Autoformat the entire codebase #357

renatodellosso · 2024-12-05T22:38:25Z

No description provided.

pages/[teamSlug]/[seasonSlug]/[competitonSlug]/[reportId]/subjective.tsx

+			.finally(() => {
+				if (location.href.includes("offline"))
+					location.href = `/offline/${props.compId}`;
+				else location.href = `/${teamSlug}/${seasonSlug}/${competitonSlug}`;


To fix the problem, we should avoid directly using user-controlled input for URL redirection. Instead, we can maintain a list of authorized redirects and choose from that list based on the user input. This ensures that only valid and safe URLs are used for redirection.

Create a list of authorized paths that the application can redirect to.

Validate the teamSlug, seasonSlug, and competitonSlug against this list before performing the redirection.

If the values are not valid, redirect to a default safe page or show an error message.

pages/api/img/get.ts

-      highWaterMark: 256 * 1024,
-    });
+		res.writeHead(200, { "content-type": "image/*" });
+		var s = fs.createReadStream(process.env.IMAGE_UPLOAD_DIR + `/${filename}`, {


To fix the problem, we need to ensure that the constructed file path is contained within a safe root folder. We can achieve this by normalizing the path using path.resolve and then checking that the normalized path starts with the root folder. This will prevent path traversal attacks.

Import the path module.

Normalize the file path using path.resolve.

Check that the normalized path starts with the root folder.

If the check fails, return a 403 status code.

If the check passes, proceed with reading the file.

pages/api/img/upload.ts

-  } else {
-    return res.send({ status: 400, message: "Invalid Request" });
-  }
+			var tempFile = fs.readFileSync(file.filepath, { encoding: "base64" });


To fix the problem, we need to ensure that the file paths derived from user input are properly validated and contained within a safe root directory. We can achieve this by normalizing the path using path.resolve and then checking that the normalized path starts with the intended root directory. This will prevent directory traversal attacks and ensure that files are only read and written within the allowed directory.

pages/api/img/upload.ts

-    return res.send({ status: 400, message: "Invalid Request" });
-  }
+			var tempFile = fs.readFileSync(file.filepath, { encoding: "base64" });
+			fs.writeFile(process.env.IMAGE_UPLOAD_DIR + filename, tempFile, (err) => {


To fix the problem, we need to ensure that the constructed file path is contained within a safe root folder. We can achieve this by normalizing the path using path.resolve and then checking that the normalized path starts with the root folder. This will prevent directory traversal attacks.

Import the path module.

Normalize the constructed file path using path.resolve.

Check that the normalized path starts with the root folder (process.env.IMAGE_UPLOAD_DIR).

If the check fails, return an error response.

