-
Notifications
You must be signed in to change notification settings - Fork 167
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: sanitize user input (#128) #129
Conversation
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
@reny-pacheco I suggest you improve on the regex for sanitizing inputs cos I don't think the current implementation supports abbreviations with special characters, e.g I suggest you use the |
Good catch @mathiasayivor , I'll try to use |
@reny-pacheco is there any update on this? |
Hello, apologies for not having an update, you can assign this to another contributor if they want to work on this. Thank you. |
@mathiasayivor you mentioned something about certain inputs not being accepted because of the sanitation. Would you have an idea related to this pull request? |
Yeah |
I'd also recommend using the Demo below:
|
I see... kind of hahaha. Do you want to go for it @mathiasayivor ? Maybe contribute to @reny-pacheco fork. |
Sure... But I'm not sure if I have write access to @reny-pacheco's fork... |
Perhaps I should just create a new PR by copying @reny-pacheco's changes and adding changes? |
Hi @mathiasayivor , If you doesn't have access, I can give you access to the fork if its possible. |
Sure @reny-pacheco ... That'd be great! |
@mathiasayivor , I've already added you as contributor to the fork, can you confirm that? |
Seen |
Alright fellas, I think we're good to go! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @mathiasayivor , I suggest to add a guard clause in line 31 of form.jsx
file, to prevent fetching of encodedAbbrMappings
if search field is empty. I found out that if you click submit with empty value. It still fetch the data.
Suggestion:
const fetchData = async (query) => {
if(!userInput.trim()) {
return
}
let mappings;
...
...
Sure... |
LGTM, Thanks @mathiasayivor 😃 |
Yikes... the whole code became something different haha. Still trying to wrap my head around it. But... when the user enters a slang that doesn't exist, it just says "some connection error occurs". Shouldn't it warn the user that the slang doesn't exist and they could raise an issue as before? |
I see. Is there a fix to this? Or we just blame it on vercel 😂 |
Hi @mathiasayivor , on my fork, I created a branch named It only fetch one endpoint and still gives the correct abbreviation. |
Perhaps do additional checks(i.e ensuring response is a valid JSON) if the response status is 200. |
I am so lost on this pull request right now, so I am putting it off for a bit. Thank you @mathiasayivor and @reny-pacheco for the progress on this! |
Closes #128
What new changes did you make? Tick all applicable boxes
Describe the new changes you added.
Sanitized user input during
keypress
andon paste
event.Form only accepts
[a-zA-Z]
values.Copied value:
aBc-12c d/e.f
Pasted value:
aBccdef
Share a screeshot of new changes
I tried to input again the malicious value
../db
and here is the screenshot of the output. It only displaysdb