anupamme commented on PR #313: URL: https://github.com/apache/cordova-paramedic/pull/313#issuecomment-5098887459
You're right, and thanks for catching this. The CWE-89/CRITICAL label came from an automated scanner pass and doesn't hold up under a real threat-model review; service comes from a fixed internal list, and app is the tool's own bundle ID, so there's no attacker-controlled path into these queries today. I've updated the framing to defence-in-depth rather than a vulnerability fix, which matches the title change. I'd still like to keep the escaping itself, on narrower grounds: it's a one-line-per-call, zero-behaviour-change safeguard in case appName or the service list ever gets sourced from something less fixed (e.g. a config file, CLI flag, or future refactor), and it costs nothing today since none of the current values contains a '. But I'm also fine dropping it if you'd rather not carry hardening changes without a live threat: your call. I also agree the template-literal → string-concatenation swap in the logger.warn calls were unrelated scope creep, not something I intended to include. I'll revert those two lines to template literals so the diff is just the escaping. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
