Fix code scan issue with ALLOWED_DOMAIN_PATTERN regex (#1687)

saleor · Jan 13, 2025 · 9649b78 · 9649b78
1 parent 9fc9edf
commit 9649b78
Show file tree

Hide file tree

Showing 14 changed files with 67 additions and 39 deletions.
diff --git a/.changeset/rotten-seals-suffer.md b/.changeset/rotten-seals-suffer.md
@@ -0,0 +1,10 @@
+---
+"products-feed": patch
+"klaviyo": patch
+"app-avatax": patch
+"cms-v2": patch
+"search": patch
+"smtp": patch
+---
+
+Escape ALLOWED_DOMAIN_PATTERN regex. It ensures that regex constructed from env variable is sanitized and can't be used to Denial of Service attack.
diff --git a/apps/avatax/package.json b/apps/avatax/package.json
@@ -60,6 +60,7 @@
     "decimal.js-light": "2.5.1",
     "dotenv": "16.3.1",
     "dynamodb-toolbox": "1.8.2",
+    "escape-string-regexp": "5.0.0",
     "graphql": "16.7.1",
     "graphql-tag": "2.12.6",
     "jotai": "^2.4.2",

diff --git a/apps/avatax/src/pages/api/register.ts b/apps/avatax/src/pages/api/register.ts
@@ -1,6 +1,7 @@
 import { createAppRegisterHandler } from "@saleor/app-sdk/handlers/next";
 import { wrapWithLoggerContext } from "@saleor/apps-logger/node";
 import { withOtel } from "@saleor/apps-otel";
+import escapeStringRegexp from "escape-string-regexp";
 
 import { env } from "@/env";
 import { createLogger } from "@/logger";
@@ -27,7 +28,7 @@ export default wrapWithLoggerContext(
       allowedSaleorUrls: [
         (url) => {
           if (allowedUrlsPattern) {
-            const regex = new RegExp(allowedUrlsPattern);
+            const regex = new RegExp(escapeStringRegexp(allowedUrlsPattern));
 
             return regex.test(url);
           }

diff --git a/apps/cms-v2/package.json b/apps/cms-v2/package.json
@@ -49,6 +49,7 @@
     "@vitejs/plugin-react": "4.3.1",
     "contentful-management": "10.46.4",
     "dotenv": "16.3.1",
+    "escape-string-regexp": "5.0.0",
     "graphql": "16.7.1",
     "graphql-tag": "2.12.6",
     "jsdom": "^20.0.3",

diff --git a/apps/cms-v2/src/pages/api/register.ts b/apps/cms-v2/src/pages/api/register.ts
@@ -1,6 +1,7 @@
 import { createAppRegisterHandler } from "@saleor/app-sdk/handlers/next";
 import { wrapWithLoggerContext } from "@saleor/apps-logger/node";
 import { withOtel } from "@saleor/apps-otel";
+import escapeStringRegexp from "escape-string-regexp";
 
 import { saleorApp } from "@/saleor-app";
 
@@ -17,7 +18,7 @@ const handler = createAppRegisterHandler({
   allowedSaleorUrls: [
     (url) => {
       if (allowedUrlsPattern) {
-        const regex = new RegExp(allowedUrlsPattern);
+        const regex = new RegExp(escapeStringRegexp(allowedUrlsPattern));
 
         return regex.test(url);
       }

diff --git a/apps/klaviyo/package.json b/apps/klaviyo/package.json
@@ -37,6 +37,7 @@
     "@sentry/nextjs": "../../node_modules/@sentry/nextjs",
     "@urql/exchange-auth": "2.1.4",
     "dotenv": "16.3.1",
+    "escape-string-regexp": "5.0.0",
     "graphql": "16.7.1",
     "graphql-tag": "2.12.6",
     "next": "14.2.3",

diff --git a/apps/klaviyo/src/pages/api/register.ts b/apps/klaviyo/src/pages/api/register.ts
@@ -1,6 +1,7 @@
 import { createAppRegisterHandler } from "@saleor/app-sdk/handlers/next";
 import { wrapWithLoggerContext } from "@saleor/apps-logger/node";
 import { withOtel } from "@saleor/apps-otel";
+import escapeStringRegexp from "escape-string-regexp";
 
