Skip to content

Secondary Response error parsing code violates Code QL rules #345

@akafredperry

Description

@akafredperry

Describe the bug

    public void setRawErrorResponse(String s) {
      // In format "AT1234-meaning of error code : <any other text>"
      rawErrorResponse = s;
      rawDataResponse = null;

      String errorCodeSegment = rawErrorResponse.substring(0, rawErrorResponse.indexOf(":")).trim();
      String[] separatedByHyphen = errorCodeSegment.split("-");
      errorCode = separatedByHyphen[0].trim();

      errorText = rawErrorResponse.replaceFirst(errorCodeSegment + ":", "").trim();
    }

This method breaks the CodeQL rules for regex injection.

The solution is to replace this method implementation, the current solution is complicated and unreadable, can be achieved with single Pattern/Matcher

Steps to reproduce

Run CodeQL workflow action

Expected behavior

CodeQL workflow action passes

Screenshots

No response

Smartphones

  • Device: [e.g. iPhone6]
  • OS: [e.g. iOS8.1]
  • Browser [e.g. stock browser, safari]
  • Version [e.g. 22]

Were you using an atApplication when the bug was found?

No response

Additional context

No response

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions