Skip to content

Commit

Permalink
resolve false positive flag
Browse files Browse the repository at this point in the history
  • Loading branch information
Janson Bunce committed Oct 2, 2024
1 parent f7471a7 commit 910b866
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions backend/src/tools/logger.ts
Original file line number Diff line number Diff line change
Expand Up @@ -80,12 +80,12 @@ export class Logger {
}

async parseToken() {
const authToken = this.request.headers.authorization;
const atoak = this.request.headers.authorization;
// Test if API key, e.g. a 32 digit hex string
if (authToken && /^[A-Fa-f0-9]{32}$/.test(authToken ?? '')) {
if (atoak && /^[A-Fa-f0-9]{32}$/.test(atoak ?? '')) {
const apiKey = await ApiKey.findOne(
{
hashedKey: createHash('sha256').update(authToken).digest('hex')
hashedKey: createHash('sha256').update(atoak).digest('hex')
},
{ relations: ['user'] }
);
Expand All @@ -94,9 +94,9 @@ export class Logger {
apiKey.lastUsed = new Date();
apiKey.save();
} else {
if (authToken) {
if (atoak) {

Check failure

Code scanning / CodeQL

User-controlled bypass of security check High

This condition guards a sensitive
action
, but a
user-provided value
controls it.
const parsedUserFromJwt = jwt.verify(
authToken,
atoak,
process.env.JWT_SECRET!
) as UserToken;
this.token = { id: parsedUserFromJwt.id };
Expand Down

0 comments on commit 910b866

Please sign in to comment.