Skip to content

Potential fix for code scanning alert no. 35: Incomplete URL substring sanitization #25237

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Potential fix for code scanning alert no. 35: Incomplete URL substring sanitization #25237

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions scripts/west_commands/sbom/output_pre_process.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@

from data_structure import Data, License, LicenseExpr
from license_utils import get_license, get_spdx_license_expr_info, is_spdx_license

from urllib.parse import urlparse

def pre_process(data: Data):
'''Do pre-processing of data for simpler usage by the output modules.'''
Expand Down Expand Up @@ -98,8 +98,9 @@
package.version = 'NoneVersion'
if package.url is None:
continue
if (package.name is None) and ('github.com' in package.url):
offs = package.url.find('github.com') + len('github.com') + 1
parsed_url = urlparse(package.url)
if (package.name is None) and (parsed_url.hostname and parsed_url.hostname.lower().endswith("github.com")):

Check failure

Code scanning / CodeQL

Incomplete URL substring sanitization High

The string
github.com
Loading
may be at an arbitrary position in the sanitized URL.

Copilot Autofix

AI 8 days ago

To fix the problem, we must parse the hostname and ensure that it represents the expected host. The best way to ensure robust handling is to check that the hostname either exactly matches "github.com" or ends with ".github.com", which safely includes the root domain and any direct subdomains, but excludes things like evil-github.com. Modify the block in scripts/west_commands/sbom/output_pre_process.py that checks parsed_url.hostname.lower().endswith("github.com") to instead check:

hostname = parsed_url.hostname.lower()
if package.name is None and (hostname == "github.com" or hostname.endswith(".github.com")):
    ...

No additional imports are needed, and all changes are local to this function.

Suggested changeset 1
scripts/west_commands/sbom/output_pre_process.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/scripts/west_commands/sbom/output_pre_process.py b/scripts/west_commands/sbom/output_pre_process.py
--- a/scripts/west_commands/sbom/output_pre_process.py
+++ b/scripts/west_commands/sbom/output_pre_process.py
@@ -99,7 +99,8 @@
         if package.url is None:
             continue
         parsed_url = urlparse(package.url)
-        if (package.name is None) and (parsed_url.hostname and parsed_url.hostname.lower().endswith("github.com")):
+        hostname = parsed_url.hostname.lower() if parsed_url.hostname else ""
+        if (package.name is None) and (hostname == "github.com" or hostname.endswith(".github.com")):
             offs = package.url.find(parsed_url.hostname) + len(parsed_url.hostname) + 1
             package.name = package.url[offs:]
             if package.name.endswith('.git'):
EOF
@@ -99,7 +99,8 @@
if package.url is None:
continue
parsed_url = urlparse(package.url)
if (package.name is None) and (parsed_url.hostname and parsed_url.hostname.lower().endswith("github.com")):
hostname = parsed_url.hostname.lower() if parsed_url.hostname else ""
if (package.name is None) and (hostname == "github.com" or hostname.endswith(".github.com")):
offs = package.url.find(parsed_url.hostname) + len(parsed_url.hostname) + 1
package.name = package.url[offs:]
if package.name.endswith('.git'):
Copilot is powered by AI and may make mistakes. Always verify output.
offs = package.url.find(parsed_url.hostname) + len(parsed_url.hostname) + 1
package.name = package.url[offs:]
if package.name.endswith('.git'):
package.name = package.name[:-4]
Expand Down
Loading