chore: update enhanced test tool #4252
Conversation
|
✅ Deploy Preview for module-federation-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ); | ||
| const code = `(function(${args.join( | ||
| ', ', | ||
| )}) {${content}\n})`; |
Check warning
Code scanning / CodeQL
Improper code sanitization Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 days ago
To fix the improper code sanitization, we need to ensure that values interpolated into generated JavaScript code (here, as part of require(...) in content) are properly sanitized and any potentially dangerous characters are escaped. Following the recommendation, we should define a function (e.g., escapeUnsafeChars) that escapes characters like <, >, /, \, and other relevant Unicode/control chars after running JSON.stringify. We will update line 783 so that instead of just JSON.stringify('./' + arg), we run this escape function on the result. This means:
- Add a helper escape function (e.g.,
escapeUnsafeChars) in this file. - Change the string interpolation in the mapping on line 783 to embed the escaped string instead.
- No other code needs to be changed.
This fix is fully contained in packages/enhanced/test/ConfigTestCases.rstest.ts, and only requires code additions and a small refactor to the mapping logic.
| @@ -14,6 +14,26 @@ | ||
| rs, | ||
| } from '@rstest/core'; | ||
|
|
||
| // Escape potentially dangerous characters for insertion into generated JS code | ||
| const charMap: { [key: string]: string } = { | ||
| '<': '\\u003C', | ||
| '>': '\\u003E', | ||
| '/': '\\u002F', | ||
| '\\': '\\\\', | ||
| '\b': '\\b', | ||
| '\f': '\\f', | ||
| '\n': '\\n', | ||
| '\r': '\\r', | ||
| '\t': '\\t', | ||
| '\0': '\\0', | ||
| '\u2028': '\\u2028', | ||
| '\u2029': '\\u2029' | ||
| }; | ||
| function escapeUnsafeChars(str: string): string { | ||
| // Only escape characters appearing in charMap | ||
| return str.replace(/[<>\b\f\n\r\t\0\u2028\u2029\\/]/g, x => charMap[x] || x); | ||
| } | ||
|
|
||
| // 预热 webpack（与原逻辑一致） | ||
| require('./helpers/warmup-webpack'); | ||
|
|
||
| @@ -780,7 +800,7 @@ | ||
| content = `module.exports = (${module | ||
| .map( | ||
| (arg: any) => | ||
| `require(${JSON.stringify(`./${arg}`)})`, | ||
| `require(${escapeUnsafeChars(JSON.stringify(`./${arg}`))})`, | ||
| ) | ||
| .join(', ')});`; | ||
| } else { |
| ); | ||
| const code = `(function(${args.join( | ||
| ', ', | ||
| )}) {${content}\n})`; |
Check warning
Code scanning / CodeQL
Improper code sanitization Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 days ago
To fix this issue, we should fully sanitize all strings that will be injected into executable code, not relying solely on JSON.stringify. As per recommended patterns (and CodeQL docs), we should introduce an escape function that replaces potentially dangerous characters (e.g. <, >, /, \, and line breaks) with safe escape sequences before including them.
Specifically:
- Implement an
escapeUnsafeCharsfunction in the relevant region of the file. - In the dynamic code construction at line 783, wrap the output of
JSON.stringifywithescapeUnsafeChars. - This ensures that even if
argincludes risky characters, they will be safely escaped and cannot break out of the script context or cause injection.
All changes are confined to the appropriate edit region.
| @@ -777,10 +777,31 @@ | ||
| currentDirectory, | ||
| '.array-require.js', | ||
| ); | ||
| // Add escapeUnsafeChars helper | ||
| const charMap = { | ||
| '<': '\\u003C', | ||
| '>': '\\u003E', | ||
| '/': '\\u002F', | ||
| '\\': '\\\\', | ||
| '\b': '\\b', | ||
| '\f': '\\f', | ||
| '\n': '\\n', | ||
| '\r': '\\r', | ||
| '\t': '\\t', | ||
| '\0': '\\0', | ||
| '\u2028': '\\u2028', | ||
| '\u2029': '\\u2029' | ||
| }; | ||
| function escapeUnsafeChars(str: string) { | ||
| return str.replace( | ||
| /[<>\b\f\n\r\t\0\u2028\u2029/\\]/g, | ||
| x => (charMap as any)[x] || x, | ||
| ); | ||
| } | ||
| content = `module.exports = (${module | ||
| .map( | ||
| (arg: any) => | ||
| `require(${JSON.stringify(`./${arg}`)})`, | ||
| `require(${escapeUnsafeChars(JSON.stringify(`./${arg}`))})`, | ||
| ) | ||
| .join(', ')});`; | ||
| } else { |
Description
Related Issue
Types of changes
Checklist