Dev - #16
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
| } | ||
| } catch (error) { | ||
| console.log(`Error fetching Swedish name for ${nameResult.scientificName}:`, error.message); |
Check failure
Code scanning / CodeQL
Use of externally-controlled format string High
This autofix suggestion was applied.
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
The best fix is to ensure that untrusted data from users is never directly placed in the format string of logging functions such as console.log. Instead, use a constant format string with placeholders (such as %s), and pass the potentially untrusted data as an argument. For the affected code at line 926, this means modifying the call console.log(Error fetching Swedish name for ${nameResult.scientificName}:, error.message); to instead use console.log("Error fetching Swedish name for %s:", nameResult.scientificName, error.message);.
No new imports or significant functional changes are required, as this is only an adjustment to the way logging arguments are constructed.
| @@ -923,7 +923,7 @@ | ||
| } | ||
| } | ||
| } catch (error) { | ||
| console.log(`Error fetching Swedish name for ${nameResult.scientificName}:`, error.message); | ||
| console.log("Error fetching Swedish name for %s:", nameResult.scientificName, error.message); | ||
| } | ||
| } | ||
|
|
WouterKoch
committed this autofix suggestion 8 months ago.
…olled format string Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2 participants
No description provided.