Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: tighten backend's request validation #3395

Merged
merged 5 commits into from
Oct 15, 2024
Merged

fix: tighten backend's request validation #3395

merged 5 commits into from
Oct 15, 2024
+13,773 −6,159

Conversation

chriskari
Copy link
Contributor

@chriskari chriskari commented Oct 10, 2024 •
edited
Loading

Description
see related isssue

Changes proposed in this pull request:

  • added filter for invalid, harmful characters such as "<", ">", ";", ".."
  • added filter for invalid request method TRACE, OPTIONS, HEAD
  • added filter for forwarded and x-forwarded-for header

Related issue(s)
#3372

Definition of done

  • The PR's title starts with one of the following prefixes:
    • feat: A new feature
    • fix: A bug fix
    • docs: Documentation only changes
    • refactor: A code change that neither fixes a bug nor adds a feature
    • test: Adding tests
    • chore: Maintainance changes to the build process or auxiliary tools, libraries, workflows, etc.
  • Related issues are linked. To link internal trackers, use the issue IDs like backlog#4567
  • Explain clearly why you created the PR and what changes it introduces
  • All necessary steps are delivered, for example, tests, documentation, merging

@kyma-bot kyma-bot added cla: yes Indicates the PR's author has signed the CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Oct 10, 2024
@chriskari chriskari linked an issue Oct 10, 2024 that may be closed by this pull request
Tighten input validation for requests initiated by the backend #3372
Open
@kyma-bot kyma-bot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Oct 11, 2024
@kyma-bot kyma-bot added the lgtm Looks good to me! label Oct 14, 2024
@mrCherry97 mrCherry97 merged commit 8f7b300 into kyma-project:main Oct 15, 2024
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dbadura dbadura dbadura approved these changes

@akucharska akucharska Awaiting requested review from akucharska akucharska is a code owner

@mrCherry97 mrCherry97 Awaiting requested review from mrCherry97 mrCherry97 is a code owner

@OliwiaGowor OliwiaGowor Awaiting requested review from OliwiaGowor OliwiaGowor is a code owner

Assignees

@dbadura dbadura

Labels
cla: yes Indicates the PR's author has signed the CLA. lgtm Looks good to me! size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Tighten input validation for requests initiated by the backend
4 participants
@chriskari @dbadura @kyma-bot @mrCherry97