Security vulnerabilities and automated fixes for github api issues
3 posts found
A critical Cross-Site Scripting (XSS) vulnerability was discovered in `js/main.js` where commit messages fetched from the GitHub API were directly interpolated into `innerHTML` without any sanitization. An attacker with repository write access could push a commit with a malicious message like `<img src=x onerror=alert(document.cookie)>`, causing arbitrary JavaScript execution in every visitor's browser. The fix applies HTML entity encoding to all five dangerous characters before rendering.
A critical credential exposure vulnerability was discovered in `cli/src/utils/github.ts`, where three GitHub API fetch calls were made without any safe token-loading mechanism, risking accidental hardcoding or token leakage in logs and CI/CD pipelines. The fix introduces a centralized `getAuthHeaders()` function that reads the token exclusively from the `GITHUB_TOKEN` environment variable and safely injects it into all outbound API requests. This ensures credentials never touch source code, buil
A critical vulnerability in an application using @octokit packages left GitHub API tokens vulnerable to exposure through hardcoding, version control commits, and insecure configuration management. This security flaw could allow attackers to gain unauthorized access to GitHub repositories and organizational resources. Learn how proper secrets management prevents token leakage and protects your GitHub integrations.