Skip to content

Commit

Permalink
fix(frontend): avoid CodeQL CWE-601
Browse files Browse the repository at this point in the history
IMO the original code was validating the input, but this should make it
more explicit
  • Loading branch information
andrewpollock committed Nov 12, 2024
1 parent d0cbe01 commit 80e3c73
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions gcp/appengine/frontend_handlers.py
Original file line number Diff line number Diff line change
Expand Up @@ -273,9 +273,9 @@ def vulnerability_redirector(potential_vuln_id):
return None

# This may raise an exception directly or via abort() for failed retrievals.
_ = osv_get_by_id(potential_vuln_id)
bug = osv_get_by_id(potential_vuln_id)

return redirect(f'/vulnerability/{potential_vuln_id}')
return redirect(f'/vulnerability/{bug["id"]}')


@blueprint.route('/<potential_vuln_id>.json')
Expand All @@ -289,13 +289,13 @@ def vulnerability_json_redirector(potential_vuln_id):
return None

# This calls abort() on failed retrievals.
_ = osv_get_by_id(potential_vuln_id)
bug = osv_get_by_id(potential_vuln_id)

if utils.is_prod():
api_url = 'api.osv.dev'
else:
api_url = 'api.test.osv.dev'
return redirect(f'https://{api_url}/v1/vulns/{potential_vuln_id}')
return redirect(f'https://{api_url}/v1/vulns/{bug["id"]}')


def bug_to_response(bug, detailed=True):
Expand Down

0 comments on commit 80e3c73

Please sign in to comment.