darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-19 05:59:44 -04:00
Code Issues Packages Projects Releases Wiki Activity

Consolidating code ql findings (#2920)

Browse Source 
* Consolidating code ql findings

* Added ref files for backstop to set baseline for removing custom js file

* Potential fix for code scanning alert no. 32: URL redirection from remote source

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Removed unused large file

* Fixed import order

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This commit is contained in:
Alex Janousek
2025-09-18 16:42:39 -04:00
committed by GitHub
parent 34d6c827c2
commit 8057c7f8dc
42 changed files with 60 additions and 7100 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
app/main/views/organizations.py
View File

@@ -90,7 +90,12 @@ def organization_dashboard(org_id):
@main.route("/organizations/<uuid:org_id>/download-usage-report.csv", methods=["GET"])
@user_has_permissions()
def download_organization_usage_report(org_id):
selected_year = request.args.get("selected_year")
selected_year_input = request.args.get("selected_year")
# Validate selected_year to prevent header injection
if selected_year_input and selected_year_input.isdigit() and len(selected_year_input) == 4:
selected_year = selected_year_input
else:
selected_year = str(datetime.now().year)
services_usage = current_organization.services_and_usage(
financial_year=selected_year
)["services"]
@@ -121,6 +126,11 @@ def download_organization_usage_report(org_id):
for service in services_usage
]
# Sanitize organization name for filename to prevent header injection
import re
safe_org_name = re.sub(r'[^\w\s-]', '', current_organization.name).strip()
safe_org_name = re.sub(r'[-\s]+', '-', safe_org_name)
return (
Spreadsheet.from_rows(org_usage_data).as_csv_data,
200,
@@ -130,7 +140,7 @@ def download_organization_usage_report(org_id):
"inline;"
'filename="{} organization usage report for year {}'
' - generated on {}.csv"'.format(
current_organization.name,
safe_org_name,
selected_year,
datetime.now().strftime("%Y-%m-%dT%H:%M:%S.%fZ"),
)