Conversation
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| private boolean isEncodedRepositoryFilePath( String contextId ) { | ||
| return contextId.startsWith( ":" ) || contextId.matches( "^[A-z]\t:.*" ); |
Check warning
Code scanning / CodeQL
Overly permissive regular expression range Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 months ago
To fix the issue, the overly permissive range A-z should be replaced with a more precise range that matches only the intended characters. In this case, the correct range is likely A-Za-z, which includes all uppercase and lowercase alphabetic characters without any unintended symbols. This change ensures that the regular expression behaves as expected and avoids matching unintended characters.
The specific change will be made on line 733 in the isEncodedRepositoryFilePath method.
| @@ -732,3 +732,3 @@ | ||
| private boolean isEncodedRepositoryFilePath( String contextId ) { | ||
| return contextId.startsWith( ":" ) || contextId.matches( "^[A-z]\t:.*" ); | ||
| return contextId.startsWith( ":" ) || contextId.matches( "^[A-Za-z]\t:.*" ); | ||
| } |
| public Response clearSessionVariable( @QueryParam( "key" ) String key ) { | ||
| try { | ||
| var result = userConsoleService.clearSessionVariable( key ); | ||
| return Response.ok( result ).build(); |
Check warning
Code scanning / CodeQL
Cross-site scripting Medium
[DEVO-12893] - Changing dep GAV
[BACKLOG-43889] - partial upload message
feat[PPP-5739]: replace ini4j with commons-configuration2
[BACKLOG-45596]-Upgrade JDK properties from 11 to 17
[BACKLOG-45998] - Adding pdi-engine-configuration-api to WEB-INF/lib
feat: move generic-file-service to pentaho-platform [PPUC-124]
- the scope had been lost when moving configs from Browse Files plugin
fix: change bean scope of GFS providers to session [PPUC-124]
fix[BISERVER-15302]: correctly update descriptions in Browse Files tooltips
- Apparently, another case not previously covered by the fix #5476
fix: incorrect GFS snapshot version number [PPUC-124]
fix: session scope for spring beans from plugins [PPUC-124]
…ut http request [PPUC-277]
fix: get all Generic File Service Provider beans [PPUC-124]
fix: session scope for spring beans from root app context beans without http request [PPUC-277]
fix[BISERVER-15346]: support defaulting to the generated content name on email attachments
[BISERVER-15534] [BISERVER-15533] - Update command line processer to …
[PPN-366] Support scheduling ktr and kjb files located in a vfs folder.
[chore] fix line terminators
* chore: Normalize message bundle line endings to LF * fix: Correct ACL settings message in Japanese properties file
[BACKLOG-48378] Provide a means for PDI to locate PDC API
[PPN-367] Support for scheduling reports on VFS.
This fixes BACKLOG-49004
[PPP-6305] - Remove weka plugins and its dependencies from pentaho product
[PPN-19] Scheduler pause/resume status update event log
…he() by catching CacheException for already-existing caches. Synchronize public methods to access the CacheManager and add an atomic getOrCreateFromRegionCache method to reduce the chances for race conditions. Other users of the cache should migrate to this new method when possible.
[BISERVER-15569] Fix race condition in HvCacheRegionFactory.createCache() by catching …
FICS requested changes for brute force administration and unlock via UI (cherry picked from commit 7dac72c)
Also improved unit testing for the class (functionalities and coverage)
* fix[BISERVER-15545]: update doSetMetadata endpoint to accept XML * Apply suggestion from @Copilot Co-authored-by: Copilot <[email protected]> * fix[BISERVER-15545]: update doSetMetadata endpoint to accept XML --------- Co-authored-by: Copilot <[email protected]>
- get smtp.sendpartial via email configuration - only fetch email failure properties on startup - apply regex to remove invalid email addresses
synchronized blocks to avoid deadlocks. Switched to concurrenthashmap to provide read/write locking on data structures and further synchronization around object creation in getOrCreate to prevent duplicate object creation.
[BACKLOG-49227] CacheManager needs finer-grained locking than
* build[PPP-6248]: update Hibernate groupId * build[PPP-6248]: update Hibernate groupId
- add lazy init for the failure email properties - add constants for repeated strings - fix wrong if for message validation - fix formatting
feat[BISERVER-15398]: receive an email when a schedule fails
Sync to Master