chore: infrastructure upgrade #13892
Conversation
…ggenius/dify into chore/infrastructure-upgrade
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| <Link target="_blank" href={`${MARKETPLACE_URL_PREFIX}`} className='inline-flex items-center system-sm-medium text-text-accent'> | ||
| <div className='mb-2 flex items-center pt-2'> | ||
| <span className='text-text-tertiary system-sm-regular pr-1'>{t('common.modelProvider.discoverMore')}</span> | ||
| <Link target="_blank" href={`${MARKETPLACE_URL_PREFIX}`} className='system-sm-medium text-text-accent inline-flex items-center'> |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 5 days ago
To fix the problem, we need to ensure that the MARKETPLACE_URL_PREFIX is properly sanitized before being used in the href attribute. This can be achieved by validating the URL to ensure it is safe and does not contain any malicious content.
The best way to fix this issue without changing existing functionality is to use a well-known library like DOMPurify to sanitize the URL. This will ensure that any potentially harmful content is removed before the URL is used.
| @@ -34,2 +34,3 @@ | ||
| import { MARKETPLACE_URL_PREFIX } from '@/config' | ||
| import DOMPurify from 'dompurify' | ||
| import cn from '@/utils/classnames' | ||
| @@ -167,3 +168,3 @@ | ||
| <span className='text-text-tertiary system-sm-regular pr-1'>{t('common.modelProvider.discoverMore')}</span> | ||
| <Link target="_blank" href={`${MARKETPLACE_URL_PREFIX}`} className='system-sm-medium text-text-accent inline-flex items-center'> | ||
| <Link target="_blank" href={DOMPurify.sanitize(`${MARKETPLACE_URL_PREFIX}`)} className='system-sm-medium text-text-accent inline-flex items-center'> | ||
| {t('plugin.marketplace.difyMarketplace')} |
| @@ -122,3 +122,4 @@ | ||
| "zundo": "^2.1.0", | ||
| "zustand": "^4.5.2" | ||
| "zustand": "^4.5.2", | ||
| "dompurify": "^3.2.4" | ||
| }, |
| Package | Version | Security advisories |
| dompurify (npm) | 3.2.4 | None |
| <Button | ||
| variant='primary' | ||
| className='w-[calc(50%-4px)]' | ||
| onClick={showInstallFromMarketplace} | ||
| > | ||
| {t('plugin.detailPanel.operation.install')} | ||
| </Button> | ||
| <a href={`${getPluginLinkInMarketplace(plugin)}?language=${localeFromLocale}`} target='_blank' className='block flex-1 shrink-0 w-[calc(50%-4px)]'> | ||
| <a href={`${getPluginLinkInMarketplace(plugin)}?language=${localeFromLocale}`} target='_blank' className='block w-[calc(50%-4px)] flex-1 shrink-0'> |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 5 days ago
To fix the problem, we need to ensure that the URL used in the href attribute is properly sanitized to prevent XSS attacks. One way to achieve this is by using a library like DOMPurify to sanitize the URL before using it. This will ensure that any potentially harmful content is removed from the URL.
- Install the
DOMPurifylibrary. - Import
DOMPurifyin the relevant file. - Use
DOMPurifyto sanitize the URL before using it in thehrefattribute.
| @@ -12,2 +12,3 @@ | ||
| import { useTags } from '@/app/components/plugins/hooks' | ||
| import DOMPurify from 'dompurify' | ||
|
|
||
| @@ -57,3 +58,3 @@ | ||
| </Button> | ||
| <a href={`${getPluginLinkInMarketplace(plugin)}?language=${localeFromLocale}`} target='_blank' className='block w-[calc(50%-4px)] flex-1 shrink-0'> | ||
| <a href={DOMPurify.sanitize(`${getPluginLinkInMarketplace(plugin)}?language=${localeFromLocale}`)} target='_blank' className='block w-[calc(50%-4px)] flex-1 shrink-0'> | ||
| <Button | ||
| @@ -85,3 +86,3 @@ | ||
| className='group relative inline-block cursor-pointer rounded-xl' | ||
| href={getPluginLinkInMarketplace(plugin)} | ||
| href={DOMPurify.sanitize(getPluginLinkInMarketplace(plugin))} | ||
| > |
| @@ -122,3 +122,4 @@ | ||
| "zundo": "^2.1.0", | ||
| "zustand": "^4.5.2" | ||
| "zustand": "^4.5.2", | ||
| "dompurify": "^3.2.4" | ||
| }, |
| Package | Version | Security advisories |
| dompurify (npm) | 3.2.4 | None |
| >{t('plugin.detailPanel.operation.checkUpdate')}</div> | ||
| )} | ||
| {(source === PluginSource.marketplace || source === PluginSource.github) && ( | ||
| <a href={detailUrl} target='_blank' className='flex items-center px-3 py-1.5 rounded-lg text-text-secondary system-md-regular cursor-pointer hover:bg-state-base-hover'> | ||
| <a href={detailUrl} target='_blank' className='text-text-secondary system-md-regular hover:bg-state-base-hover flex cursor-pointer items-center rounded-lg px-3 py-1.5'> |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 6 days ago
To fix the problem, we need to ensure that the detailUrl is properly sanitized before being used in the anchor tag's href attribute. This can be achieved by using a library like DOMPurify to sanitize the URL and prevent any malicious scripts from being executed.
