Tracking pull request to merge release-1.65.0 to master #2358
Conversation
…re isnt an empty box when agreements dont have comments (#2359) chore: modifies proptypes in vehicle supplier tabs due to console messages appearing
* Create unit-tests for ComplianceObligationContainer * Refactor ComplianceObligationContainer for unit-test edge case * Grouping some tests * Refactor compliance unit-tests to reduce duplicated codes * Refactor TestHelper class to TestData class * Grouping common test data * Refactor testData class in ComplianceObligationContainer test
* Add unit-tests for Compliance and Compliance-components * Minor clean-up * Minor clean-up
…caught reference error) (#2378)
…event Error 31 (duplicate VINs) (#2370) * task: spreadsheets with duplicate vins are rejected with error message during submission * chore: moves line out of loop
* unit tests for supp components * tweaks and start zevsales * get rid of duplication
#2377) * -adds navigation tabs to credit agreement details * chore: ran prettier
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| axios.get.mockResolvedValue(mockResponse); | ||
|
|
||
| const params = { headers: { Authorization: "Bearer token" } }; |
Check failure
Code scanning / CodeQL
Hard-coded credentials Critical test
* Disable Save button if vehicle supplier, transaction type, or effective date is not entered. * Disable "Submit to Director" button if credit quantity is missing.
* Add model-year in query string to solve tab-names inconsistency during loading issue. * Add URI encoding and code clean-up * Align compliance report tabs * Fixing compliance report disabled tabs alignment * Disable compliance-report tabs when loading. * Move insertIdAndYear function to utilities
| const getRoute = () => { | ||
| if (locationRoute && locationState) { | ||
| return history.push(locationRoute, locationState) | ||
| return history.push(locationRoute, locationState); |
Check failure
Code scanning / CodeQL
Client-side cross-site scripting High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 2 months ago
To fix the problem, we need to ensure that the locationRoute parameter is properly sanitized before being used in the history.push method. One effective way to do this is by using a library like DOMPurify to sanitize the user input. This will prevent any malicious scripts from being executed.
- Install the
DOMPurifylibrary. - Import
DOMPurifyin the relevant files. - Sanitize the
locationRouteparameter before using it in thehistory.pushmethod.
| @@ -5,2 +5,3 @@ | ||
| import history from "../History"; | ||
| import DOMPurify from "dompurify"; | ||
|
|
||
| @@ -20,8 +21,9 @@ | ||
| const getRoute = () => { | ||
| if (locationRoute && locationState) { | ||
| return history.push(locationRoute, locationState); | ||
| const sanitizedRoute = DOMPurify.sanitize(locationRoute); | ||
| if (sanitizedRoute && locationState) { | ||
| return history.push(sanitizedRoute, locationState); | ||
| } | ||
|
|
||
| if (locationRoute) { | ||
| return history.push(locationRoute); | ||
| if (sanitizedRoute) { | ||
| return history.push(sanitizedRoute); | ||
| } |
| @@ -52,3 +52,4 @@ | ||
| "winston": "^3.2.1", | ||
| "xlsx": "^0.18.5" | ||
| "xlsx": "^0.18.5", | ||
| "dompurify": "^3.2.3" | ||
| }, |
| Package | Version | Security advisories |
| dompurify (npm) | 3.2.3 | None |
| } | ||
|
|
||
| if (locationRoute) { | ||
| return history.push(locationRoute) | ||
| return history.push(locationRoute); |
Check failure
Code scanning / CodeQL
Client-side cross-site scripting High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 2 months ago
To fix the problem, we need to ensure that the locationRoute parameter is sanitized or validated before being used in the history.push function. One effective way to do this is to use a whitelist of allowed routes and ensure that the locationRoute matches one of these allowed routes before proceeding.
- Create a whitelist of allowed routes.
- Validate the
locationRouteagainst this whitelist before using it in thehistory.pushfunction. - If the
locationRouteis not valid, handle the error appropriately (e.g., redirect to a default safe route or show an error message).
| @@ -19,11 +19,10 @@ | ||
| } = props; | ||
| const allowedRoutes = ["/route1", "/route2", "/route3"]; // Add all allowed routes here | ||
| const getRoute = () => { | ||
| if (locationRoute && locationState) { | ||
| return history.push(locationRoute, locationState); | ||
| } | ||
|
|
||
| if (locationRoute) { | ||
| if (locationRoute && allowedRoutes.includes(locationRoute)) { | ||
| if (locationState) { | ||
| return history.push(locationRoute, locationState); | ||
| } | ||
| return history.push(locationRoute); | ||
| } | ||
|
|
||
| return history.goBack(); |
| if (newState === 'SUBMITTED') { | ||
| history.replace(ROUTES_VEHICLES.DETAILS.replace(/:id/gi, id)) | ||
| if (newState === "SUBMITTED") { | ||
| history.replace(ROUTES_VEHICLES.DETAILS.replace(/:id/gi, id)); |
Check failure
Code scanning / CodeQL
Client-side cross-site scripting High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 2 months ago
To fix the problem, we need to ensure that the id parameter is properly sanitized before being used in constructing the URL. One way to achieve this is by using a library like DOMPurify to sanitize the id parameter. This will help prevent any malicious scripts from being executed.
- Install the
DOMPurifylibrary. - Import
DOMPurifyin the file. - Sanitize the
idparameter before using it in the URL construction.
| @@ -13,2 +13,3 @@ | ||
| import VehicleDetailsPage from "./components/VehicleDetailsPage"; | ||
| import DOMPurify from "dompurify"; | ||
|
|
||
| @@ -20,3 +21,4 @@ | ||
| }); | ||
| const { id } = useParams(); | ||
| const { id: rawId } = useParams(); | ||
| const id = DOMPurify.sanitize(rawId); | ||
| const { keycloak, user, location } = props; |
| @@ -52,3 +52,4 @@ | ||
| "winston": "^3.2.1", | ||
| "xlsx": "^0.18.5" | ||
| "xlsx": "^0.18.5", | ||
| "dompurify": "^3.2.3" | ||
| }, |
| Package | Version | Security advisories |
| dompurify (npm) | 3.2.3 | None |
…tip (#2414) * feat: disables save button if forecast isn't filled, adds tooltip * fix: adds check for model year before disabling save * chore: adds proptypes
* fix: conditionally displays confirmation for sales forecast if year >= 2023 * chore: adds proptypes * chore: replaces if-then-else flow as requested by sonarcloud
* enhance ux on file upload * allow for prescence of confirm modal to be controlled via props for FileDropArea
* Create unit-tests for Credits * Grouping common test data
* unit tests for credit agreement components * reduce duplicate code
* feat: 2412 - updated sales and supplied table * small change
* feat: adds tooltip component and implements it on supplier info page and compliance obligation * chore: linting * chore: more linting * fix: adds # to css color
* fix: adds filter to credit agreement comments for bceid users * adds check to ensure comment exists for update * chore: credit agreement tests * chore: linting
* Disable Recommend buttons in credit transfer if no comment is entered. * Fix props-validation * Disable "Add Comment" button until a comment is entered. * Fix the issue that some buttons won't change back to disabled if comment is erased.
* Add admin command reset_database * minor change * Add migration and check for production environment
* credit transfer tests * more debug * ensure users get distinct organizations * remove transaction.oncommit
|
No description provided.