…signment

BanEvading

Very Skibidi Code

renatodellosso

Looks good

Tr01ler

⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡴⠞⠛⠉⢙⡛⣶⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣴⠋⠀⠀⠀⢰⠁⠀⠀⠉⢻⣷⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢰⠇⠀⠀⠀⠀⠘⠀⠀⠀⠀⠀⠹⣷⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡟⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⠜⢹⠇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣤⣶⡶⠶⠮⠭⠵⢖⠒⠿⢤⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⣠⡶⠿⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠲⣄⡀⠀⠀⠀⠀⠀⣰⠟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⢀⣴⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠚⠿⡷⣄⣀⣴⠞⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⣠⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠪⣻⣄⠀⠀⠀⣀⣀⠤⠴⠒⠚⢋⣭⣟⣯⣍⠉⠓⠒⠦⠤⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⣼⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⡝⣧⠔⠋⠁⠀⣀⠤⠔⣶⣿⡿⠿⠿⠿⠍⠉⠒⠢⢤⣀⠈⠑⠦⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⣼⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡦⠤⢤⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣞⣧⠤⠒⠉⠀⠀⠾⠛⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⢲⣴⣾⣷⢤⡀⠀⠀⠀⠀⠀⠀⠀
⢰⠇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡜⠀⠀⠀⠀⠈⠙⠳⢦⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠸⣾⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠸⠟⢿⣿⣧⠙⢦⠀⠀⠀⠀⠀⠀
⡜⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠿⣦⣄⡀⠀⠐⢄⠀⠀⠀⢻⡇⠀⠀⠀⠀⡠⢊⣭⣬⣭⣶⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⢿⡀⠀⠑⣄⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⢿⣦⡀⠀⠑⢄⣀⢿⠇⠀⠀⠀⡜⣼⠟⠁⠀⠀⠉⢿⡄⠀⠀⠀⠀⣠⠤⠤⠤⣀⡀⠈⠙⡄⠀⠈⢆⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⣝⢦⡀⠀⣠⡞⠢⢄⠀⡜⣼⠁⣠⣴⣶⢦⡀⠀⢻⠀⠀⢀⣎⡴⠟⠛⠛⠶⣝⢦⠀⠘⡄⠀⠈⢧⠀⠀
⢢⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣧⣄⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢦⢻⡾⠋⠀⣀⣀⠁⠁⡇⢰⢿⣄⣿⣎⢷⠀⢸⡇⠀⢸⡝⢀⣤⣄⡀⠀⠙⢷⡀⠀⢱⠀⠀⠈⡇⠀
⠸⡆⠀⠀⠀⠀⠀⠀⠀⠀⡸⠀⠀⠈⠙⣳⢦⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠟⣧⠀⢀⣀⣀⡉⠱⣿⣼⣆⢿⠻⣯⡞⠀⢸⡇⠀⢸⣷⣏⢙⣿⡻⡆⠀⠀⢳⠀⠀⠀⠀⠀⢸⡀
⠀⢳⡀⠀⠀⠀⠀⠀⠉⠚⠁⠀⠀⠀⠀⠀⠉⠻⢿⣦⡀⠀⠀⠀⠀⠀⠀⠀⠀⣰⡏⠈⠁⠀⠀⠉⠢⠈⠛⢻⣿⠿⠛⠁⢀⣿⠇⠀⠈⣿⣿⢿⡟⣧⡷⠀⠀⢸⡄⠀⠀⠀⠀⠈⡇
⠀⠈⢷⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⢿⢧⡀⠀⠀⠀⠢⠤⠔⡽⠁⠚⠉⠉⠉⢗⢷⣄⡠⣀⢻⣆⣀⣠⡿⠋⠀⠀⠀⠈⢿⡷⠿⠟⠁⠀⠀⣼⠀⠀⠀⠀⠀⠀⢱
⠀⠀⠀⠻⣆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢣⠻⡄⠀⢀⣀⡤⠞⠁⠀⠀⠀⠀⠀⠘⢦⡈⠁⠀⠀⠸⡟⠉⠀⠀⠀⠀⠀⠀⠀⠙⢦⣀⣤⡶⠟⠉⠙⠒⠀⠀⠀⠀⢘
⠀⠀⠀⠀⠈⠳⣦⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠠⡀⠀⡇⣿⠛⠉⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⣿⣤⡀⠀⠈⠁⠀⠀⠀⠀⠀⠀⠀⠀⢠⠞⠍⠠⠤⠒⠂⢄⠀⠀⠀⠀⠀⢸
⠀⠀⠀⠀⠀⠀⠈⠙⠲⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢀⣽⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢹⣿⡉⠓⠦⣄⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠐⣉⡿⠓⠲⠄⠀⠀⠀⠀⡆
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠛⠶⢤⣤⣄⣀⣠⣤⡤⠶⠛⣿⡀⠀⢢⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⣿⣿⣄⠀⠀⠉⠙⠒⠲⠤⠤⠤⣤⣤⡤⠖⠚⠁⠀⠀⠀⠀⠀⠀⠀⢰⠃
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢹⣷⠀⠀⠱⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢹⣿⣿⣿⣦⣄⡀⠀⠀⠀⢀⣼⣿⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡞⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⣧⡀⠀⠙⢄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢫⠙⢻⣿⣿⣿⣿⣿⣿⣿⣿⡏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡼⠁⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢳⡱⡀⠀⠀⠣⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠳⣔⢹⡉⢻⣿⣿⣿⣿⡿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡞⠁⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠹⣿⣆⠀⠀⠈⠢⡀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠳⣥⣠⣹⣿⡿⠟⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠞⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠳⣕⢄⠀⠀⠈⠂⠀⠀⠀⠀⠀⠀⠀⠈⠓⠢⠌⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡴⠃⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠻⢷⡦⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⠔⠋⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠺⢕⣦⣄⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⠴⠚⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠛⠻⠤⢄⣀⣀⣀⣀⣀⣀⣠⠤⠴⠒⠊⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀

renatodellosso added 2 commits December 5, 2024 17:35

Add .prettierignore to exclude package-lock.json and node_modules

a8b1b3a

Autoformat all files

d1af03b

renatodellosso added the developer improvement Improve the codebase in non-user-facing ways label Dec 5, 2024

renatodellosso self-assigned this Dec 5, 2024

Merge branch 'main' into autoformatter

2de640a

github-advanced-security bot found potential problems Dec 5, 2024

View reviewed changes

Autoformatted ClientApi.ts

f0ea1a8

renatodellosso requested review from owen-beck and sonofharri December 5, 2024 22:48

