fix(component): sanitized and encoded config request parameters in `post-internet-header` to prevent injection #5281

alionazherdetska · 2025-04-14T19:58:23Z

📄 Description

Addressed a potential injection vulnerability in the Internet Header's config.json request mechanism by validating and encoding the input parameters (projectId, environment, and version).

📝 Checklist

✅ My code follows the style guidelines of this project
🛠️ I have performed a self-review of my own code
📄 I have made corresponding changes to the documentation
⚠️ My changes generate no new warnings or errors
🧪 I have added tests that prove my fix is effective or that my feature works
✔️ New and existing unit tests pass locally with my changes

changeset-bot · 2025-04-14T19:58:27Z

⚠️ No Changeset found

Latest commit: b918701

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

swisspost-bot · 2025-04-14T19:58:38Z

Related Previews

https://preview-5281--swisspost-design-system.netlify.app

gfellerph

Please add a test case where a "malicious" or invalid payload is trying to modify the URL of the config request where we can see that these changes are preventing the malicious request from being sent. I think it will be valuable in the future to understand the methods used to manipulate the config requests so we can react to them not only in the header, but in other places where we send requests based on properties on a web component.

packages/internet-header/src/components/post-internet-header/post-internet-header.tsx

sonarqubecloud · 2025-06-02T17:18:56Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

packages/internet-header/src/components/post-internet-header/post-internet-header.tsx

sonarqubecloud · 2025-07-15T12:04:07Z

Quality Gate failed

Failed conditions
2 Security Hotspots

See analysis details on SonarQube Cloud

alizedebray · 2025-07-17T14:03:52Z

packages/internet-header/src/components/post-internet-header/post-internet-header.tsx

+    if (!this.isValidEnvironment(this.environment)) {
+      throw new Error(
+        `Internet Header environment "${this.environment}" is not valid. Please use one of: ${PostInternetHeader.VALID_ENVIRONMENTS.join(', ')}`
+      );
+    }


If you give a default value to the parameter of the handleEnvironmentChange function like so:

handleEnvironmentChange(newValue = this.environment) {

You can completely reuse it in the componentWillLoad, intead of duplicating the error message:

Suggested change

if (!this.isValidEnvironment(this.environment)) {

throw new Error(

`Internet Header environment "${this.environment}" is not valid. Please use one of: ${PostInternetHeader.VALID_ENVIRONMENTS.join(', ')}`

);

}

this.handleEnvironmentChange();

It's usually how we do it in our components, here the example of the post-banner:
https://github.com/swisspost/design-system/blob/main/packages/components/src/components/post-banner/post-banner.tsx#L87

gfellerph

@alionazherdetska I think we need to quickly sync on this PR. Generally, it might be easier to validate the params just before sending the request and not in the whole lifecycle.

gfellerph · 2025-04-29T08:29:22Z

packages/internet-header/cypress/e2e/header.cy.ts

Solid suite of tests!

gfellerph · 2025-06-10T15:04:15Z

packages/internet-header/src/components/post-internet-header/post-internet-header.tsx

    const renderLanguageSwitch = config.header.navLang.length > 1;

    const initialLogoScale = renderMetaNavigation ? getLogoScale(this.host) : '1';
+    const safeVersion = this.isValidVersion(packageJson.version) ? packageJson.version : 'unknown';


I don't think this check is effective here. The packageJson.version imported from the actual package.json file cannot be manipulated. I think the issue here is, that after the initial render with the correct version, the version is tampered with and when analytics grabs the value, it grabs the tampered value. Not really an issue for us after all and certainly not something we could fix. Should we revert the changes here to keep code simpler?

gfellerph · 2025-06-10T15:08:30Z

packages/internet-header/src/components/post-internet-header/post-internet-header.tsx

+  constructor() {}
+


Empty constructors are not necessary. Please remove this.

Suggested change

constructor() {}

gfellerph · 2025-06-10T15:10:21Z

packages/internet-header/src/components/post-internet-header/post-internet-header.tsx

+  @Watch('project')
+  handleProjectChange(newValue: string) {
+    if (!isValidProjectId(newValue)) {
+      throw new Error(
+        `Internet Header project key is invalid. Please provide a valid project key.`
+      );
+    }
+  }


A project change requires a page reload (and is not a real scenario, since one project only ever has one project id). Throwing an error here might suggest that changing project id on the fly is supported. I'd remove this check.

gfellerph · 2025-06-10T15:10:56Z

packages/internet-header/src/components/post-internet-header/post-internet-header.tsx

+  private isValidVersion(str: string): boolean {
+    if (typeof str !== 'string') return false;
+    return /^[a-z0-9.-]+$/.test(str);
+  }


Possibly not needed since we can't really validate the version at the right time.

alionazherdetska requested a review from a team as a code owner April 14, 2025 19:58

alionazherdetska requested a review from gfellerph April 14, 2025 19:58

alionazherdetska changed the title ~~fix(component): sanitized and encoded config request parameters in post-internet-header to prevent malicious injection~~ fix(component): sanitized and encoded config request parameters in post-internet-header to prevent injection Apr 15, 2025

gfellerph requested changes Apr 23, 2025

View reviewed changes

packages/internet-header/src/components/post-internet-header/post-internet-header.tsx Outdated Show resolved Hide resolved

alionazherdetska requested a review from gfellerph April 25, 2025 09:49

This was linked to issues May 10, 2025

Fix codeql findings #5191

Closed

Escape query string params before calling config #4968

Open

alionazherdetska removed a link to an issue May 10, 2025

Fix codeql findings #5191

Closed

alizedebray force-pushed the release/v8 branch from 57e5afe to be33f10 Compare May 22, 2025 07:44

alionazherdetska force-pushed the 4970-escape-query-string-params-before-calling-config branch from 6f15fce to 195eda6 Compare June 2, 2025 17:16

alizedebray self-requested a review July 3, 2025 06:58

alizedebray requested changes Jul 14, 2025

View reviewed changes

alionazherdetska force-pushed the 4970-escape-query-string-params-before-calling-config branch from f6d651a to fc3cf7a Compare July 15, 2025 06:43

alionazherdetska changed the base branch from release/v8 to release/v9 July 15, 2025 06:52

alionazherdetska changed the base branch from release/v9 to release/v8 July 15, 2025 06:54

alionazherdetska changed the base branch from release/v8 to release/v9 July 15, 2025 06:55

alionazherdetska force-pushed the 4970-escape-query-string-params-before-calling-config branch from fc3cf7a to 9687493 Compare July 15, 2025 06:56

alionazherdetska closed this Jul 15, 2025

alionazherdetska force-pushed the 4970-escape-query-string-params-before-calling-config branch from 9687493 to caeba55 Compare July 15, 2025 06:58

added tests for internet-header

bf802de

alionazherdetska reopened this Jul 15, 2025

reverted changes

2e889b5

alionazherdetska requested a review from alizedebray July 15, 2025 08:10

alionazherdetska marked this pull request as draft July 15, 2025 08:42

alionazherdetska force-pushed the 4970-escape-query-string-params-before-calling-config branch 3 times, most recently from a18dfd5 to 2e889b5 Compare July 15, 2025 11:24

alionazherdetska added 2 commits July 15, 2025 13:44

refactored the header

9d72e1d

removed redundant code

b918701

alionazherdetska marked this pull request as ready for review July 15, 2025 12:02

alizedebray requested changes Jul 17, 2025

View reviewed changes

gfellerph requested changes Jul 21, 2025

View reviewed changes

oliverschuerch force-pushed the release/v9 branch 4 times, most recently from 43820ed to 34664c7 Compare October 22, 2025 14:14

fix(component): sanitized and encoded config request parameters in post-internet-header to prevent injection #5281

Are you sure you want to change the base?

fix(component): sanitized and encoded config request parameters in post-internet-header to prevent injection #5281

Uh oh!

Conversation

alionazherdetska commented Apr 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📄 Description

📝 Checklist

Uh oh!

changeset-bot bot commented Apr 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

swisspost-bot commented Apr 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gfellerph left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud bot commented Jun 2, 2025

Quality Gate passed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Jul 15, 2025

Quality Gate failed

Uh oh!

alizedebray Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

gfellerph left a comment

Choose a reason for hiding this comment

Uh oh!

gfellerph Apr 29, 2025

Choose a reason for hiding this comment

Uh oh!

gfellerph Jun 10, 2025

Choose a reason for hiding this comment

Uh oh!

gfellerph Jun 10, 2025

Choose a reason for hiding this comment

Uh oh!

gfellerph Jun 10, 2025

Choose a reason for hiding this comment

Uh oh!

gfellerph Jun 10, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

fix(component): sanitized and encoded config request parameters in `post-internet-header` to prevent injection #5281

fix(component): sanitized and encoded config request parameters in `post-internet-header` to prevent injection #5281

alionazherdetska commented Apr 14, 2025 •

edited

Loading

changeset-bot bot commented Apr 14, 2025 •

edited

Loading

swisspost-bot commented Apr 14, 2025 •

edited

Loading