Merge branch release/v8.1.0 into master #478
Conversation
# Conflicts: # DocService/npm-shrinkwrap.json
…ests fixes and improvement, bugs fixes.
…, affectedRows -> isInsert
…ndencies update, minor structure refactorng
Integration tests for databases and GitHub actions
# Conflicts: # DocService/sources/databaseConnectors/baseConnector.js
Feature/wopi save template
Fix/databases timeout
…elop # Conflicts: # Common/sources/storage-fs.js # DocService/package.json # DocService/sources/DocsCoServer.js # DocService/sources/databaseConnectors/connectorUtilities.js # DocService/sources/databaseConnectors/postgreConnector.js # DocService/sources/gc.js # DocService/sources/mySqlBaseConnector.js # DocService/sources/wopiClient.js
Fix/mysql ssl connection
…meters to all requests
…en openings due to integrator failures; For bug 68424
…ortsLocks=false; Fix bug 68501
Fix/bug 68501
Fix/bugfix
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| var result = null; | ||
| var error = null; | ||
| try { | ||
| result = yield pool.query(sqlCommand, opt_values); |
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources High
| expires = Math.ceil(expires / 1000); | ||
| expires += expiredAfter; | ||
|
|
||
| var md5 = crypto.createHash('md5').update(expires + decodeURIComponent(uri) + storageSecretString).digest("base64"); |
Check failure
Code scanning / CodeQL
Use of a broken or weak cryptographic algorithm High
| router.use(`/${bucketName}/${storageFolderName}/${rout}`, (req, res, next) => { | ||
| const index = req.url.lastIndexOf('/'); | ||
| if ('GET' === req.method && index > 0) { | ||
| let sendFileOptions = { | ||
| root: rootPath, dotfiles: 'deny', headers: { | ||
| 'Content-Disposition': 'attachment' | ||
| } | ||
| }; | ||
| const urlParsed = urlModule.parse(req.url); | ||
| if (urlParsed && urlParsed.pathname) { | ||
| const filename = decodeURIComponent(path.basename(urlParsed.pathname)); | ||
| sendFileOptions.headers['Content-Type'] = mime.getType(filename); | ||
| } | ||
| const realUrl = decodeURI(req.url.substring(0, index)); | ||
| res.sendFile(realUrl, sendFileOptions, (err) => { | ||
| if (err) { | ||
| operationContext.global.logger.error(err); | ||
| res.status(400).end(); | ||
| } | ||
| }); | ||
| } else { | ||
| res.sendStatus(404); | ||
| } | ||
| }); |
Check failure
Code scanning / CodeQL
Missing rate limiting High
| //https://github.com/ONLYOFFICE/web-apps/blob/4a7879b4f88f315fe94d9f7d97c0ed8aa9f82221/apps/documenteditor/main/app/controller/Main.js#L1652 | ||
| //this.appOptions.isPasswordSupport = this.appOptions.isEdit && this.api.asc_isProtectionSupport() && (this.permissions.protect!==false); | ||
| let isPasswordSupport = tenOpenProtectedFile && !conn.user?.view && false !== conn.permissions?.protect; | ||
| ctx.logger.debug('commandSetPassword isEnterCorrectPassword=%s, hasDocumentPassword=%s, hasPasswordCol=%s, isPasswordSupport=%s', conn.isEnterCorrectPassword, hasDocumentPassword, hasPasswordCol, isPasswordSupport); |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
| //https://github.com/ONLYOFFICE/web-apps/blob/4a7879b4f88f315fe94d9f7d97c0ed8aa9f82221/apps/documenteditor/main/app/controller/Main.js#L1652 | ||
| //this.appOptions.isPasswordSupport = this.appOptions.isEdit && this.api.asc_isProtectionSupport() && (this.permissions.protect!==false); | ||
| let isPasswordSupport = tenOpenProtectedFile && !conn.user?.view && false !== conn.permissions?.protect; | ||
| ctx.logger.debug('commandSetPassword isEnterCorrectPassword=%s, hasDocumentPassword=%s, hasPasswordCol=%s, isPasswordSupport=%s', conn.isEnterCorrectPassword, hasDocumentPassword, hasPasswordCol, isPasswordSupport); |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
| try { | ||
| connection = await pool.getConnection(); | ||
|
|
||
| const result = await connection.query(sqlCommand, values); |
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources High
pull_requestevent (Disable codeql scanning onpull_requestevent #455)