Sanitize to user provided fields #8203

Open N-o-Z opened 1 month ago

N-o-Z commented 1 month ago

We should sanitize any user inputted fields in pull requests such as Title and Description to avoid potentially malicious attacks

arielshaqed commented 1 month ago

In case this is not part of the plan: It's cool to do it on the backend, but please (also) protect when inserting the user provided fields into the DOM. So it really needs to be based on an allowlist rather than on a blocklist. That list can come (and probably should) from an existing React library, of course.

N-o-Z commented 1 month ago

@itaigilo I think this is something we can do this current sprint. WDYT?

itaigilo commented 1 month ago

@itaigilo I think this is something we can do this current sprint. WDYT?

Yeah, I guess so. Will do it on my next workday.

itaiad200 commented 2 days ago

@itaigilo should we close this?

itaigilo commented 1 day ago

@itaigilo should we close this?

@N-o-Z can we close it?

N-o-Z commented 1 day ago

@itaigilo should we close this?

@N-o-Z can we close it?

There's an open PR linked to this issue - what about it?

itaigilo commented 1 day ago

There's an open PR linked to this issue - what about it?

It's not relevant anymore - there's no need to sanitize the fields on the UI side, and this PR can be closed.

N-o-Z commented 1 day ago

There's no need because? Also what about the BE?