Skip to content

56437 - #2

Open
metodikamikaelnilsson wants to merge 1 commit into
masterfrom
56437
Open

56437#2
metodikamikaelnilsson wants to merge 1 commit into
masterfrom
56437

Conversation

@metodikamikaelnilsson

@metodikamikaelnilsson metodikamikaelnilsson commented Apr 1, 2025

Copy link
Copy Markdown

No description provided.

github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 1, 2025
View reviewed changes
Comment thread src/http.ts
options[attr] = exoptions[attr];
}
}
debug('Http request: %j', options);

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information

This logs sensitive data returned by [an access to _password](1) as clear text.

Copilot Autofix

AI over 1 year ago

To fix the problem, we need to ensure that sensitive information such as passwords is not logged. The best way to fix this is to sanitize the options object before logging it. We can create a copy of the options object and remove or mask any sensitive information before passing it to the debug function.

  • Create a sanitized copy of the options object.
  • Remove or mask sensitive information such as passwords from the sanitized copy.
  • Log the sanitized copy instead of the original options object.
Suggested changeset 1
src/http.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/http.ts b/src/http.ts
--- a/src/http.ts
+++ b/src/http.ts
@@ -159,3 +159,7 @@
     }
-    debug('Http request: %j', options);
+    const sanitizedOptions = { ...options };
+    if (sanitizedOptions.headers && sanitizedOptions.headers.Authorization) {
+      sanitizedOptions.headers.Authorization = '***';
+    }
+    debug('Http request: %j', sanitizedOptions);
     return options;
EOF
@@ -159,3 +159,7 @@
}
debug('Http request: %j', options);
const sanitizedOptions = { ...options };
if (sanitizedOptions.headers && sanitizedOptions.headers.Authorization) {
sanitizedOptions.headers.Authorization = '***';
}
debug('Http request: %j', sanitizedOptions);
return options;
Copilot is powered by AI and may make mistakes. Always verify output.
Comment thread src/http.ts
if (typeof body === 'string') {
// Remove any extra characters that appear before or after the SOAP envelope.
const regex = /(?:<\?[^?]*\?>[\s]*)?<([^:]*):Envelope([\S\s]*)<\/\1:Envelope>/i;
const match = body.replace(/<!--[\s\S]*?-->/, '').match(regex);

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data

This [regular expression](1) that depends on [library input](2) may run slow on strings starting with '<' and with many repetitions of '<9'. This [regular expression](3) that depends on [library input](2) may run slow on strings starting with '<:envelope' and with many repetitions of '<:envelopea'.
Comment thread src/http.ts
if (typeof body === 'string') {
// Remove any extra characters that appear before or after the SOAP envelope.
const regex = /(?:<\?[^?]*\?>[\s]*)?<([^:]*):Envelope([\S\s]*)<\/\1:Envelope>/i;
const match = body.replace(/<!--[\s\S]*?-->/, '').match(regex);

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data

This [regular expression](1) that depends on [library input](2) may run slow on strings starting with '<!--' and with many repetitions of '<!--'.
Comment thread src/http.ts
if (typeof body === 'string') {
// Remove any extra characters that appear before or after the SOAP envelope.
const regex = /(?:<\?[^?]*\?>[\s]*)?<([^:]*):Envelope([\S\s]*)<\/\1:Envelope>/i;
const match = body.replace(/<!--[\s\S]*?-->/, '').match(regex);

Check failure

Code scanning / CodeQL

Incomplete multi-character sanitization

This string may still contain [<!--](1), which may cause an HTML element injection vulnerability.

Copilot Autofix

AI over 1 year ago

To fix the problem, we need to ensure that all occurrences of HTML comments are removed from the body string. The best way to achieve this is to apply the regular expression replacement repeatedly until no more replacements can be performed. This ensures that all instances of the targeted pattern are removed.

We will modify the handleResponse method to repeatedly apply the regular expression replacement until the body string no longer changes. This approach guarantees that all HTML comments are removed, preventing any potential injection vulnerabilities.

