Skip to content

Fix JSDoc comment security vulnerability: escape only necessary */ sequences #2421

Fix JSDoc comment security vulnerability: escape only necessary */ sequences

Fix JSDoc comment security vulnerability: escape only necessary */ sequences #2421

Status Failure
Total duration 1m 9s
Artifacts

main.yml

on: pull_request
Matrix: build-and-test
Fit to window
Zoom out
Zoom in

Annotations

6 errors
build-and-test (22)
Process completed with exit code 1.
tests/spec/jsdoc-escaping/basic.test.ts > jsdoc-escaping > should escape JSDoc comment characters in descriptions: tests/spec/jsdoc-escaping/basic.test.ts#L43
Error: Snapshot `jsdoc-escaping > should escape JSDoc comment characters in descriptions 1` mismatched - Expected + Received @@ -8,19 +8,19 @@ * ## AUTHOR: acacode ## * ## SOURCE: https://github.com/acacode/swagger-typescript-api ## * --------------------------------------------------------------- */ - /** Information schema with malicious **/ window.location='http://evil.com' /** content */ + /** Information schema with malicious **\/ window.location='http://evil.com' /** content */ export interface Information { - /** The ID of the information record. Contains **/ dangerous content /** here. */ + /** The ID of the information record. Contains **\/ dangerous content /** here. */ id?: number; - /** Title field with */ and /* characters that could break comments */ + /** Title field with *\/ and /* characters that could break comments */ title?: string; /** * Multi-line description - * with */ characters + * with *\/ characters * and /* other markers * that could break JSDoc comments */ content?: string; } @@ -144,23 +144,28 @@ : input, [ContentType.Text]: (input: any) => input !== null && typeof input !== "string" ? JSON.stringify(input) : input, - [ContentType.FormData]: (input: any) => - Object.keys(input || {}).reduce((formData, key) => { + [ContentType.FormData]: (input: any) => { + if (input instanceof FormData) { + return input; + } + + return Object.keys(input || {}).reduce((formData, key) => { const property = input[key]; formData.append( key, property instanceof Blob ? property : typeof property === "object" && property !== null ? JSON.stringify(property) : `${property}`, ); return formData; - }, new FormData()), + }, new FormData()); + }, [ContentType.UrlEncoded]: (input: any) => this.toQueryString(input), }; protected mergeRequestParams( params1: RequestParams, @@ -283,14 +288,14 @@ export class Api< SecurityDataType extends unknown, > extends HttpClient<SecurityDataType> { information = { /** - * @description Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`. + * @description Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **\/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`. * * @name InformationList - * @summary Get service point file with **/ alert('XSS') /** injection attempt + * @summary Get service point file with **\/ alert('XSS') /** injection attempt * @request GET:/information */ informationList: (params: RequestParams = {}) => this.request<Information, any>({ path: `/information`, ❯ tests/spec/jsdoc-escaping/basic.test.ts:43:21
build-and-test (24)
Process completed with exit code 1.
tests/spec/jsdoc-escaping/basic.test.ts > jsdoc-escaping > should escape JSDoc comment characters in descriptions: tests/spec/jsdoc-escaping/basic.test.ts#L43
Error: Snapshot `jsdoc-escaping > should escape JSDoc comment characters in descriptions 1` mismatched - Expected + Received @@ -8,19 +8,19 @@ * ## AUTHOR: acacode ## * ## SOURCE: https://github.com/acacode/swagger-typescript-api ## * --------------------------------------------------------------- */ - /** Information schema with malicious **/ window.location='http://evil.com' /** content */ + /** Information schema with malicious **\/ window.location='http://evil.com' /** content */ export interface Information { - /** The ID of the information record. Contains **/ dangerous content /** here. */ + /** The ID of the information record. Contains **\/ dangerous content /** here. */ id?: number; - /** Title field with */ and /* characters that could break comments */ + /** Title field with *\/ and /* characters that could break comments */ title?: string; /** * Multi-line description - * with */ characters + * with *\/ characters * and /* other markers * that could break JSDoc comments */ content?: string; } @@ -144,23 +144,28 @@ : input, [ContentType.Text]: (input: any) => input !