Skip to content

Conversation

@thekevinm
Copy link
Contributor

No description provided.

nicdavidson and others added 13 commits April 1, 2025 14:28
…tering

- Replace string concatenation with parameterized queries in Service::selectByRequest()
- Add input validation for service IDs (numeric check and type casting)
- Prevent SQL injection attacks in role-based access control filtering
- Maintain backward compatibility while securing database queries

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
…bels

Implements security fix for Stored XSS vulnerability in Services tab.

Changes:
- Add validation rules for label (max 80 chars) and description (max 255 chars)
- Add setLabelAttribute() mutator to strip HTML tags from labels
- Add setDescriptionAttribute() mutator to strip HTML tags from descriptions

This prevents malicious JavaScript injection in service label and description
fields, addressing the XSS vulnerability identified in security audit.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants