Conversation
Summary of ChangesHello @lingard1234, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! 이 PR은 사용자가 전용 API 엔드포인트를 통해 인스타그램 계정 ID를 업데이트할 수 있는 새로운 기능을 도입합니다. 이는 소셜 미디어 링크를 수정하는 구조화된 방법을 제공하여 사용자 프로필 관리를 개선하고, 데이터 일관성을 보장하며 사용자 경험을 향상시킵니다. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This PR successfully adds a new API endpoint for updating user Instagram account information, with the functionality generally well-implemented. However, a significant security concern exists due to the lack of input validation for the "snsAccount" field. This oversight can lead to potential Stored Cross-Site Scripting (XSS) and Open Redirect vulnerabilities, as unvalidated input is used to construct URLs and is returned in API responses. Implementing strict regex validation at the DTO level is recommended to mitigate these risks.
| @Size(max = 100) | ||
| private String snsAccount; |
There was a problem hiding this comment.
The snsAccount field lacks proper validation, allowing arbitrary strings to be submitted. This can lead to potential Open Redirect and Stored Cross-Site Scripting (XSS) vulnerabilities, as the input is used to construct URLs and is returned in API responses. For example, an attacker could provide a payload like ../../attacker.com to manipulate the constructed URL or "><script>alert(1)</script> to inject malicious scripts. Additionally, Instagram account IDs have a maximum length of 30 characters, so the @Size(max = 100) should be adjusted to 30 to align with this requirement and strengthen data validation.
@Size(max = 30)
@jakarta.validation.constraints.Pattern(regexp = "^[a-zA-Z0-9._]*$", message = "Invalid Instagram handle format")
private String snsAccount;| String cleanAccount = snsAccount.trim().replace("@", ""); | ||
| this.snsUrl = "https://www.instagram.com/" + cleanAccount + "/"; |
There was a problem hiding this comment.
The updateSns method constructs an Instagram URL by simple concatenation with the user-provided snsAccount string. Without strict validation for path traversal characters (e.g., ../), an attacker can manipulate the resulting snsUrl. For example, an input of ../../attacker.com would result in https://www.instagram.com/../../attacker.com/, which resolves to https://attacker.com/. This constitutes an Open Redirect vulnerability if the URL is used in the frontend or an SSRF risk if used server-side.
1 participant
Summary
sns 수정 API 엔드포인트 생성 및 스웨거 정리
Changes
UseService, UserSwagger, MyInstagramUpdateRequestDto
Type of Change
Related Issues
Closes #361
참고 사항