- Install the
DOMPurifylibrary. - Import
DOMPurifyin the relevant file. - Use
DOMPurifyto sanitize thedetailUrlbefore using it in the anchor tag.
| @@ -14,2 +14,3 @@ | ||
| import cn from '@/utils/classnames' | ||
| import DOMPurify from 'dompurify' | ||
|
|
||
| @@ -42,2 +43,4 @@ | ||
|
|
||
| const sanitizedDetailUrl = DOMPurify.sanitize(detailUrl) | ||
|
|
||
| return ( | ||
| @@ -80,3 +83,3 @@ | ||
| {(source === PluginSource.marketplace || source === PluginSource.github) && ( | ||
| <a href={detailUrl} target='_blank' className='text-text-secondary system-md-regular hover:bg-state-base-hover flex cursor-pointer items-center rounded-lg px-3 py-1.5'> | ||
| <a href={sanitizedDetailUrl} target='_blank' className='text-text-secondary system-md-regular hover:bg-state-base-hover flex cursor-pointer items-center rounded-lg px-3 py-1.5'> | ||
| <span className='grow'>{t('plugin.detailPanel.operation.viewDetail')}</span> |
| @@ -122,3 +122,4 @@ | ||
| "zundo": "^2.1.0", | ||
| "zustand": "^4.5.2" | ||
| "zustand": "^4.5.2", | ||
| "dompurify": "^3.2.4" | ||
| }, |
| Package | Version | Security advisories |
| dompurify (npm) | 3.2.4 | None |
| <a href={`${MARKETPLACE_URL_PREFIX}/plugins/${author}/${name}`} target='_blank' className='block px-3 py-1.5 rounded-lg text-text-secondary system-md-regular cursor-pointer hover:bg-state-base-hover'>{t('common.operation.viewDetails')}</a> | ||
| <div className='bg-components-panel-bg-blur border-components-panel-border w-[112px] rounded-xl border-[0.5px] p-1 shadow-lg'> | ||
| <div onClick={handleDownload} className='text-text-secondary system-md-regular hover:bg-state-base-hover cursor-pointer rounded-lg px-3 py-1.5'>{t('common.operation.download')}</div> | ||
| <a href={`${MARKETPLACE_URL_PREFIX}/plugins/${author}/${name}`} target='_blank' className='text-text-secondary system-md-regular hover:bg-state-base-hover block cursor-pointer rounded-lg px-3 py-1.5'>{t('common.operation.viewDetails')}</a> |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 5 days ago
To fix the problem, we need to ensure that the value of MARKETPLACE_URL_PREFIX is properly sanitized before being used in the href attribute. One way to achieve this is by using a library like DOMPurify to sanitize the URL. This will ensure that any potentially malicious content is removed before the URL is used.
- Install the
DOMPurifylibrary. - Import
DOMPurifyin the relevant file. - Use
DOMPurifyto sanitize theMARKETPLACE_URL_PREFIXbefore using it in thehrefattribute.
| @@ -16,2 +16,3 @@ | ||
| import { downloadFile } from '@/utils/format' | ||
| import DOMPurify from 'dompurify' | ||
|
|
||
| @@ -62,2 +63,3 @@ | ||
| }, [blob]) | ||
| const sanitizedMarketplaceUrlPrefix = DOMPurify.sanitize(MARKETPLACE_URL_PREFIX) | ||
| return ( | ||
| @@ -80,3 +82,3 @@ | ||
| <div onClick={handleDownload} className='text-text-secondary system-md-regular hover:bg-state-base-hover cursor-pointer rounded-lg px-3 py-1.5'>{t('common.operation.download')}</div> | ||
| <a href={`${MARKETPLACE_URL_PREFIX}/plugins/${author}/${name}`} target='_blank' className='text-text-secondary system-md-regular hover:bg-state-base-hover block cursor-pointer rounded-lg px-3 py-1.5'>{t('common.operation.viewDetails')}</a> | ||
| <a href={`${sanitizedMarketplaceUrlPrefix}/plugins/${author}/${name}`} target='_blank' className='text-text-secondary system-md-regular hover:bg-state-base-hover block cursor-pointer rounded-lg px-3 py-1.5'>{t('common.operation.viewDetails')}</a> | ||
| </div> |
| @@ -122,3 +122,4 @@ | ||
| "zundo": "^2.1.0", | ||
| "zustand": "^4.5.2" | ||
| "zustand": "^4.5.2", | ||
| "dompurify": "^3.2.4" | ||
| }, |
| Package | Version | Security advisories |
| dompurify (npm) | 3.2.4 | None |
Summary
Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.
Tip
Close issue syntax:
Fixes #<issue number>orResolves #<issue number>, see documentation for more details.Screenshots
Checklist
Important
Please review the checklist below before submitting your pull request.
dev/reformat(backend) andcd web && npx lint-staged(frontend) to appease the lint gods