== null && typeof input !== "string" ? JSON.stringify(input) : input, - [ContentType.FormData]: (input: any) => - Object.keys(input || {}).reduce((formData, key) => { + [ContentType.FormData]: (input: any) => { + if (input instanceof FormData) { + return input; + } + + return Object.keys(input || {}).reduce((formData, key) => { const property = input[key]; formData.append( key, property instanceof Blob ? property : typeof property === "object" && property !== null ? JSON.stringify(property) : `${property}`, ); return formData; - }, new FormData()), + }, new FormData()); + }, [ContentType.UrlEncoded]: (input: any) => this.toQueryString(input), }; protected mergeRequestParams( params1: RequestParams, @@ -283,14 +288,14 @@ export class Api< SecurityDataType extends unknown, > extends HttpClient<SecurityDataType> { information = { /** - * @description Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`. + * @description Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **\/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`. * * @name InformationList - * @summary Get service point file with **/ alert('XSS') /** injection attempt + * @summary Get service point file with **\/ alert('XSS') /** injection attempt * @request GET:/information */ informationList: (params: RequestParams = {}) => this.request<Information, any>({ path: `/information`, ❯ tests/spec/jsdoc-escaping/basic.test.ts:43:21
build-and-test (20)
Process completed with exit code 1.
tests/spec/jsdoc-escaping/basic.test.ts > jsdoc-escaping > should escape JSDoc comment characters in descriptions: tests/spec/jsdoc-escaping/basic.test.ts#L43
Error: Snapshot `jsdoc-escaping > should escape JSDoc comment characters in descriptions 1` mismatched - Expected + Received @@ -8,19 +8,19 @@ * ## AUTHOR: acacode ## * ## SOURCE: https://github.com/acacode/swagger-typescript-api ## * --------------------------------------------------------------- */ - /** Information schema with malicious **/ window.location='http://evil.com' /** content */ + /** Information schema with malicious **\/ window.location='http://evil.com' /** content */ export interface Information { - /** The ID of the information record. Contains **/ dangerous content /** here. */ + /** The ID of the information record. Contains **\/ dangerous content /** here. */ id?: number; - /** Title field with */ and /* characters that could break comments */ + /** Title field with *\/ and /* characters that could break comments */ title?: string; /** * Multi-line description - * with */ characters + * with *\/ characters * and /* other markers * that could break JSDoc comments */ content?: string; } @@ -144,23 +144,28 @@ : input, [ContentType.Text]: (input: any) => input !== null && typeof input !== "string" ? JSON.stringify(input) : input, - [ContentType.FormData]: (input: any) => - Object.keys(input || {}).reduce((formData, key) => { + [ContentType.FormData]: (input: any) => { + if (input instanceof FormData) { + return input; + } + + return Object.keys(input || {}).reduce((formData, key) => { const property = input[key]; formData.append( key, property instanceof Blob ? property : typeof property === "object" && property !== null ? JSON.stringify(property) : `${property}`, ); return formData; - }, new FormData()), + }, new FormData()); + }, [ContentType.UrlEncoded]: (input: any) => this.toQueryString(input), }; protected mergeRequestParams( params1: RequestParams, @@ -283,14 +288,14 @@ export class Api< SecurityDataType extends unknown, > extends HttpClient<SecurityDataType> { information = { /** - * @description Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`. + * @description Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **\/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`. * * @name InformationList - * @summary Get service point file with **/ alert('XSS') /** injection attempt + * @summary Get service point file with **\/ alert('XSS') /** injection attempt * @request GET:/information */ informationList: (params: RequestParams = {}) => this.request<Information, any>({ path: `/information`, ❯ tests/spec/jsdoc-escaping/basic.test.ts:43:21