-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Refactor: Schedule 도메인의 반복 일정과 관련된 필드값을 Embedded로 분리 #70
Conversation
기존에 Calendar에 있던 내용을 Schedule패키지를 새로 만들어서 분리
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Schedule과 Repetition을 객체지향으로 분리해서 반복 속성을 따로 관리하기에 더 편해진 것 같네요 b!
originalImagePath.toAbsolutePath().toString(), | ||
"-quality", "50", | ||
avifImagePath.toAbsolutePath().toString() | ||
"convert", |
Check failure
Code scanning / CodeQL
Uncontrolled command line Critical
user-provided value
This command line depends on a
user-provided value
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the problem, we need to ensure that the file paths derived from user input are properly validated and sanitized before being used in the ProcessBuilder
. This can be achieved by checking that the file paths do not contain any malicious characters or sequences that could lead to command injection. Additionally, we can use a whitelist approach to ensure that only valid file extensions are allowed.
The best way to fix the problem without changing existing functionality is to add a method that validates the file paths and call this method before constructing the ProcessBuilder
. This method should check for any invalid characters and ensure that the file paths are within the expected directory.
-
Copy modified lines R69-R70 -
Copy modified lines R88-R94
@@ -68,2 +68,4 @@ | ||
private void imageConvertProcess(Path originalImagePath, Path avifImagePath) { | ||
validateFilePath(originalImagePath); | ||
validateFilePath(avifImagePath); | ||
ProcessBuilder processBuilder = new ProcessBuilder( | ||
@@ -85,2 +87,9 @@ | ||
} | ||
} | ||
|
||
private void validateFilePath(Path filePath) { | ||
String pathString = filePath.toString(); | ||
if (pathString.contains("..") || pathString.contains(";") || pathString.contains("&")) { | ||
throw new ImageException(ImageErrorCode.INVALID_FILE_PATH); | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM !
📑 개요
✅ PR 체크리스트
🚀 상세 작업 내용
기존에 같이 있던
Calendar
와Schedule
를 분리하였습니다.📁 ETC
현재 진행중인 이슈와 충돌 가능성이 매우 큽니다. 그러므로 @jiwon83 께서 확인해주시고, 진행중인 이슈 완료시 해당 PR을 머지하는 방식으로 해야할 것 같습니다.
close: #56