WAF whitelist XSS_BODY for logo upload #6210
Conversation
| @@ -55,5 +56,5 @@ | |||
| """.strip().split('\n') | |||
|
|
|||
| COMMCAREHQ_XML_QUERYSTRING_URLS_REGEX = """ | |||
There was a problem hiding this comment.
I would suggest fixing the lint error not by escaping the \ within the string, but by making this an r-string (starting with r""") as described here https://docs.python.org/3/library/re.html:
The solution is to use Python’s raw string notation for regular expression patterns; backslashes are not handled in any special way in a string literal prefixed with 'r'. So r"\n" is a two-character string containing '' and 'n', while "\n" is a one-character string containing a newline. Usually patterns will be expressed in Python code using this raw string notation.
That's also how the block of regular expressions above is defined.
|
@akashkj can you update the PR description to include a ticket, list the environments it affects ("saas aws environments"), and remove the section about announcing a new release (since there's no announcement needed with this one because it doesn't affect third parties)? Make sure also to link it to the related PR in commcare-hq. |
|
Besides my two comments, this looks good to me. Ping me when it's ready for re-review |
|
@dannyroberts Other(hq) branch is merged. |
Add WAF rule for project basic settings in which a custom logo is uploaded.
Ticket: https://dimagi-dev.atlassian.net/browse/USH-4025
Commcare-HQ PR: dimagi/commcare-hq#34017
Environments Affected
Production, India and Staging