Suggested changeset 1
src/http.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/http.ts b/src/http.ts
--- a/src/http.ts
+++ b/src/http.ts
@@ -175,3 +175,8 @@
       const regex = /(?:<\?[^?]*\?>[\s]*)?<([^:]*):Envelope([\S\s]*)<\/\1:Envelope>/i;
-      const match = body.replace(/<!--[\s\S]*?-->/, '').match(regex);
+      let previous;
+      do {
+        previous = body;
+        body = body.replace(/<!--[\s\S]*?-->/g, '');
+      } while (body !== previous);
+      const match = body.match(regex);
       if (match) {
EOF
@@ -175,3 +175,8 @@
const regex = /(?:<\?[^?]*\?>[\s]*)?<([^:]*):Envelope([\S\s]*)<\/\1:Envelope>/i;
const match = body.replace(/<!--[\s\S]*?-->/, '').match(regex);
let previous;
do {
previous = body;
body = body.replace(/<!--[\s\S]*?-->/g, '');
} while (body !== previous);
const match = body.match(regex);
if (match) {
Copilot is powered by AI and may make mistakes. Always verify output.
Comment thread src/security/WSSecurityCert.ts
const endOfSecurityHeader = xml.indexOf('</wsse:Security>');
if (endOfSecurityHeader > -1) {
const securityHeaderRegexp = /<wsse:Security( [^>]*)?>/;
const match = xml.match(securityHeaderRegexp);

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data

This [regular expression](1) that depends on [library input](2) may run slow on strings starting with '<wsse:Security ' and with many repetitions of '<wsse:Security '. This [regular expression](1) that depends on [library input](3) may run slow on strings starting with '<wsse:Security ' and with many repetitions of '<wsse:Security '.
Comment thread src/wsdl/index.ts
if (~ns.indexOf('http://www.w3.org/')) {
continue;
}
if (~ns.indexOf('http://xml.apache.org/')) {

Check failure

Code scanning / CodeQL

Incomplete URL substring sanitization

'[http://xml.apache.org/](1)' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Copilot Autofix

AI over 1 year ago

To fix the problem, we need to replace the substring check with a more robust method that parses the URL and verifies the host explicitly. This involves using the url module to parse the URL and then checking the host against a whitelist of allowed hosts.

  • Parse the URL using the url module to extract the host.
  • Check if the host is in a predefined list of allowed hosts.
  • Replace the substring check with this new method.
Suggested changeset 1
src/wsdl/index.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/wsdl/index.ts b/src/wsdl/index.ts
--- a/src/wsdl/index.ts
+++ b/src/wsdl/index.ts
@@ -1346,3 +1346,5 @@
       }
-      if (~ns.indexOf('http://xml.apache.org/')) {
+      const parsedUrl = url.parse(ns);
+      const allowedHosts = ['xml.apache.org'];
+      if (allowedHosts.includes(parsedUrl.host)) {
         continue;
EOF
@@ -1346,3 +1346,5 @@
}
if (~ns.indexOf('http://xml.apache.org/')) {
const parsedUrl = url.parse(ns);
const allowedHosts = ['xml.apache.org'];
if (allowedHosts.includes(parsedUrl.host)) {
continue;
Copilot is powered by AI and may make mistakes. Always verify output.
Comment thread test/client-response-options-test.js
before(function (done) {
// start test soap server (hello.wsdl)
server = http.createServer(function (request, response) {
response.end('404: Not Found: ' + request.url);

Check failure

Code scanning / CodeQL

Reflected cross-site scripting

Cross-site scripting vulnerability due to a [user-provided value](1).

Copilot Autofix

AI over 1 year ago

To fix the reflected cross-site scripting vulnerability, we need to sanitize the user input before including it in the HTTP response. The best way to do this is by using a library that provides HTML escaping functionality. This will ensure that any potentially malicious characters in the user input are properly encoded, preventing the execution of scripts.

In this case, we can use the escape-html library to sanitize the request.url before including it in the response. This change will be made in the test/client-response-options-test.js file.

