FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Improve JSON validation in `start-proxy` action by mbg · Pull Request #2956 · github/codeql-action · GitHub

/ codeql-action Public

Improve JSON validation in start-proxy action - #2956

Merged
mbg merged 4 commits into
mainfrom
mbg/start-proxy/validation-improvements
Jul 3, 2025
ConversationCommits (4)ChecksFiles changed
Merged

Improve JSON validation in start-proxy action#2956
mbg merged 4 commits into
mainfrom
mbg/start-proxy/validation-improvements

Conversation

mbg commented Jun 27, 2025 •
edited
Loading

Copy link
Copy Markdown
Member

This PR makes three changes related to the start-proxy action:

  1. Additional validation is performed on the structure of the parsed JSON, to ensure that we have an array of configurations, configurations themselves are objects, and we don't accidentally treat null values as meaningful.
  2. The test coverage is extended for these changes.

Merge / deployment checklist

  • Confirm this change is backwards compatible with existing workflows.
  • Confirm the readme has been updated if necessary.
  • Confirm the changelog has been updated if necessary.

github-advanced-security AI found potential problems Jun 27, 2025
View reviewed changes
Comment thread src/start-proxy.test.ts
Comment on lines +58 to +63
testCredential,
undefined,
),
{
message: "Invalid credentials - must be an object",
},

Check failure

Code scanning / CodeQL

Untrusted data passed to external API with additional heuristic sources

Call to ava.\[callback\].\[param 't'\].throws() \[callback 0 result\] with untrusted data from [getToke ... word(e)](1).
Comment thread src/start-proxy.test.ts
Comment on lines +81 to +86
testCredential,
undefined,
),
{
message: "Invalid credentials - must specify host or url",
},

Check failure

Code scanning / CodeQL

Untrusted data passed to external API with additional heuristic sources

Call to ava.\[callback\].\[param 't'\].throws() \[callback 0 result\] with untrusted data from [getToke ... word(e)](1).
Comment thread src/start-proxy.test.ts Fixed
Comment thread src/start-proxy.test.ts Fixed
mbg force-pushed the mbg/start-proxy/validation-improvements branch from 28fe65c to 9281048 Compare July 2, 2025 16:03
mbg marked this pull request as ready for review July 3, 2025 09:07
mbg requested a review from a team as a code owner July 3, 2025 09:07
mbg merged commit b694213 into main Jul 3, 2025
mbg deleted the mbg/start-proxy/validation-improvements branch July 3, 2025 11:23
github-actions Bot mentioned this pull request Jul 21, 2025
Merged
8 tasks
mbg mentioned this pull request Aug 5, 2025
Merged
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
aibaars aibaars approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL