From 30d7d3975c68894da666de838183d17af6338087 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Sat, 5 Mar 2022 09:00:04 +0100 Subject: [PATCH] Apply suggestions from code review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Patrik Oldsberg Co-authored-by: Fredrik Adelöw --- SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 1ff2460d19..49e26349b0 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -61,7 +61,7 @@ function writeTemporaryFile(tmpDir: string, name: string, content: string) { If the `name` of the file is controlled by the user, they can for example enter `../../../../etc/hosts` as the name of the file. This can lead to a file being written outside the intended directory, which in turn can be used to inject malicious code or other form of attacks. -The recommended solution to this is to use `resolveSafeChildPath` from `@backstage/backend-common` to resolve the file path instead. It makes sure that the resolved path does not fall outside the provided directory. If you simply what to validate whether a file path is safe, you can use `isChildPath` instead. +The recommended solution to this is to use `resolveSafeChildPath` from `@backstage/backend-common` to resolve the file path instead. It makes sure that the resolved path does not fall outside the provided directory. If you simply want to validate whether a file path is safe, you can use `isChildPath` instead. The insecure example above should instead be written like this: @@ -103,7 +103,7 @@ res.send({ ok: true }); // BAD res.json({ ok: true }); // GOOD ``` -If you absolute must return a string with `.send(...)`, use an explicit and secure `Content-Type`: +If you absolutely must return a string with `.send(...)`, use an explicit and secure `Content-Type`: ```ts res.send(`message=${message}`); // BAD