You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kie.apache.org by "baldimir (via GitHub)" <gi...@apache.org> on 2025/11/06 10:50:47 UTC

[PR] [kie-tools#3342] Handle reported SAST problems [incubator-kie-tools]

baldimir opened a new pull request, #3343:
URL: https://github.com/apache/incubator-kie-tools/pull/3343

   Resolves: https://github.com/apache/incubator-kie-tools/issues/3342
   
   - Adds a check that the zip is unzipped in the user's home folder in the upload service. 
   - Replaces the deprecated url.parse method usage with URL and URLSearchParams. 
   - Handles some log forging potential problems. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org

Re: [PR] [kie-tools#3342] Handle reported SAST problems [incubator-kie-tools]

Posted by "jomarko (via GitHub)" <gi...@apache.org>.
jomarko commented on PR #3343:
URL: https://github.com/apache/incubator-kie-tools/pull/3343#issuecomment-3496758853

   I have checked for now scenarios:
   - import asset into Sandbox, without connection for github set up, using url https://github.com/apache/incubator-kie-kogito-runtimes/blob/main/jbpm/jbpm-tests/src/test/resources/BPMN2-RuleTask.bpmn2 🟒 
   - import asset into sandbox from private github repository, sandbox <-> github connection was set up 🟒 
   - create private gist from the opened asset πŸ”΄ 
   
   could someone check if this is issue also on main or related to this PR?
   
   <img width="934" height="812" alt="image" src="https://github.com/user-attachments/assets/6210f594-5e7d-408c-925f-fbd1c61a392b" />
   <img width="1576" height="686" alt="Screenshot 2025-11-06 123546" src="https://github.com/user-attachments/assets/7f42273a-f9e2-4634-a0bb-185621d9b158" />
   <img width="718" height="438" alt="Screenshot 2025-11-06 123526" src="https://github.com/user-attachments/assets/93a0d67f-be0d-468f-a7d9-b1d3adea660b" />
   
   it actually creates some non expected gists, 
   
   <img width="929" height="823" alt="Screenshot 2025-11-06 123644" src="https://github.com/user-attachments/assets/dc1f4865-1b45-4c36-a972-d721f2eeecaa" />
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org

Re: [PR] [kie-tools#3342] Handle reported SAST problems [incubator-kie-tools]

Posted by "baldimir (via GitHub)" <gi...@apache.org>.
baldimir commented on PR #3343:
URL: https://github.com/apache/incubator-kie-tools/pull/3343#issuecomment-3502610180

