anupamme commented on PR #313: URL: https://github.com/apache/cordova-paramedic/pull/313#issuecomment-5098939086
You're right, and thanks for catching this. The CWE-89/CRITICAL label came from an automated scanner pass and doesn't hold up under a real threat-model review — \`service\` comes from a fixed internal list and \`app\` is the tool's own bundle id, so there's no attacker-controlled path into these queries today. I've updated the framing to defense-in-depth rather than a vulnerability fix, which matches the title change. I'd still like to keep the escaping itself, on narrower grounds: it's a one-line-per-call, zero-behavior-change safeguard in case \`appName\` or the service list ever gets sourced from something less fixed (e.g. a config file, CLI flag, or future refactor), and it costs nothing today since none of the current values contain a \`'\`. But I'm also fine dropping it if you'd rather not carry hardening changes without a live threat — your call. I also agree the template-literal → string-concatenation swap in the \`logger.warn\` calls was unrelated scope creep from the automated patch, not something I intended to include. I've reverted those two lines back to template literals so the diff is just the escaping. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