 import { saleorApp } from "../../../saleor-app";
 import { loggerContext } from "../../logger-context";
@@ -16,7 +17,7 @@ const handler = createAppRegisterHandler({
   allowedSaleorUrls: [
     (url) => {
       if (allowedUrlsPattern) {
-        const regex = new RegExp(allowedUrlsPattern);
+        const regex = new RegExp(escapeStringRegexp(allowedUrlsPattern));
 
         return regex.test(url);
       }

diff --git a/apps/products-feed/package.json b/apps/products-feed/package.json
@@ -48,6 +48,7 @@
     "@urql/exchange-auth": "2.1.4",
     "@vitejs/plugin-react": "4.3.1",
     "dotenv": "16.3.1",
+    "escape-string-regexp": "5.0.0",
     "fast-xml-parser": "^4.0.15",
     "graphql": "16.7.1",
     "graphql-tag": "2.12.6",

diff --git a/apps/products-feed/src/pages/api/register.ts b/apps/products-feed/src/pages/api/register.ts
@@ -1,8 +1,8 @@
 import { createAppRegisterHandler } from "@saleor/app-sdk/handlers/next";
 import { wrapWithLoggerContext } from "@saleor/apps-logger/node";
 import { withOtel } from "@saleor/apps-otel";
+import escapeStringRegexp from "escape-string-regexp";
 
-import { createLogger } from "../../logger";
 import { loggerContext } from "../../logger-context";
 import { saleorApp } from "../../saleor-app";
 
@@ -19,7 +19,7 @@ export default wrapWithLoggerContext(
       allowedSaleorUrls: [
         (url) => {
           if (allowedUrlsPattern) {
-            const regex = new RegExp(allowedUrlsPattern);
+            const regex = new RegExp(escapeStringRegexp(allowedUrlsPattern));
 
             return regex.test(url);
           }

diff --git a/apps/search/package.json b/apps/search/package.json
@@ -50,6 +50,7 @@
     "clsx": "^1.2.1",
     "debug": "^4.3.4",
     "dotenv": "16.3.1",
+    "escape-string-regexp": "5.0.0",
     "graphql": "16.7.1",
     "graphql-tag": "2.12.6",
     "next": "14.2.3",

diff --git a/apps/search/src/pages/api/register.ts b/apps/search/src/pages/api/register.ts
@@ -1,6 +1,7 @@
 import { createAppRegisterHandler } from "@saleor/app-sdk/handlers/next";
 import { wrapWithLoggerContext } from "@saleor/apps-logger/node";
 import { withOtel } from "@saleor/apps-otel";
+import escapeStringRegexp from "escape-string-regexp";
 
 import { saleorApp } from "../../../saleor-app";
 import { loggerContext } from "../../lib/logger-context";
@@ -14,7 +15,7 @@ export default wrapWithLoggerContext(
       allowedSaleorUrls: [
         (url) => {
           if (allowedUrlsPattern) {
-            const regex = new RegExp(allowedUrlsPattern);
+            const regex = new RegExp(escapeStringRegexp(allowedUrlsPattern));
 
             return regex.test(url);
           }

diff --git a/apps/smtp/package.json b/apps/smtp/package.json
@@ -47,6 +47,7 @@
     "@urql/exchange-auth": "2.1.4",
     "@vitejs/plugin-react": "4.3.1",
     "dotenv": "16.3.1",
+    "escape-string-regexp": "5.0.0",
     "graphql": "16.7.1",
     "graphql-tag": "2.12.6",
     "handlebars": "^4.7.7",

diff --git a/apps/smtp/src/pages/api/register.ts b/apps/smtp/src/pages/api/register.ts
@@ -2,6 +2,7 @@ import { createAppRegisterHandler } from "@saleor/app-sdk/handlers/next";
 import { wrapWithLoggerContext } from "@saleor/apps-logger/node";
 import { withOtel } from "@saleor/apps-otel";
 import { SaleorVersionCompatibilityValidator } from "@saleor/apps-shared";
+import escapeStringRegexp from "escape-string-regexp";
 
 import { createInstrumentedGraphqlClient } from "../../lib/create-instrumented-graphql-client";
 import { createLogger } from "../../logger";
@@ -22,7 +23,7 @@ export default wrapWithLoggerContext(
       allowedSaleorUrls: [
         (url) => {
           if (allowedUrlsPattern) {
-            const regex = new RegExp(allowedUrlsPattern);
+            const regex = new RegExp(escapeStringRegexp(allowedUrlsPattern));
 
             return regex.test(url);
           }