feat: building selection criteria file transfer script - #1220
feat: building selection criteria file transfer script#1220YazeedLoonat wants to merge 2 commits into
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const image = await axios.get( | ||
| `https://res.cloudinary.com/${dataTransferDTO.cloudinaryName}/image/upload/${oldAssetInfo[j].file_id}.pdf`, | ||
| { | ||
| responseType: 'arraybuffer', | ||
| }, | ||
| ); |
Check failure
Code scanning / CodeQL
Server-side request forgery
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI over 1 year ago
To fix the SSRF vulnerability, we need to validate and restrict the cloudinaryName value to a predefined set of allowed values (allow-list). This ensures that only trusted subdomains are used in the URL construction. The best way to implement this is to:
- Define an allow-list of valid
cloudinaryNamevalues. - Validate the
cloudinaryNameagainst this allow-list before using it in the URL. - Reject or handle invalid values appropriately.
The validation should be implemented in the transferListingBuildingSelectionCriteriaAssetsData method in api/src/services/script-runner.service.ts. If the cloudinaryName is invalid, an exception should be thrown to prevent further processing.
| @@ -1175,2 +1175,6 @@ | ||
| // pull down image from cloudinary | ||
| const allowedCloudinaryNames = ['trusted-cloudinary-name1', 'trusted-cloudinary-name2']; | ||
| if (!allowedCloudinaryNames.includes(dataTransferDTO.cloudinaryName)) { | ||
| throw new BadRequestException('Invalid cloudinaryName provided.'); | ||
| } | ||
| const image = await axios.get( |
cfa0d15 to
d584f19
Compare
|
Is this still needed? |
| `${dataTransferDTO.jurisdiction} county doesn't exist in foreign database`, | ||
| ); | ||
| } | ||
| const listingTransferMap = await this.prisma.listingTransferMap.findMany({ |
There was a problem hiding this comment.
I'm confused on what the purpose of this listingTransferMap layer. The listing_id is always the same as the old_id and doesn't take jurisdiction into account. So when we go to use this for San Jose it will also try to do the listings of the Alameda listings we transferred.
4 participants
This PR addresses #1217
Description
This adds a new transfer script that transfer building selection criteria
How Can This Be Tested/Reviewed?
You'll need to run the jurisdiction transfer scripts locally including the new script
you should have the building selection criteria files uploaded to AWS and attached the listing
Author Checklist:
yarn generate:clientand/or created a migration when requiredReview Process: