Develop #28
Develop #28
Conversation
Bumps [werkzeug](https://github.com/pallets/werkzeug) from 2.2.2 to 2.2.3. - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@2.2.2...2.2.3) --- updated-dependencies: - dependency-name: werkzeug dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [flask](https://github.com/pallets/flask) from 2.2.2 to 2.3.2. - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@2.2.2...2.3.2) --- updated-dependencies: - dependency-name: flask dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…hosting feat: Add deployment workflow for static files
on-behalf-of: @Azure opensource@microsoft.com
…ure correct app directory is used
…code input selection screen)
…bution remains shown.
…o deleted bump 0.19.0
# Conflicts: # POC/docs/source/requirements.txt
# Conflicts: # README.md
# Conflicts: # data/data_template.xlsx
|
Azure Static Web Apps: Your stage site is ready! Visit it here: https://black-stone-02fb10f03-28.westeurope.5.azurestaticapps.net |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if (result) { | ||
| console.log(result); | ||
| document.getElementById("result").textContent = result.text; | ||
| window.location = "/entry?code=" + result.text; |
Check warning
Code scanning / CodeQL
Exception text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 2 months ago
To fix the problem, we need to ensure that the result.text is properly sanitized or escaped before being used in constructing the URL. This can be achieved by using a function to encode the result.text to prevent any malicious scripts from being executed.
The best way to fix the problem without changing existing functionality is to use the encodeURIComponent function to encode the result.text before appending it to the URL. This function encodes special characters, making it safe to include in a URL.
| @@ -74,3 +74,3 @@ | ||
| document.getElementById("result").textContent = result.text; | ||
| window.location = "/entry?code=" + result.text; | ||
| window.location = "/entry?code=" + encodeURIComponent(result.text); | ||
| } |
|
@jmargutt @elwinschmitz FYI I will merge this in order to prevent overhead. In the unlikely case that the offline version starts seeing issues because of this, the merge commit can still be reverted. |
ref #21 make sure there's one source of truth again regarding development branches. This should prevent unessesary houeskeeping of branches.