[Feature] Add node deployment using processes (Multiplatform) #11
Conversation
… flag, and async boost
…/nebula into feature/processes
…ate loggins in training-related classes
…into feature/processes
…ion of classes during dirichlet
enriquetomasmb
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| $('#confirm-modal-body').html('Are you sure you want to run the scenario?\n' + | ||
| '<br><br><p class="badge text-bg-danger">Warning: you will stop the running scenario and start a new one</p>'); | ||
| '<br><p class="badge text-bg-warning">The scenario will be deployed using the selected deployment option: ' + deploymentOption.value + '</p>' + | ||
| '<br><p class="badge text-bg-danger">Warning: you will stop the running scenario and start a new one</p>'); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 6 months ago
To fix the problem, we need to ensure that any user input or DOM text that is reinterpreted as HTML is properly sanitized or escaped to prevent XSS attacks. In this case, we should escape the deploymentOption.value before inserting it into the HTML content of the modal.
The best way to fix this is to use a function that escapes HTML special characters. This will ensure that any potentially malicious content is rendered as plain text rather than executable HTML or JavaScript.
| @@ -2001,4 +2001,12 @@ | ||
| var deploymentOption = document.querySelector('input[name="deploymentRadioOptions"]:checked'); | ||
| const escapeHtml = (unsafe) => { | ||
| return unsafe | ||
| .replace(/&/g, "&") | ||
| .replace(/</g, "<") | ||
| .replace(/>/g, ">") | ||
| .replace(/"/g, """) | ||
| .replace(/'/g, "'"); | ||
| }; | ||
| $('#confirm-modal-body').html('Are you sure you want to run the scenario?\n' + | ||
| '<br><p class="badge text-bg-warning">The scenario will be deployed using the selected deployment option: ' + deploymentOption.value + '</p>' + | ||
| '<br><p class="badge text-bg-warning">The scenario will be deployed using the selected deployment option: ' + escapeHtml(deploymentOption.value) + '</p>' + | ||
| '<br><p class="badge text-bg-danger">Warning: you will stop the running scenario and start a new one</p>'); |
| @@ -737,6 +926,10 @@ | |||
| os.path.join(os.environ["NEBULA_ROOT"], "app", "tmp", scenario_name), | |||
| exist_ok=True, | |||
| ) | |||
| os.chmod( | |||
| os.path.join(os.environ["NEBULA_ROOT"], "app", "tmp", scenario_name), | |||
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
No description provided.