Fix JSDoc comment security vulnerability: escape only necessary */ sequences #2421
Annotations
6 errors
build-and-test (22)
Process completed with exit code 1.
|
tests/spec/jsdoc-escaping/basic.test.ts > jsdoc-escaping > should escape JSDoc comment characters in descriptions:
tests/spec/jsdoc-escaping/basic.test.ts#L43
Error: Snapshot `jsdoc-escaping > should escape JSDoc comment characters in descriptions 1` mismatched
- Expected
+ Received
@@ -8,19 +8,19 @@
* ## AUTHOR: acacode ##
* ## SOURCE: https://github.com/acacode/swagger-typescript-api ##
* ---------------------------------------------------------------
*/
- /** Information schema with malicious **/ window.location='http://evil.com' /** content */
+ /** Information schema with malicious **\/ window.location='http://evil.com' /** content */
export interface Information {
- /** The ID of the information record. Contains **/ dangerous content /** here. */
+ /** The ID of the information record. Contains **\/ dangerous content /** here. */
id?: number;
- /** Title field with */ and /* characters that could break comments */
+ /** Title field with *\/ and /* characters that could break comments */
title?: string;
/**
* Multi-line description
- * with */ characters
+ * with *\/ characters
* and /* other markers
* that could break JSDoc comments
*/
content?: string;
}
@@ -144,23 +144,28 @@
: input,
[ContentType.Text]: (input: any) =>
input !== null && typeof input !== "string"
? JSON.stringify(input)
: input,
- [ContentType.FormData]: (input: any) =>
- Object.keys(input || {}).reduce((formData, key) => {
+ [ContentType.FormData]: (input: any) => {
+ if (input instanceof FormData) {
+ return input;
+ }
+
+ return Object.keys(input || {}).reduce((formData, key) => {
const property = input[key];
formData.append(
key,
property instanceof Blob
? property
: typeof property === "object" && property !== null
? JSON.stringify(property)
: `${property}`,
);
return formData;
- }, new FormData()),
+ }, new FormData());
+ },
[ContentType.UrlEncoded]: (input: any) => this.toQueryString(input),
};
protected mergeRequestParams(
params1: RequestParams,
@@ -283,14 +288,14 @@
export class Api<
SecurityDataType extends unknown,
> extends HttpClient<SecurityDataType> {
information = {
/**
- * @description Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`.
+ * @description Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **\/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`.
*
* @name InformationList
- * @summary Get service point file with **/ alert('XSS') /** injection attempt
+ * @summary Get service point file with **\/ alert('XSS') /** injection attempt
* @request GET:/information
*/
informationList: (params: RequestParams = {}) =>
this.request<Information, any>({
path: `/information`,
❯ tests/spec/jsdoc-escaping/basic.test.ts:43:21
|
build-and-test (24)
Process completed with exit code 1.
|
tests/spec/jsdoc-escaping/basic.test.ts > jsdoc-escaping > should escape JSDoc comment characters in descriptions:
tests/spec/jsdoc-escaping/basic.test.ts#L43
Error: Snapshot `jsdoc-escaping > should escape JSDoc comment characters in descriptions 1` mismatched
- Expected
+ Received
@@ -8,19 +8,19 @@
* ## AUTHOR: acacode ##
* ## SOURCE: https://github.com/acacode/swagger-typescript-api ##
* ---------------------------------------------------------------
*/
- /** Information schema with malicious **/ window.location='http://evil.com' /** content */
+ /** Information schema with malicious **\/ window.location='http://evil.com' /** content */
export interface Information {
- /** The ID of the information record. Contains **/ dangerous content /** here. */
+ /** The ID of the information record. Contains **\/ dangerous content /** here. */
id?: number;
- /** Title field with */ and /* characters that could break comments */
+ /** Title field with *\/ and /* characters that could break comments */
title?: string;
/**
* Multi-line description
- * with */ characters
+ * with *\/ characters
* and /* other markers
* that could break JSDoc comments
*/
content?: string;
}
@@ -144,23 +144,28 @@
: input,
[ContentType.Text]: (input: any) =>
input !== null && typeof input !== "string"
? JSON.stringify(input)
: input,
- [ContentType.FormData]: (input: any) =>
- Object.keys(input || {}).reduce((formData, key) => {
+ [ContentType.FormData]: (input: any) => {
+ if (input instanceof FormData) {
+ return input;
+ }
+
+ return Object.keys(input || {}).reduce((formData, key) => {
const property = input[key];
formData.append(
key,
property instanceof Blob
? property
: typeof property === "object" && property !== null
? JSON.stringify(property)
: `${property}`,
);
return formData;
- }, new FormData()),
+ }, new FormData());
+ },
[ContentType.UrlEncoded]: (input: any) => this.toQueryString(input),
};
protected mergeRequestParams(
params1: RequestParams,
@@ -283,14 +288,14 @@
export class Api<
SecurityDataType extends unknown,
> extends HttpClient<SecurityDataType> {
information = {
/**
- * @description Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`.
