Introduce archive.tira.io to prepare for usage in pyterrier-artifacts #671
Conversation
Development
update pyterrier-artifacts to main
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return JsonResponse(ret[0], safe=False) | ||
| else: | ||
| return HttpResponseNotFound( | ||
| json.dumps({"status": 1, "message": f"Could not find a software '{software}' by user '{user_id}'."}) |
Check warning
Code scanning / CodeQL
Reflected server-side cross-site scripting Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 7 days ago
To fix the problem, we need to escape the user_id and software parameters before including them in the JSON response message. This can be done using the html.escape() function from the standard library to ensure that any special characters are properly escaped, preventing XSS attacks.
We will modify the code in the software_details function to escape the user_id and software parameters before including them in the JSON response message. This change will be made in the file application/src/tira_app/endpoints/v1/_systems.py.
| @@ -1,2 +1,3 @@ | ||
| import json | ||
| import html | ||
|
|
||
| @@ -51,3 +52,3 @@ | ||
| return HttpResponseNotFound( | ||
| json.dumps({"status": 1, "message": f"Could not find a software '{software}' by user '{user_id}'."}) | ||
| json.dumps({"status": 1, "message": f"Could not find a software '{html.escape(software)}' by user '{html.escape(user_id)}'."}) | ||
| ) |
No description provided.