Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
plugins/twitter.py
Outdated
| msg = await event.eor("🔍 `Getting tweet details...`") | ||
| try: | ||
| client = await get_client() | ||
| if "twitter.com" in match or "x.com" in match: |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
This autofix suggestion was applied.
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 12 months ago
To fix the problem, we need to parse the URL and check the hostname to ensure it matches "twitter.com" or "x.com" correctly. This will prevent malicious URLs from bypassing the check by embedding the allowed hostnames in unexpected locations.
- Use the
urlparsefunction from theurllib.parsemodule to parse the URL. - Extract the hostname from the parsed URL and check if it matches "twitter.com" or "x.com".
- Update the code in the
twitter_detailsfunction to implement this change.
| @@ -83,4 +83,6 @@ | ||
| client = await get_client() | ||
| if "twitter.com" in match or "x.com" in match: | ||
| tweet_id = match.split("/")[-1].split("?")[0] | ||
| from urllib.parse import urlparse | ||
| parsed_url = urlparse(match) | ||
| if parsed_url.hostname in ["twitter.com", "x.com"]: | ||
| tweet_id = parsed_url.path.split("/")[-1].split("?")[0] | ||
| else: |
New-dev0
committed this autofix suggestion 12 months ago.
plugins/twitter.py
Outdated
| msg = await event.eor("🔍 `Getting tweet details...`") | ||
| try: | ||
| client = await get_client() | ||
| if "twitter.com" in match or "x.com" in match: |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 12 months ago
To fix the problem, we should parse the URL using urlparse and then check the hostname to ensure it matches "twitter.com" or "x.com". This approach is more reliable than checking for substrings within the URL.
- Parse the URL using
urlparse. - Extract the hostname from the parsed URL.
- Check if the hostname is either "twitter.com" or "x.com".
- Update the code in the
twitter_mediafunction to use this method.
| @@ -25,2 +25,3 @@ | ||
| import os | ||
| from urllib.parse import urlparse | ||
| from twikit import Client | ||
| @@ -151,4 +152,5 @@ | ||
| client = await get_client() | ||
| if "twitter.com" in match or "x.com" in match: | ||
| tweet_id = match.split("/")[-1].split("?")[0] | ||
| parsed_url = urlparse(match) | ||
| if parsed_url.hostname in ["twitter.com", "x.com"]: | ||
| tweet_id = parsed_url.path.split("/")[-1].split("?")[0] | ||
| else: |
…g sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 participant
Pollstickercommand by using cloudscraper