Localstack support for running locally #245
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| } | ||
| if jsonRequest { | ||
| http.Redirect(w, r, "https://"+host+"/service/update2/json"+queryString, http.StatusTemporaryRedirect) | ||
| http.Redirect(w, r, extension.ConstructURL(host, "/service/update2/json"+queryString), http.StatusTemporaryRedirect) |
There was a problem hiding this comment.
reported by reviewdog 🐶
[semgrep] An HTTP redirect was found to be crafted from user-input r. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist.
Source: https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect
Cc @thypon @kdenhartog
There was a problem hiding this comment.
seems like these 2 are concerns that need to be addressed.
Also, please encode the query params
| http.Redirect(w, r, extension.ConstructURL(host, "/service/update2/json"+queryString), http.StatusTemporaryRedirect) | ||
| } else { | ||
| http.Redirect(w, r, "https://"+host+"/service/update2"+queryString, http.StatusTemporaryRedirect) | ||
| http.Redirect(w, r, extension.ConstructURL(host, "/service/update2"+queryString), http.StatusTemporaryRedirect) |
There was a problem hiding this comment.
reported by reviewdog 🐶
[semgrep] An HTTP redirect was found to be crafted from user-input r. This can lead to open redirect vulnerabilities, potentially allowing attackers to redirect users to malicious web sites. It is recommend where possible to not allow user-input to craft the redirect URL. When user-input is necessary to craft the request, it is recommended to follow OWASP best practices to restrict the URL to domains in an allowlist.
Source: https://semgrep.dev/r/go.lang.security.injection.open-redirect.open-redirect
Cc @thypon @kdenhartog
DJAndries
force-pushed
the
add-docker-compose
branch
from
b861acb to
9829379
Compare
| --table-name Extensions \ | ||
| --attribute-definitions AttributeName=ID,AttributeType=S \ | ||
| --key-schema AttributeName=ID,KeyType=HASH \ | ||
| --provisioned-throughput ReadCapacityUnits=10,WriteCapacityUnits=10 || true |
There was a problem hiding this comment.
I was thinking that simply invoking the brave-core-crx-packager would be sufficient, rather than adding some insert commands and including a crx blob in the repo. thoughts?
There was a problem hiding this comment.
I wouldn't include the crx blob itself, just the metadata in DDB for testing the API (since go-update doesn't handle the actual blobs).
For a full test, the crx could still be built/uploaded separately.
There was a problem hiding this comment.
this would allow the user to curl the API, but it wouldn't allow a user to test the solution e2e using the browser
5 participants
No description provided.