Repository navigation
Fix security issues - #1378
Fix security issues#1378
Conversation
|
The deployments were removed when this pull request closed. Reopening it deploys again at the same address. |
9a3f820 to
c016525
Compare
c016525 to
658af28
Compare
| referrerUrl = document.referrer ? new URL(document.referrer) : null; | ||
| } catch (e) { | ||
| // Ignore invalid referrer URLs | ||
| referrerUrl = null; |
There was a problem hiding this comment.
Unnecessary since it repeats the default value...
| referrerUrl = document.referrer ? new URL(document.referrer) : null; | ||
| } catch (e) { | ||
| // Ignore invalid referrer URLs | ||
| referrerUrl = null; |
There was a problem hiding this comment.
Unnecessary since it repeats the default value...
| } | ||
|
|
||
| // custom referrer (only for metabase.com) | ||
| var referrerUrl = null; |
There was a problem hiding this comment.
Since everything is named with the Anon suffix, should we have the same for that? Meaning referrerUrlAnon... it might create a "collision" with the other referrerUrl ;)
…or clarity and prevent collision
ef1b3f0 to
231822c
Compare
|
@losrebellos Thanks for the feedback! Addressed the comments in 231822c. |
There was a problem hiding this comment.
🟢 Approval recommended
No unresolved review issues were identified.
0 open findings
What changed in this PR
Fixes security issues in Snowplow referrer handling and GitHub Actions permissions.
Changes:
- Validate referrer URLs using HTTPS and exact hostnames.
- Restrict workflow permissions to least privilege.
| File | Description |
|---|---|
public/docs/js/marketing-snowplow.js |
Secures marketing referrer validation. |
public/docs/js/anonymous-snowplow.js |
Secures anonymous referrer validation. |
.github/workflows/update-version-support.yml |
Limits workflow permissions. |
.github/workflows/test.yml |
Limits test workflow permissions. |
🧠 Review effort: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Fix security issues flagged in https://github.com/metabase/metabase.github.io/pull/6651/checks?check_run_id=113024868999
They're also flagged in this repo: https://github.com/metabase/docs.metabase.github.io/security/code-scanning
Fixing them now so they don't get flagged in the docs->monorepo migration and because they're easy and we should do them anyway.