Repository navigation
Conversation
added 4 commits
March 29, 2024 09:30
![patched.codes[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
…ava/io/shiftleft/controller/SearchController.java"
…ava/io/shiftleft/controller/CustomerController.java"
…ava/io/shiftleft/controller/AppErrorController.java"
…ava/io/shiftleft/controller/AdminController.java"
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request from patched fixes 9 issues.
Added input sanitization to prevent eval injection
The code diff imports the HtmlUtils class from the Spring Framework and uses it to sanitize the input 'foo' before it is parsed as an expression. This is done to prevent eval injection, a type of security vulnerability.Security fix for file path validation and sanitization
The changes in the diff are primarily focused on improving the security of the system by adding file path validation and sanitization. The code now checks if the file path starts with the base path, and if it doesn't, it throws an exception and sends an error message. This is to prevent directory traversal attacks. The rest of the changes are minor formatting adjustments, such as changing tabs to spaces for indentation and correcting a typo in a comment.Added CSRF token handling and removed unnecessary comments and debug prints
The diff introduces several changes to the code. It adds imports for handling CSRF tokens and session attributes in Spring. It also adds a CSRF token to the session attributes and a method to retrieve it. The errorHtml method is modified to include the CSRF token in the model. An initBinder method is added to disallow binding of the password field. The diff also removes several comment lines and a debug print statement that prints error attributes. The errorAttributes method is simplified to return the error attributes directly.Improved exception handling and security enhancements
The diff includes changes in the way objects are read and written from streams, exception handling, and cookie handling.