Suggested changeset 2
test/client-response-options-test.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/test/client-response-options-test.js b/test/client-response-options-test.js
--- a/test/client-response-options-test.js
+++ b/test/client-response-options-test.js
@@ -5,3 +5,4 @@
   http = require('http'),
-  assert = require('assert');
+  assert = require('assert'),
+  escapeHtml = require('escape-html');
 
@@ -28,3 +29,3 @@
     server = http.createServer(function (request, response) {
-      response.end('404: Not Found: ' + request.url);
+      response.end('404: Not Found: ' + escapeHtml(request.url));
     });
EOF
@@ -5,3 +5,4 @@
http = require('http'),
assert = require('assert');
assert = require('assert'),
escapeHtml = require('escape-html');

@@ -28,3 +29,3 @@
server = http.createServer(function (request, response) {
response.end('404: Not Found: ' + request.url);
response.end('404: Not Found: ' + escapeHtml(request.url));
});
package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -18,3 +18,4 @@
     "whatwg-mimetype": "4.0.0",
-    "xml-crypto": "^6.0.1"
+    "xml-crypto": "^6.0.1",
+    "escape-html": "^1.0.3"
   },
EOF
@@ -18,3 +18,4 @@
"whatwg-mimetype": "4.0.0",
"xml-crypto": "^6.0.1"
"xml-crypto": "^6.0.1",
"escape-html": "^1.0.3"
},
This fix introduces these dependencies
Package Version Security advisories
escape-html (npm) 1.0.3 None
Copilot is powered by AI and may make mistakes. Always verify output.
Comment thread test/server-receive-complex-type.js
before(function (done) {

server = http.createServer(function(request,response) {
response.end('404: Not Found: ' + request.url);

Check failure

Code scanning / CodeQL

Reflected cross-site scripting

Cross-site scripting vulnerability due to a [user-provided value](1).

Copilot Autofix

AI over 1 year ago

To fix the reflected cross-site scripting vulnerability, we need to sanitize the request.url before including it in the response. The best way to do this is by using a well-known library for escaping HTML, such as escape-html. This will ensure that any potentially malicious content in the URL is properly escaped and cannot be executed as a script in the user's browser.

We will:

  1. Import the escape-html library.
  2. Use the escape function from the escape-html library to sanitize the request.url before including it in the response.
Suggested changeset 2
test/server-receive-complex-type.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/test/server-receive-complex-type.js b/test/server-receive-complex-type.js
--- a/test/server-receive-complex-type.js
+++ b/test/server-receive-complex-type.js
@@ -1,8 +1,9 @@
-'use strict';
-
-var assert = require('assert');
-var http = require('http');
-var soap = require('..');
-var server;
-var url;
+'use strict';
+
+var assert = require('assert');
+var http = require('http');
+var escape = require('escape-html');
+var soap = require('..');
+var server;
+var url;
 
@@ -77,5 +78,5 @@
 
-    server = http.createServer(function(request,response) {
-      response.end('404: Not Found: ' + request.url);
-    });
+    server = http.createServer(function(request,response) {
+      response.end('404: Not Found: ' + escape(request.url));
+    });
     
EOF
@@ -1,8 +1,9 @@
'use strict';

var assert = require('assert');
var http = require('http');
var soap = require('..');
var server;
var url;
'use strict';

var assert = require('assert');
var http = require('http');
var escape = require('escape-html');
var soap = require('..');
var server;
var url;

@@ -77,5 +78,5 @@

server = http.createServer(function(request,response) {
response.end('404: Not Found: ' + request.url);
});
server = http.createServer(function(request,response) {
response.end('404: Not Found: ' + escape(request.url));
});

package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -18,3 +18,4 @@
     "whatwg-mimetype": "4.0.0",
-    "xml-crypto": "^6.0.1"
+    "xml-crypto": "^6.0.1",
+    "escape-html": "^1.0.3"
   },
EOF
@@ -18,3 +18,4 @@
"whatwg-mimetype": "4.0.0",
"xml-crypto": "^6.0.1"
"xml-crypto": "^6.0.1",
"escape-html": "^1.0.3"
},
This fix introduces these dependencies
Package Version Security advisories
escape-html (npm) 1.0.3 None
Copilot is powered by AI and may make mistakes. Always verify output.
Comment thread test/server-response-event-test.js


server = http.createServer(function (request, response) {
response.end('404: Not Found: ' + request.url);

Check failure

Code scanning / CodeQL

Reflected cross-site scripting

Cross-site scripting vulnerability due to a [user-provided value](1).