+ * @description Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **\/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`.
*
* @name InformationList
- * @summary Get service point file with **/ alert('XSS') /** injection attempt
+ * @summary Get service point file with **\/ alert('XSS') /** injection attempt
* @request GET:/information
*/
informationList: (params: RequestParams = {}) =>
this.request<Information, any>({
path: `/information`,
❯ tests/spec/jsdoc-escaping/basic.test.ts:43:21
|
build-and-test (20)
Process completed with exit code 1.
|
tests/spec/jsdoc-escaping/basic.test.ts > jsdoc-escaping > should escape JSDoc comment characters in descriptions:
tests/spec/jsdoc-escaping/basic.test.ts#L43
Error: Snapshot `jsdoc-escaping > should escape JSDoc comment characters in descriptions 1` mismatched
- Expected
+ Received
@@ -8,19 +8,19 @@
* ## AUTHOR: acacode ##
* ## SOURCE: https://github.com/acacode/swagger-typescript-api ##
* ---------------------------------------------------------------
*/
- /** Information schema with malicious **/ window.location='http://evil.com' /** content */
+ /** Information schema with malicious **\/ window.location='http://evil.com' /** content */
export interface Information {
- /** The ID of the information record. Contains **/ dangerous content /** here. */
+ /** The ID of the information record. Contains **\/ dangerous content /** here. */
id?: number;
- /** Title field with */ and /* characters that could break comments */
+ /** Title field with *\/ and /* characters that could break comments */
title?: string;
/**
* Multi-line description
- * with */ characters
+ * with *\/ characters
* and /* other markers
* that could break JSDoc comments
*/
content?: string;
}
@@ -144,23 +144,28 @@
: input,
[ContentType.Text]: (input: any) =>
input !== null && typeof input !== "string"
? JSON.stringify(input)
: input,
- [ContentType.FormData]: (input: any) =>
- Object.keys(input || {}).reduce((formData, key) => {
+ [ContentType.FormData]: (input: any) => {
+ if (input instanceof FormData) {
+ return input;
+ }
+
+ return Object.keys(input || {}).reduce((formData, key) => {
const property = input[key];
formData.append(
key,
property instanceof Blob
? property
: typeof property === "object" && property !== null
? JSON.stringify(property)
: `${property}`,
);
return formData;
- }, new FormData()),
+ }, new FormData());
+ },
[ContentType.UrlEncoded]: (input: any) => this.toQueryString(input),
};
protected mergeRequestParams(
params1: RequestParams,
@@ -283,14 +288,14 @@
export class Api<
SecurityDataType extends unknown,
> extends HttpClient<SecurityDataType> {
information = {
/**
- * @description Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`.
+ * @description Get service point file of all Nordic countries (SE,FI,DK,NO) from S3 storage. You can download previous service point file upto 7 days from current date. This is equivalent to **\/information** endpoint with parameters `countryCode:SE,FI,DK,NO` and `context:ALL` and header `Accept-Encoding:gzip`.
*
* @name InformationList
- * @summary Get service point file with **/ alert('XSS') /** injection attempt
+ * @summary Get service point file with **\/ alert('XSS') /** injection attempt
* @request GET:/information
*/
informationList: (params: RequestParams = {}) =>
this.request<Information, any>({
path: `/information`,
❯ tests/spec/jsdoc-escaping/basic.test.ts:43:21
|