codeant-ai-for-open-source[bot] commented on code in PR #36986:
URL: https://github.com/apache/superset/pull/36986#discussion_r2673317451
##########
superset-frontend/src/features/datasets/AddDataset/LeftPanel/index.tsx:
##########
@@ -191,7 +192,7 @@ export default function LeftPanel({
description={
<span>
{t('Manage your databases')}{' '}
- <Typography.Link href="/databaseview/list">
+ <Typography.Link href={ensureAppRoot('/databaseview/list')}>
Review Comment:
**Suggestion:** A malicious or misconfigured `ensureAppRoot` could return a
non-relative or unsafe URL (for example a javascript: or external URL).
Constrain the value to a safe internal path (e.g. ensure it starts with '/')
and fallback if not, to prevent link injection/XSS-like issues. [security]
**Severity Level:** Critical 🚨
```suggestion
<Typography.Link href={((): string => { const p =
ensureAppRoot('/databaseview/list'); return p && p.startsWith('/') ?
encodeURI(p) : '/databaseview/list'; })()}>
```
<details>
<summary><b>Why it matters? ⭐ </b></summary>
Valid security concern: untrusted or misconfigured ensureAppRoot could
return an external or unsafe URL (javascript: scheme etc). The proposed guard
(verify it starts with '/' and fallback) prevents link injection and is a
reasonable defensive measure. It's a legitimate fix when the origin of
ensureAppRoot's value isn't strictly controlled.
</details>
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:**
superset-frontend/src/features/datasets/AddDataset/LeftPanel/index.tsx
**Line:** 195:195
**Comment:**
*Security: A malicious or misconfigured `ensureAppRoot` could return a
non-relative or unsafe URL (for example a javascript: or external URL).
Constrain the value to a safe internal path (e.g. ensure it starts with '/')
and fallback if not, to prevent link injection/XSS-like issues.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
```
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