Copilot Autofix

AI over 1 year ago

To fix the reflected cross-site scripting vulnerability, we need to sanitize the user input before including it in the HTTP response. The best way to do this is by using a library that provides HTML escaping functionality. This will ensure that any potentially malicious characters in the request.url are properly encoded, preventing the execution of scripts.

We will use the escape-html library to sanitize the request.url before including it in the response. This involves:

  1. Installing the escape-html library.
  2. Importing the escape-html library in the file.
  3. Using the escape function from the escape-html library to sanitize the request.url.
Suggested changeset 2
test/server-response-event-test.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/test/server-response-event-test.js b/test/server-response-event-test.js
--- a/test/server-response-event-test.js
+++ b/test/server-response-event-test.js
@@ -6,2 +6,3 @@
 const { default: axios } = require('axios');
+var escape = require('escape-html');
 var server;
@@ -54,3 +55,3 @@
     server = http.createServer(function (request, response) {
-      response.end('404: Not Found: ' + request.url);
+      response.end('404: Not Found: ' + escape(request.url));
     });
EOF
@@ -6,2 +6,3 @@
const { default: axios } = require('axios');
var escape = require('escape-html');
var server;
@@ -54,3 +55,3 @@
server = http.createServer(function (request, response) {
response.end('404: Not Found: ' + request.url);
response.end('404: Not Found: ' + escape(request.url));
});
package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -18,3 +18,4 @@
     "whatwg-mimetype": "4.0.0",
-    "xml-crypto": "^6.0.1"
+    "xml-crypto": "^6.0.1",
+    "escape-html": "^1.0.3"
   },
EOF
@@ -18,3 +18,4 @@
"whatwg-mimetype": "4.0.0",
"xml-crypto": "^6.0.1"
"xml-crypto": "^6.0.1",
"escape-html": "^1.0.3"
},
This fix introduces these dependencies
Package Version Security advisories
escape-html (npm) 1.0.3 None
Copilot is powered by AI and may make mistakes. Always verify output.
Comment thread test/server-style-mix-test.js
before(function (done) {

server = http.createServer(function (request, response) {
response.end('404: Not Found: ' + request.url);

Check failure

Code scanning / CodeQL

Reflected cross-site scripting

Cross-site scripting vulnerability due to a [user-provided value](1).

Copilot Autofix

AI over 1 year ago

To fix the reflected cross-site scripting vulnerability, we need to sanitize the user input before incorporating it into the response. The best way to do this is by using a library that provides HTML escaping functionality. In this case, we can use the escape-html library to escape the request.url before including it in the response.

  1. Install the escape-html library.
  2. Import the escape-html library in the file.
  3. Use the escape function from the escape-html library to sanitize the request.url before concatenating it into the response.
Suggested changeset 2
test/server-style-mix-test.js

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/test/server-style-mix-test.js b/test/server-style-mix-test.js
--- a/test/server-style-mix-test.js
+++ b/test/server-style-mix-test.js
@@ -7,2 +7,3 @@
 const { default: axios } = require('axios');
+var escape = require('escape-html');
 var server;
@@ -43,3 +44,3 @@
         server = http.createServer(function (request, response) {
-            response.end('404: Not Found: ' + request.url);
+            response.end('404: Not Found: ' + escape(request.url));
         });
EOF
@@ -7,2 +7,3 @@
const { default: axios } = require('axios');
var escape = require('escape-html');
var server;
@@ -43,3 +44,3 @@
server = http.createServer(function (request, response) {
response.end('404: Not Found: ' + request.url);
response.end('404: Not Found: ' + escape(request.url));
});
package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -18,3 +18,4 @@
     "whatwg-mimetype": "4.0.0",
-    "xml-crypto": "^6.0.1"
+    "xml-crypto": "^6.0.1",
+    "escape-html": "^1.0.3"
   },
EOF
@@ -18,3 +18,4 @@
"whatwg-mimetype": "4.0.0",
"xml-crypto": "^6.0.1"
"xml-crypto": "^6.0.1",
"escape-html": "^1.0.3"
},
This fix introduces these dependencies
Package Version Security advisories
escape-html (npm) 1.0.3 None
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@metodikamikaelnilsson @github-advanced-security