Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix overly permissive regex #1514

Merged
merged 1 commit into from
Oct 25, 2023
Merged

Fix overly permissive regex #1514

merged 1 commit into from
Oct 25, 2023

Conversation

axelboc
Copy link
Contributor

@axelboc axelboc commented Oct 24, 2023

I've activated CodeQL analysis on the repo to try it out: https://github.com/silx-kit/h5web/settings/security_analysis

It detected an issue in a regex: https://github.com/silx-kit/h5web/security/code-scanning/1

Copy link
Member

@loichuder loichuder left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good to know.

I wonder if we could be even more restrictive. This part of the regex looks for the letter representing the dataType and this letter can only be a few (as evidenced by the switch below).

@axelboc
Copy link
Contributor Author

axelboc commented Oct 25, 2023

Hmm but if the regex doesn't match, we throw an error; and the error is more for cases where the format of the dtype string is invalid rather than unknown. When the format looks right but the dtype "letter" is not recognised, then we return an unknown type. So I'd rather be lenient on the letter that can be matched.

However, maybe I should reword the error message to "Invalid dtype" to avoid confusion.

@axelboc
Copy link
Contributor Author

axelboc commented Oct 25, 2023

I should add that this relates to the testing of the providers that I'd like to put in place: I'm hoping it will help make this kind of dtype parsing a bit more exhaustive and therefore stricter.

@axelboc axelboc merged commit 4917b6b into main Oct 25, 2023
10 checks passed
@axelboc axelboc deleted the fix-codeq-alert branch October 25, 2023 08:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants