Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Microsoft Copilot Studio Provider #529

Open
wants to merge 35 commits into
base: integration
Choose a base branch
from
Open

Microsoft Copilot Studio Provider #529

wants to merge 35 commits into from

Conversation

Grant-Archibald-MS
Copy link
Contributor

Pull Request Template

Description

Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.

Checklist

  • The code change is covered by unit tests. I have added tests that prove my fix is effective or that my feature works
  • I have performed end-to-end test locally.
  • New and existing unit tests pass locally with my changes
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I used clear names for everything
  • I have performed a self-review of my own code

@Grant-Archibald-MS Grant-Archibald-MS requested a review from a team as a code owner January 28, 2025 00:47
github-advanced-security[bot]
github-advanced-security bot found potential problems Feb 10, 2025
View reviewed changes
src/blazor/copilot.test/wwwroot/index.html
}
</style>
<script src="https://alcdn.msauth.net/browser/2.14.2/js/msal-browser.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/monaco-editor/0.52.2/min/vs/loader.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
src/docs/layouts/shortcodes/powerfx-interactive.html
<div id="` $id `-output"></div>
</div>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/monaco-editor/0.52.2/min/vs/editor/editor.main.css">
<script src="https://cdnjs.cloudflare.com/ajax/libs/monaco-editor/0.52.2/min/vs/loader.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium documentation

Script loaded from content delivery network with no integrity check.
src/docs/layouts/shortcodes/powerfx_playground.html
<p>You can try the following to experiment with this playground task:</p>
<div id="` $id `-steps"></div>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/monaco-editor/0.52.2/min/vs/editor/editor.main.css">
<script src="https://cdnjs.cloudflare.com/ajax/libs/monaco-editor/0.52.2/min/vs/loader.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium documentation

Script loaded from content delivery network with no integrity check.
src/docs/layouts/shortcodes/powerfx_playground.html
}
});
</script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/js-yaml/4.1.0/js-yaml.min.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium documentation

Script loaded from content delivery network with no integrity check.
src/docs/themes/relearn/layouts/partials/menu.html
<a class="padding">
<i class="fas fa-language fa-fw"></i>
<div class="select-style">
<select id="select-language" onchange="location = this.value;">

Check warning

Code scanning / CodeQL

DOM text reinterpreted as HTML Medium documentation

DOM text
Loading
is reinterpreted as HTML without escaping meta-characters.

Copilot Autofix AI 16 days ago

To fix the problem, we need to ensure that the value of the select element is properly sanitized before being used to set the location property. One way to achieve this is by using a function that validates the URL to ensure it is safe. We can create a helper function that checks if the URL is within the expected domain or matches a specific pattern.

  • Create a helper function to validate the URL.
  • Update the onchange attribute to use this helper function instead of directly setting location to this.value.
  • Ensure the helper function is included in the relevant script section.
Suggested changeset 1
src/docs/themes/relearn/layouts/partials/menu.html

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/docs/themes/relearn/layouts/partials/menu.html b/src/docs/themes/relearn/layouts/partials/menu.html
--- a/src/docs/themes/relearn/layouts/partials/menu.html
+++ b/src/docs/themes/relearn/layouts/partials/menu.html
@@ -59,3 +59,3 @@
           <div class="select-style">
-            <select id="select-language" onchange="location = this.value;">
+            <select id="select-language" onchange="validateAndRedirect(this.value);">
           {{ $siteLanguages := .Site.Languages}}
@@ -99,2 +99,12 @@
   </div>
+<script>
+  function validateAndRedirect(url) {
+    const allowedPattern = /^https:\/\/example\.com/; // Adjust this pattern to match allowed URLs
+    if (allowedPattern.test(url)) {
+      location = url;
+    } else {
+      console.error('Invalid URL:', url);
+    }
+  }
+</script>
 </nav>
EOF
@@ -59,3 +59,3 @@
<div class="select-style">
<select id="select-language" onchange="location = this.value;">
<select id="select-language" onchange="validateAndRedirect(this.value);">
{{ $siteLanguages := .Site.Languages}}
@@ -99,2 +99,12 @@
</div>
<script>
function validateAndRedirect(url) {
const allowedPattern = /^https:\/\/example\.com/; // Adjust this pattern to match allowed URLs
if (allowedPattern.test(url)) {
location = url;
} else {
console.error('Invalid URL:', url);
}
}
</script>
</nav>
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
review required
Projects
Power Apps Test Engine
Status: No status
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@Grant-Archibald-MS