renatodellosso added 4 commits December 5, 2024 17:55

Refactor countdown component styles to use object syntax for value as…

0dcf30d

…signment

Add TypeScript ESLint plugin to configuration

571c469

Remove TypeScript ESLint plugin from configuration

b30d199

Merge branch 'main' into autoformatter

d1bc2fe

BanEvading approved these changes Dec 10, 2024

View reviewed changes

renatodellosso commented Dec 10, 2024

View reviewed changes

Tr01ler approved these changes Dec 10, 2024

View reviewed changes

renatodellosso added 3 commits December 10, 2024 16:16

Merge branch 'main' into autoformatter

1935663

Fix formatting

67f0737

Merge branch 'main' into autoformatter

e11e7e0

renatodellosso merged commit ba465f3 into main Dec 10, 2024
4 of 6 checks passed

renatodellosso deleted the autoformatter branch December 10, 2024 21:24

@@ -117,5 +117,14 @@
             			.finally(() => {
-            				if (location.href.includes("offline"))
-            					location.href = `/offline/${props.compId}`;
-            				else location.href = `/${teamSlug}/${seasonSlug}/${competitonSlug}`;
+            				const authorizedPaths = [
+            					`/${teamSlug}/${seasonSlug}/${competitonSlug}`,
+            					`/offline/${props.compId}`
+            				];
+            				const redirectTo = location.href.includes("offline")
+            					? `/offline/${props.compId}`
+            					: `/${teamSlug}/${seasonSlug}/${competitonSlug}`;
+            				if (authorizedPaths.includes(redirectTo)) {
+            					location.href = redirectTo;
+            				} else {
+            					location.href = '/error'; // Redirect to a safe error page
+            				}
             			});

@@ -2,2 +2,3 @@
             import * as fs from "fs";
+            import * as path from "path";
@@ -17,4 +18,11 @@
+            		const rootDir = process.env.IMAGE_UPLOAD_DIR;
+            		const filePath = path.resolve(rootDir, filename);
+            		if (!filePath.startsWith(rootDir)) {
+            			return res.status(403).send({ status: 403, message: "Forbidden" });
+            		}
             		res.writeHead(200, { "content-type": "image/*" });
-            		var s = fs.createReadStream(process.env.IMAGE_UPLOAD_DIR + `/${filename}`, {
+            		var s = fs.createReadStream(filePath, {
             			highWaterMark: 256 * 1024,

@@ -3,3 +3,3 @@
             import * as fs from "fs";
+            import * as path from "path";
             export const config = {
@@ -26,9 +26,16 @@
+            			const ROOT = process.env.IMAGE_UPLOAD_DIR;
             			var filetype = file.mimetype.split("image/")[1];
             			var filename = `/${file.newFilename}.${filetype}`;
-            			console.log(process.env.IMAGE_UPLOAD_DIR + filename);
-            			console.log(process.env.IMAGE_UPLOAD_DIR);
+            			var filePath = path.resolve(ROOT, filename);
+            			if (!filePath.startsWith(ROOT)) {
+            				throw new Error("Invalid file path");
+            			}
             			var tempFile = fs.readFileSync(file.filepath, { encoding: "base64" });
-            			fs.writeFile(process.env.IMAGE_UPLOAD_DIR + filename, tempFile, (err) => {
+            			fs.writeFile(filePath, tempFile, (err) => {
+            				if (err) {
+            					throw err;
+            				}
             				res.send({ status: 200, filename: filename });

@@ -3,2 +3,3 @@
             import * as fs from "fs";
+            import * as path from "path";
@@ -27,8 +28,15 @@
             			var filetype = file.mimetype.split("image/")[1];
-            			var filename = `/${file.newFilename}.${filetype}`;
-            			console.log(process.env.IMAGE_UPLOAD_DIR + filename);
-            			console.log(process.env.IMAGE_UPLOAD_DIR);
+            			var filename = `${file.newFilename}.${filetype}`;
+            			var uploadDir = process.env.IMAGE_UPLOAD_DIR;
+            			var filePath = path.resolve(uploadDir, filename);
+            			if (!filePath.startsWith(uploadDir)) {
+            				return res.send({ status: 403, message: "Forbidden" });
+            			}
             			var tempFile = fs.readFileSync(file.filepath, { encoding: "base64" });
-            			fs.writeFile(process.env.IMAGE_UPLOAD_DIR + filename, tempFile, (err) => {
+            			fs.writeFile(filePath, tempFile, (err) => {
+            				if (err) {
+            					return res.send({ status: 500, message: err.message });
+            				}
             				res.send({ status: 200, filename: filename });

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Autoformat the entire codebase #357

Autoformat the entire codebase #357

Uh oh!

renatodellosso commented Dec 5, 2024

Uh oh!

Check warning

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Copilot Autofix

BanEvading left a comment

Uh oh!

renatodellosso left a comment

Uh oh!

Tr01ler left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Autoformat the entire codebase #357

Autoformat the entire codebase #357

Uh oh!

Conversation

renatodellosso commented Dec 5, 2024

Uh oh!

Check warning

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

BanEvading left a comment

Choose a reason for hiding this comment

Uh oh!

renatodellosso left a comment

Choose a reason for hiding this comment

Uh oh!

Tr01ler left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants