Improvement/format all UI with biomejs#4806
Improvement/format all UI with biomejs#4806MonPote wants to merge 2 commits intodevelopment/131.0from
Conversation
Hello monpote,My role is to assist you with the merge of this Available options
Available commands
Status report is not available. |
Request integration branchesWaiting for integration branch creation to be requested by the user. To request integration branches, please comment on this pull request with the following command: Alternatively, the |
|
/create_integration_branches |
ConflictA conflict has been raised during the creation of I have not created the integration branch. Here are the steps to resolve this conflict: git fetch
git checkout -B w/132.0/improvement/format-all-ui-with-biomejs origin/development/132.0
git merge origin/improvement/format-all-ui-with-biomejs
# <intense conflict resolution>
git commit
git push -u origin w/132.0/improvement/format-all-ui-with-biomejsThe following options are set: create_integration_branches |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const nodeRolesLabels = Object.keys(node.metadata.labels).filter( | ||
| (label) => label.startsWith(ROLE_PREFIX), | ||
| ); | ||
| const nodeRolesLabels = Object.keys(node.metadata.labels).filter((label) => label.startsWith(ROLE_PREFIX)); |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 26 days ago
In general, to fix incomplete substring/prefix checks you should parse and validate the structure explicitly rather than relying on includes or startsWith on uncontrolled strings. For a Kubernetes node role label, the expected structure is exactly node-role.kubernetes.io/<role-name> with no extra suffix or additional separators in the key portion. Instead of checking label.startsWith(ROLE_PREFIX), we should ensure that the label key is of the form ROLE_PREFIX + '/' + <role-name>, where <role-name> is non-empty and does not contain another /.
In this file, the best way to fix the issue without changing existing functionality is to replace the broad startsWith(ROLE_PREFIX) filter with a stricter structural check on the label string. We can do this inline in the filter callback to avoid adding new helpers or imports. A safe check is:
- Ensure the label key begins with
ROLE_PREFIX + '/'. - Ensure there is only one
/(so no additional path-like components in the key).
This preserves all current valid labels like node-role.kubernetes.io/master and node-role.kubernetes.io/worker, but rejects malformed or malicious labels like node-role.kubernetes.ioevil.com/worker or node-role.kubernetes.io/master/extra. The change is localized to the nodeRolesLabels computation around line 317 in ui/src/ducks/app/nodes.ts; no new imports or additional definitions are required.
| @@ -314,7 +314,14 @@ | ||
| } | ||
|
|
||
| // the Roles of the Node should be the ones that are stored in the labels `node-role.kubernetes.io/<role-name>` | ||
| const nodeRolesLabels = Object.keys(node.metadata.labels).filter((label) => label.startsWith(ROLE_PREFIX)); | ||
| const nodeRolesLabels = Object.keys(node.metadata.labels).filter((label) => { | ||
| // Only accept labels exactly matching the expected prefix + single role segment. | ||
| return ( | ||
| label.startsWith(`${ROLE_PREFIX}/`) && | ||
| // Ensure there's only one '/' (the one after the prefix) | ||
| label.indexOf('/', ROLE_PREFIX.length + 1) === -1 | ||
| ); | ||
| }); | ||
| const nodeRoles = nodeRolesLabels?.map((nRL) => nRL.split('/')[1]); | ||
| return { | ||
| id: node.metadata.uid, |
2 participants
Component:
Context:
Summary:
Acceptance criteria:
Closes: #ISSUE_NUMBER