Skip to content

v0.124.1 — CodeQL: the last two backlog alerts

v0.122.1's last task, re-running CodeQL on main, left 18 alerts open of the 92 it started with: the 16 js/missing-rate-limiting alerts, which belong to the API rate limiting roadmap entry, and two that the fixes did not satisfy.

  • [x] The two leftovers: js/unvalidated-dynamic-method-call (#110, the inpaint provider's call) and js/cors-permissive-configuration (#89, null from normalizeOrigin reaching the origin list).
    • Note: inpaintHoles checks that the provider it looked up is a function before calling it (the check in inpaintProviderFor alone was not read as a guard, as with the grant holders in v0.122.1). normalizeOrigin returns undefined, never null, and accepts only an http(s) URL, so neither the opaque "null" origin nor a null can reach the list the cors middleware and Socket.IO are given.