Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const detectVideoType = (): VideoType => { | ||
| const url = videoUrl.toLowerCase(); | ||
|
|
||
| if (url.includes("youtube.com") || url.includes("youtu.be")) { |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the problem, we need to parse the URL and check the host value explicitly rather than using substring checks. This ensures that the host is exactly what we expect and not part of a larger, potentially malicious URL. We will use the URL class to parse the URL and then check the hostname against a whitelist of allowed hosts.
- Parse the URL using the
URLclass. - Check the hostname against a whitelist of allowed hosts.
- Update the
detectVideoTypefunction to use this new method.
| @@ -35,10 +35,15 @@ | ||
| const detectVideoType = (): VideoType => { | ||
| const url = videoUrl.toLowerCase(); | ||
| try { | ||
| const url = new URL(videoUrl); | ||
| const hostname = url.hostname.toLowerCase(); | ||
|
|
||
| if (url.includes("youtube.com") || url.includes("youtu.be")) { | ||
| return "youtube"; | ||
| } | ||
| if (hostname === "youtube.com" || hostname === "www.youtube.com" || hostname === "youtu.be") { | ||
| return "youtube"; | ||
| } | ||
|
|
||
| if (url.includes("vimeo.com")) { | ||
| return "vimeo"; | ||
| if (hostname === "vimeo.com" || hostname === "www.vimeo.com") { | ||
| return "vimeo"; | ||
| } | ||
| } catch (error) { | ||
| console.error("Invalid URL:", error); | ||
| } |
| return "youtube"; | ||
| } | ||
|
|
||
| if (url.includes("vimeo.com")) { |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the problem, we need to parse the URL and check the host value instead of using a substring check. This ensures that the check is accurate and not prone to bypasses by embedding the target string in unexpected locations.
- Parse the URL using the
URLconstructor. - Extract the host from the parsed URL.
- Check if the host matches "vimeo.com" or "www.vimeo.com".
| @@ -41,4 +41,9 @@ | ||
|
|
||
| if (url.includes("vimeo.com")) { | ||
| return "vimeo"; | ||
| try { | ||
| const parsedUrl = new URL(videoUrl); | ||
| if (parsedUrl.hostname === "vimeo.com" || parsedUrl.hostname === "www.vimeo.com") { | ||
| return "vimeo"; | ||
| } | ||
| } catch (error) { | ||
| console.error("Invalid URL:", error); | ||
| } |
2 participants
No description provided.