Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
8de1d45 to
8fb715b
Compare
8fb715b to
5f37056
Compare
|
⏳ I'm reviewing this pull request for security vulnerabilities and code quality issues. I'll provide an update when I'm done |
![amazon-inspector-n-virginia[bot]](https://avatars.githubusercontent.com/u/214039647?s=60&v=4){kind=small}
| } | ||
| } | ||
|
|
||
| const entries = await fs.readdir(contentDir, { withFileTypes: true }); |
There was a problem hiding this comment.
Description: Path traversal vulnerability detected. An attacker could access files outside the intended directory, potentially exposing sensitive information or executing malicious code. Validate and sanitize file paths by using path.normalize() and checking that the resolved path is within the expected directory. Learn More - https://cwe.mitre.org/data/definitions/22.html.
Severity: High
| } | ||
|
|
||
| async function readMd(filePath) { | ||
| const raw = await fs.readFile(filePath, "utf8"); |
There was a problem hiding this comment.
Description: Path traversal vulnerability detected. An attacker could access files outside the intended directory, potentially exposing sensitive information or executing malicious code. Validate and sanitize file paths by using path.normalize() and checking that the resolved path is within the expected directory. Learn More - https://cwe.mitre.org/data/definitions/22.html.
Severity: High
| slug = entry.name; | ||
| const indexPath = path.join(contentDir, entry.name, "index.md"); | ||
| try { | ||
| await fs.access(indexPath); |
There was a problem hiding this comment.
Description: Path traversal vulnerability detected. An attacker could access files outside the intended directory, potentially exposing sensitive information or executing malicious code. Validate and sanitize file paths by using path.normalize() and checking that the resolved path is within the expected directory. Learn More - https://cwe.mitre.org/data/definitions/22.html.
Severity: High
| } catch { | ||
| continue; | ||
| } | ||
| const inner = await fs.readdir(path.join(contentDir, entry.name)); |
There was a problem hiding this comment.
Description: Path traversal vulnerability detected. An attacker could access files outside the intended directory, potentially exposing sensitive information or executing malicious code. Validate and sanitize file paths by using path.normalize() and checking that the resolved path is within the expected directory. Learn More - https://cwe.mitre.org/data/definitions/22.html.
Severity: High
|
✅ I finished the code review, and left comments with the issues I found. |
| @@ -0,0 +1,222 @@ | |||
| import fs from "node:fs/promises"; | |||
There was a problem hiding this comment.
Do we want to commit this script or have it as a stand-alone script we can run once from our dev machines?
There was a problem hiding this comment.
I decided to commit it so zainab could understand what was happening
5f37056 to
c1530eb
Compare
3 participants
Description
Type of Change
Changes Made
Notes
Testing
Related Github Issue(s)/Trello Ticket(s)
Checklist