From 655a8d46d8743ae27ec63aeb5a10e10d28b07fe1 Mon Sep 17 00:00:00 2001
From: ivgo <ivgo@spreadgroup.com>
Date: Tue, 7 Jun 2022 08:39:55 +0200
Subject: [PATCH] Fix codeQL error using URL params as part of the URL & remove
 commit added by mistake

Signed-off-by: ivgo <ivgo@spreadgroup.com>
---
 .../src/service/VaultBuilder.tsx              |  4 ++--
 plugins/vault-backend/src/service/vaultApi.ts | 19 ++++++++++---------
 plugins/vault/src/api.test.ts                 |  8 ++++----
 plugins/vault/src/api.ts                      | 10 +++++++---
 .../EntityVaultTable.test.tsx                 |  8 ++++----
 yarn.lock                                     |  2 +-
 6 files changed, 28 insertions(+), 23 deletions(-)

diff --git a/plugins/vault-backend/src/service/VaultBuilder.tsx b/plugins/vault-backend/src/service/VaultBuilder.tsx
index 8ea2399d84..aa2858345f 100644
--- a/plugins/vault-backend/src/service/VaultBuilder.tsx
+++ b/plugins/vault-backend/src/service/VaultBuilder.tsx
@@ -152,8 +152,8 @@ export class VaultBuilder {
       res.json({ status: 'ok' });
     });
 
-    router.get('/v1/secrets', async (req, res) => {
-      const path = req.query.path;
+    router.get('/v1/secrets/:path', async (req, res) => {
+      const { path } = req.params;
       if (typeof path !== 'string') {
         throw new InputError(`Invalid path: ${path}`);
       }
diff --git a/plugins/vault-backend/src/service/vaultApi.ts b/plugins/vault-backend/src/service/vaultApi.ts
index 5c7cc97dbe..0623780654 100644
--- a/plugins/vault-backend/src/service/vaultApi.ts
+++ b/plugins/vault-backend/src/service/vaultApi.ts
@@ -85,16 +85,17 @@ export class VaultClient implements VaultApi {
     query: { [key in string]: any },
     method: string = 'GET',
   ): Promise<T | undefined> {
-    const url = `${this.vaultConfig.baseUrl}/${path}?${new URLSearchParams(
-      query,
-    ).toString()}`;
-    const response = await fetch(url, {
-      method,
-      headers: {
-        Accept: 'application/json',
-        'X-Vault-Token': this.vaultConfig.token,
+    const url = new URL(path, this.vaultConfig.baseUrl);
+    const response = await fetch(
+      `${url.toString()}?${new URLSearchParams(query).toString()}`,
+      {
+        method,
+        headers: {
+          Accept: 'application/json',
+          'X-Vault-Token': this.vaultConfig.token,
+        },
       },
-    });
+    );
     if (response.status === 200) {
       return (await response.json()) as T;
     }
diff --git a/plugins/vault/src/api.test.ts b/plugins/vault/src/api.test.ts
index a913be01be..3452cbad38 100644
--- a/plugins/vault/src/api.test.ts
+++ b/plugins/vault/src/api.test.ts
@@ -42,11 +42,11 @@ describe('api', () => {
 
   const setupHandlers = () => {
     server.use(
-      rest.get(`${mockBaseUrl}/v1/secrets`, (req, res, ctx) => {
-        const path = req.url.searchParams.get('path');
-        if (path === 'test/success') {
+      rest.get(`${mockBaseUrl}/v1/secrets/:path`, (req, res, ctx) => {
+        const { path } = req.params;
+        if (path === 'test%2Fsuccess') {
           return res(ctx.json(mockSecretsResult));
-        } else if (path === 'test/error') {
+        } else if (path === 'test%2Ferror') {
           return res(ctx.json([]));
         }
         return res(ctx.status(400));
diff --git a/plugins/vault/src/api.ts b/plugins/vault/src/api.ts
index ce92eb7538..74b212429f 100644
--- a/plugins/vault/src/api.ts
+++ b/plugins/vault/src/api.ts
@@ -56,9 +56,13 @@ export class VaultClient implements VaultApi {
   }
 
   async listSecrets(secretPath: string): Promise<VaultSecret[]> {
-    const result = await this.callApi<VaultSecret[]>('v1/secrets', {
-      path: secretPath,
-    });
+    if (secretPath === '') {
+      return [];
+    }
+    const result = await this.callApi<VaultSecret[]>(
+      `v1/secrets/${encodeURIComponent(secretPath)}`,
+      {},
+    );
     if (!result) {
       return [];
     }
diff --git a/plugins/vault/src/components/EntityVaultTable/EntityVaultTable.test.tsx b/plugins/vault/src/components/EntityVaultTable/EntityVaultTable.test.tsx
index 805039e2ea..3538d2e0ae 100644
--- a/plugins/vault/src/components/EntityVaultTable/EntityVaultTable.test.tsx
+++ b/plugins/vault/src/components/EntityVaultTable/EntityVaultTable.test.tsx
@@ -83,11 +83,11 @@ describe('EntityVautTable', () => {
 
   const setupHandlers = () => {
     server.use(
-      rest.get(`${mockBaseUrl}/v1/secrets`, (req, res, ctx) => {
-        const path = req.url.searchParams.get('path');
-        if (path === 'test/success') {
+      rest.get(`${mockBaseUrl}/v1/secrets/:path`, (req, res, ctx) => {
+        const { path } = req.params;
+        if (path === 'test%2Fsuccess') {
           return res(ctx.json(mockSecretsResult));
-        } else if (path === 'test/error') {
+        } else if (path === 'test%2Ferror') {
           return res(ctx.json([]));
         }
         return res(ctx.status(400));
diff --git a/yarn.lock b/yarn.lock
index 00e6731bac..f50e0af69d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -18211,7 +18211,7 @@ minimatch@3.0.4:
   dependencies:
     brace-expansion "^1.1.7"
 
-minimatch@5.1.0, minimatch@^5.0.0, minimatch@^5.0.1:
+minimatch@5.1.0, minimatch@^5.0.0, minimatch@^5.0.1, minimatch@^5.1.0:
   version "5.1.0"
   resolved "https://registry.npmjs.org/minimatch/-/minimatch-5.1.0.tgz#1717b464f4971b144f6aabe8f2d0b8e4511e09c7"
   integrity sha512-9TPBGGak4nHfGZsPBohm9AWg6NoT7QTCehS3BIJABslyZbzxfV78QM2Y6+i741OPZIafFAaiiEMh5OyIrJPgtg==