DOI / Update DOI widget in editor #8468
Conversation
* DOI server can be retrieved by editor by id or uuid * Updating a DOI is only allowed when a server is configured for the DOI prefix * DOI server list is disabled in update mode
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -85,24 +108,55 @@ | |||
| * the metadata is published. | |||
| * | |||
| */ | |||
| function canPublishDoiForResource(md, resource) { | |||
| function canPublishDoiForResource(md, doiUrl) { | |||
| if (doiUrl == null || doiUrl.indexOf("doi.org/") === -1) { | |||
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the problem, we need to ensure that the URL is parsed and the host is explicitly checked against a whitelist of allowed hosts. This will prevent attackers from embedding "doi.org/" in unexpected parts of the URL. We will use the URL constructor available in modern JavaScript to parse the URL and then check the host.
- Parse the
doiUrlusing theURLconstructor. - Extract the host from the parsed URL.
- Check if the host matches the expected "doi.org" or any allowed subdomains.
| @@ -111,3 +111,12 @@ | ||
| function canPublishDoiForResource(md, doiUrl) { | ||
| if (doiUrl == null || doiUrl.indexOf("doi.org/") === -1) { | ||
| if (doiUrl == null) { | ||
| return false; | ||
| } | ||
| try { | ||
| var parsedUrl = new URL(doiUrl); | ||
| var host = parsedUrl.host; | ||
| if (host !== "doi.org" && !host.endsWith(".doi.org")) { | ||
| return false; | ||
| } | ||
| } catch (e) { | ||
| return false; |
| !isMdWorkflowEnableForMetadata | ||
| ); | ||
| } | ||
|
|
||
| function checkDoiManagementForResource(md, resource) { | ||
| if (resource.locUrl == null || resource.locUrl.indexOf("doi.org/") === -1) { |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
|
|
|
Follow up of #8098
Checklist
mainbranch, backports managed with labelREADME.mdfilespom.xmldependency management. Update build documentation with intended library use and library tutorials or documentationFunded by Ifremer