Skip to content

Conversation

@jbms
Copy link
Collaborator

@jbms jbms commented Jan 17, 2025

Comment on lines +42 to +50
res.send(`
<html>
<body>
<script>
window.opener.postMessage(${jsonToken}, ${jsonOrigin});
</script>
</body>
</html>
`);

Check failure

Code scanning / CodeQL

Reflected cross-site scripting High

Cross-site scripting vulnerability due to a
user-provided value
.
const cookies = cookie.parse(req.headers.cookie ?? "");
const origin = req.headers.origin ?? "";
res.set("x-frame-options", "deny");
res.set("access-control-allow-origin", origin);

Check failure

Code scanning / CodeQL

CORS misconfiguration for credentials transfer High

Credential
leak vulnerability due to a
misconfigured CORS header value
.
@jbms jbms force-pushed the kvstore-refactor branch 12 times, most recently from 366d41a to f5e932b Compare January 19, 2025 04:34
- New datasource URL syntax based on ZEP 8
proposal (zarr-developers/zeps#48)
- Support for ZIP archives
@jbms jbms force-pushed the kvstore-refactor branch from f5e932b to 5fef01c Compare January 19, 2025 04:44
@jbms jbms merged commit 9d3a618 into master Jan 19, 2025
25 of 26 checks passed
@jbms jbms deleted the kvstore-refactor branch January 19, 2025 04:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant