refactor(go-website): Implement auth & triage page - #5842
Conversation
|
@jess-lowe can you make sure the Go triage tool still does what you need it to do |
e21bbba to
2401578
Compare
jess-lowe
left a comment
jess-lowe
left a comment
There was a problem hiding this comment.
still does the thing 👍🏻
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
2401578 to
131b399
Compare
2c30b3d to
59d22c1
Compare
59d22c1 to
c481c2c
Compare
| secretKey := os.Getenv("SESSION_SECRET_KEY") | ||
| if secretKey == "" { | ||
| secretKey = os.Getenv("FLASK_SECRET_KEY") | ||
| } | ||
| if secretKey == "" { | ||
| secretKey = os.Getenv("SECRET_KEY") | ||
| } | ||
|
|
There was a problem hiding this comment.
Can we log a warning if secretkey is not set? Also, what situation would we not have a secret key? Just local dev?
There was a problem hiding this comment.
Made a warning. I'm pretty sure prod doesn't set this either.
| case "nvd": | ||
| url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=" + cveID | ||
| default: | ||
| return nil, fmt.Errorf("invalid source: %s", source) |
There was a problem hiding this comment.
If source is invalid, it should be models.ErrNotFound right?
There was a problem hiding this comment.
Made a ErrInvalidArgument for this, which feels more correct for an invalid source.
| return nil, fmt.Errorf("external API returned status %d", resp.StatusCode) | ||
| } | ||
|
|
||
| return io.ReadAll(resp.Body) |
There was a problem hiding this comment.
Maybe add a limit reader here incase nvd responds with an dos attack.
There was a problem hiding this comment.
Added a 10MB limit in case the Nefarious Vulnerability Database decides to attack us
c481c2c to
9cb2f57
Compare
9cb2f57 to
c5316a3
Compare
4 participants
Implemented the google login page & cookies & connections needed for the triage page.
Auth stuff implements AES-256-GCM (instead of Flask's unencrypted signed cookies) to store the auth session client-side. I was thinking of using scs, but that is server side (would need to connect to redis), and I'd rather keep it similar to Flask's client-side stuff.
Stack created with GitHub Stacks CLI • Give Feedback 💬