Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: sanitize user input (#128) #129

Closed
wants to merge 6 commits into from
Closed

fix: sanitize user input (#128) #129

wants to merge 6 commits into from

Conversation

reny-pacheco
Copy link
Contributor

@reny-pacheco reny-pacheco commented Oct 12, 2022

Closes #128

What new changes did you make? Tick all applicable boxes

  • Added new abbreviation
  • Fixed something in the source code
  • Added a new feature
  • Fixed the docs (README.md, CONTRIBTUING.md, etc)

Describe the new changes you added.

Sanitized user input during keypress and on paste event.
Form only accepts [a-zA-Z] values.

Copied value: aBc-12c d/e.f
Pasted value: aBccdef

Share a screeshot of new changes

I tried to input again the malicious value ../db and here is the screenshot of the output. It only displays db

image

@vercel
Copy link

vercel bot commented Oct 12, 2022

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Updated
abbreve ✅ Ready (Inspect) Visit Preview Oct 24, 2022 at 2:48PM (UTC)

@mathiasayivor
Copy link
Contributor

@reny-pacheco I suggest you improve on the regex for sanitizing inputs cos I don't think the current implementation supports abbreviations with special characters, e.g w/o.

I suggest you use the encodeURIComponent function instead.

@reny-pacheco
Copy link
Contributor Author

Good catch @mathiasayivor , I'll try to use encodeURIComponent. Thank you.

@Njong392
Copy link
Owner

@reny-pacheco is there any update on this?

@reny-pacheco
Copy link
Contributor Author

Hello, apologies for not having an update, you can assign this to another contributor if they want to work on this. Thank you.

@Njong392
Copy link
Owner

@mathiasayivor you mentioned something about certain inputs not being accepted because of the sanitation. Would you have an idea related to this pull request?

@mathiasayivor
Copy link
Contributor

@mathiasayivor you mentioned something about certain inputs not being accepted because of the sanitation. Would you have an idea related to this pull request?

Yeah

@mathiasayivor
Copy link
Contributor

encodeURIComponent is the best option for sanitizing user inputs, since it's used in the CLI for encoding.

I'd also recommend using the encodedAbbrMappings.json in addition to encodeURIComponent to be sure the searched slang doesn't exist before sending the final result to the user.

Demo below:

search -> sanitize user input (`encodeURIComponent`)
                                                   |
                                          search abbrev -> found result? -> show slang definition
                                                   |
                                             No result?
                                                   |
                           check encodedAbbrMappings.json -> found result? -> show slang definition
                                                   |
                                             No result?
                                                   |
                           Display Result not found error

@Njong392
Copy link
Owner

I see... kind of hahaha. Do you want to go for it @mathiasayivor ? Maybe contribute to @reny-pacheco fork.

@mathiasayivor
Copy link
Contributor

I see... kind of hahaha. Do you want to go for it @mathiasayivor ? Maybe contribute to @reny-pacheco fork.

Sure... But I'm not sure if I have write access to @reny-pacheco's fork...

@mathiasayivor
Copy link
Contributor

mathiasayivor commented Oct 23, 2022

Perhaps I should just create a new PR by copying @reny-pacheco's changes and adding changes?

@reny-pacheco
Copy link
Contributor Author

reny-pacheco commented Oct 23, 2022

Sure... But I'm not sure if I have write access to @reny-pacheco's fork...

Hi @mathiasayivor , If you doesn't have access, I can give you access to the fork if its possible.

@mathiasayivor
Copy link
Contributor

mathiasayivor commented Oct 23, 2022

Sure @reny-pacheco ... That'd be great!

@reny-pacheco
Copy link
Contributor Author

Sure @reny-pacheco ... That'd be great!

@mathiasayivor , I've already added you as contributor to the fork, can you confirm that?

@mathiasayivor
Copy link
Contributor

Sure @reny-pacheco ... That'd be great!

@mathiasayivor , I've already added you as contributor to the fork, can you confirm that?

Seen

@mathiasayivor
Copy link
Contributor

Alright fellas, I think we're good to go!
@Njong392 @reny-pacheco @adropofilm reviews are welcomed.

Copy link
Contributor Author

@reny-pacheco reny-pacheco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @mathiasayivor , I suggest to add a guard clause in line 31 of form.jsx file, to prevent fetching of encodedAbbrMappings if search field is empty. I found out that if you click submit with empty value. It still fetch the data.

Suggestion:

const fetchData = async (query) => {
   if(!userInput.trim()) {
      return
    } 
    let mappings;
    ...
    ...

@mathiasayivor
Copy link
Contributor

Hi @mathiasayivor , I suggest to add a guard clause in line 31 of form.jsx file, to prevent fetching of encodedAbbrMappings if search field is empty. I found out that if you click submit with empty value. It still fetch the data.

Suggestion:

const fetchData = async (query) => {
   if(!userInput.trim()) {
      return
    } 
    let mappings;
    ...
    ...

Sure...

@reny-pacheco
Copy link
Contributor Author

LGTM, Thanks @mathiasayivor 😃

@Njong392
Copy link
Owner

Yikes... the whole code became something different haha. Still trying to wrap my head around it. But... when the user enters a slang that doesn't exist, it just says "some connection error occurs". Shouldn't it warn the user that the slang doesn't exist and they could raise an issue as before?

@mathiasayivor
Copy link
Contributor

Yikes... the whole code became something different haha. Still trying to wrap my head around it. But... when the user enters a slang that doesn't exist, it just says "some connection error occurs". Shouldn't it warn the user that the slang doesn't exist and they could raise an issue as before?

This works on the local dev env:
Screenshot from 2022-10-26 12-34-32

The error you're getting is the expected behaviour, since the server is responding with 200 status instead of 404.

@mathiasayivor
Copy link
Contributor

I think the error you're getting is an issue with how vercel's routing works,

Screenshot from 2022-10-26 12-39-27

The expected response, in this case, is 404 but the server is returning 200 with HTML as content type, hence the app is unable to parse HTML as JSON, thence the error.

@Njong392
Copy link
Owner

I see. Is there a fix to this? Or we just blame it on vercel 😂

@reny-pacheco
Copy link
Contributor Author

reny-pacheco commented Oct 26, 2022

Hi @mathiasayivor , on my fork, I created a branch named simplified-fetch that may fix 404 issue , since previously we are explicitly comparing the status code. Maybe you can check it since you have already access on my fork.

It only fetch one endpoint and still gives the correct abbreviation.
But we still need to check if the status code is correct(404) if there is no abbreviation once deployed.
image

@mathiasayivor
Copy link
Contributor

I see. Is there a fix to this? Or we just blame it on vercel 😂

Perhaps do additional checks(i.e ensuring response is a valid JSON) if the response status is 200.

@Njong392
Copy link
Owner

Njong392 commented Nov 1, 2022

I am so lost on this pull request right now, so I am putting it off for a bit. Thank you @mathiasayivor and @reny-pacheco for the progress on this!

@reny-pacheco reny-pacheco closed this by deleting the head repository Apr 27, 2023
@Njong392 Njong392 mentioned this pull request Jun 27, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

User input is not sanitize before making a request resulting to send all contents of db.json file.
3 participants