   @jomarko thanks for the review. The steps to test doesn't work for me. I am getting 
   ```
   └─ Running...
   packages/keyboard-shortcuts build:dev$ rimraf dist && tsc -p tsconfig.json
   β”‚ src/envelope/DefaultKeyboardShortcutsService.ts(20,33): error TS2307: Cannot find module '@kie-tools-core/operating-system' or its corresponding type declarations.
   └─ Failed in 2s at /Users/tiborzimanyi/IdeaProjects/kie-tools/packages/keyboard-shortcuts
   packages/json-yaml-language-service build:dev$ rimraf dist && tsc -p tsconfig.json
   └─ Running...
   /Users/tiborzimanyi/IdeaProjects/kie-tools/packages/keyboard-shortcuts:
    ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL  @kie-tools-core/keyboard-shortcuts@0.0.0 build:dev: `rimraf dist && tsc -p tsconfig.json`
   Exit status 2
   .../runtime-tools-process-gateway-api build:dev$ rimraf dist && tsc -p tsconfig.json
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org

Re: [PR] [kie-tools#3342] Handle reported SAST problems [incubator-kie-tools]

Posted by "baldimir (via GitHub)" <gi...@apache.org>.
baldimir commented on code in PR #3343:
URL: https://github.com/apache/incubator-kie-tools/pull/3343#discussion_r2513437403


##########
packages/cors-proxy/src/proxy/ExpressCorsProxy.ts:
##########
@@ -231,6 +231,19 @@ class Logger {
     console.debug(message, arg ?? "");
   }
 
+  /**
+   * This is used when some very basic user input sanitization is needed before it is posted in the logs,
+   * to avoid completely uncontrolled logging of user input.
+   * @param message
+   * @param arg
+   */
+  public debugEscapeNewLines(message: string, arg?: any) {
+    if (!this.verbose) {
+      return;
+    }
+    return console.debug(message.replace(/\r?\n|\r/g, "_"), arg ?? "");

Review Comment:
   Fixed. Thanks for noticing this. 



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org

Re: [PR] [kie-tools#3342] Handle reported SAST problems [incubator-kie-tools]

Posted by "fantonangeli (via GitHub)" <gi...@apache.org>.
fantonangeli commented on PR #3343:
URL: https://github.com/apache/incubator-kie-tools/pull/3343#issuecomment-3511693197

   Hi @baldimir , FYI I'm finalizing my PR focused mainly on the `origin` input for the `cors-proxy`, but after that I would like to focus on the `target-url` input.
   We can have a chat about this, to think about a logic for that.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org

Re: [PR] [kie-tools#3342] Handle reported SAST problems [incubator-kie-tools]

Posted by "baldimir (via GitHub)" <gi...@apache.org>.
baldimir commented on PR #3343:
URL: https://github.com/apache/incubator-kie-tools/pull/3343#issuecomment-3496881948

   There are 2 tests failing. I need to take a look at those. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org

Re: [PR] [kie-tools#3342] Handle reported SAST problems [incubator-kie-tools]

Posted by "baldimir (via GitHub)" <gi...@apache.org>.
baldimir merged PR #3343:
URL: https://github.com/apache/incubator-kie-tools/pull/3343


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org

Re: [PR] [kie-tools#3342] Handle reported SAST problems [incubator-kie-tools]

Posted by "baldimir (via GitHub)" <gi...@apache.org>.
baldimir commented on PR #3343:
URL: https://github.com/apache/incubator-kie-tools/pull/3343#issuecomment-3497047662

   I removed the dev deployments upload check. It doesn't make sense at the end as the unzip folder is configurable. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org

Re: [PR] [kie-tools#3342] Handle reported SAST problems [incubator-kie-tools]

Posted by "baldimir (via GitHub)" <gi...@apache.org>.
baldimir commented on PR #3343:
URL: https://github.com/apache/incubator-kie-tools/pull/3343#issuecomment-3511721996

   @fantonangeli Hi, I am sorry, I am not sure I understand properly, this is the first time I touch the code here in this area. To discuss about how it works and future improvements, I think @tiagobento or @thiagoelg may be better. This PR is just trying to replace the url.parse method, because it is deprecated and unsecure. However I am still willing to discuss if you need. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org

Re: [PR] [kie-tools#3342] Handle reported SAST problems [incubator-kie-tools]

Posted by "baldimir (via GitHub)" <gi...@apache.org>.
baldimir commented on PR #3343:
URL: https://github.com/apache/incubator-kie-tools/pull/3343#issuecomment-3502678660

   Looks like I made the build progress further. Will update here when I know more.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org

Re: [PR] [kie-tools#3342] Handle reported SAST problems [incubator-kie-tools]

Posted by "jomarko (via GitHub)" <gi...@apache.org>.
jomarko commented on code in PR #3343:
URL: https://github.com/apache/incubator-kie-tools/pull/3343#discussion_r2511219091


##########
packages/cors-proxy/src/proxy/ExpressCorsProxy.ts:
##########
@@ -231,6 +231,19 @@ class Logger {
     console.debug(message, arg ?? "");
   }
 
+  /**
+   * This is used when some very basic user input sanitization is needed before it is posted in the logs,
+   * to avoid completely uncontrolled logging of user input.
+   * @param message
+   * @param arg
+   */
+  public debugEscapeNewLines(message: string, arg?: any) {
+    if (!this.verbose) {
+      return;
+    }
+    return console.debug(message.replace(/\r?\n|\r/g, "_"), arg ?? "");

Review Comment:
   ```suggestion
       console.debug(message.replace(/\r?\n|\r/g, "_"), arg ?? "");
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org

Re: [PR] [kie-tools#3342] Handle reported SAST problems [incubator-kie-tools]

Posted by "baldimir (via GitHub)" <gi...@apache.org>.
baldimir commented on PR #3343:
URL: https://github.com/apache/incubator-kie-tools/pull/3343#issuecomment-3511708879

   @jomarko it works now with the latest change, when I test it locally. Thanks for help. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org