Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Huurtoeslag #31

Merged
merged 13 commits into from
Feb 24, 2025
Merged

Huurtoeslag #31

merged 13 commits into from
Feb 24, 2025

Conversation

anneschuth
Copy link
Member

No description provided.

anneschuth and others added 7 commits February 24, 2025 13:54
@anneschuth
wip huurtoeslag
4de19e6
@anneschuth
update huurtoeslag
79fe4d8
@anneschuth
update schema
23d329f
@pre-commit-ci
[pre-commit.ci] auto fixes from pre-commit.com hooks
af90f44 
for more information, see https://pre-commit.ci
@anneschuth
Implement huurtoeslag test scenarios
33178e6 
- Added scenario for person under 18 years old (not eligible)
- Added scenario for single person with low income and higher rent
- Added scenario for person with income too high (over €44,000)
- Fixed up YAML file with correct service costs calculation
- Updated template display for required fields

🤖 Generated with Claude Code
Co-Authored-By: Claude <[email protected]>
@anneschuth
Update CLAUDE.md
1baffab
@pre-commit-ci
[pre-commit.ci] auto fixes from pre-commit.com hooks
166a7c9 
for more information, see https://pre-commit.ci
github-advanced-security[bot]
github-advanced-security bot found potential problems Feb 24, 2025
View reviewed changes
web/templates/admin/dashboard.html
<div class="-mt-2 -mr-2">{{ org_logo(current_service) }}</div>
<div class="relative">
<select class="appearance-none bg-white border rounded-md py-2 pl-4 pr-10 font-medium focus:outline-none focus:ring-2 focus:ring-blue-500"
onchange="window.location.href = '/admin/' + this.value">

Check warning

Code scanning / CodeQL

DOM text reinterpreted as HTML Medium

DOM text
Loading
is reinterpreted as HTML without escaping meta-characters.

Copilot Autofix AI 14 days ago

To fix the problem, we need to ensure that the value from the select element is properly encoded or sanitized before being used in the URL. One way to achieve this is by using JavaScript's encodeURIComponent function, which encodes a URI component by replacing each instance of certain characters by one, two, three, or four escape sequences representing the UTF-8 encoding of the character.

  • Modify the onchange event handler to use encodeURIComponent(this.value) instead of directly concatenating this.value.
  • This change ensures that any special characters in this.value are properly encoded, preventing potential XSS attacks.
Suggested changeset 1
web/templates/admin/dashboard.html

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/web/templates/admin/dashboard.html b/web/templates/admin/dashboard.html
--- a/web/templates/admin/dashboard.html
+++ b/web/templates/admin/dashboard.html
@@ -11,3 +11,3 @@
                     <select class="appearance-none bg-white border rounded-md py-2 pl-4 pr-10 font-medium focus:outline-none focus:ring-2 focus:ring-blue-500"
-                            onchange="window.location.href = '/admin/' + this.value">
+                            onchange="window.location.href = '/admin/' + encodeURIComponent(this.value)">
                         {% for service_name in available_services %}
EOF
@@ -11,3 +11,3 @@
<select class="appearance-none bg-white border rounded-md py-2 pl-4 pr-10 font-medium focus:outline-none focus:ring-2 focus:ring-blue-500"
onchange="window.location.href = '/admin/' + this.value">
onchange="window.location.href = '/admin/' + encodeURIComponent(this.value)">
{% for service_name in available_services %}
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
web/templates/base.html
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Burger.nl</title>
<script src="https://cdnjs.cloudflare.com/ajax/libs/htmx/1.9.10/htmx.min.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
web/templates/base.html
Comment on lines +10 to +11
<script defer
src="https://cdnjs.cloudflare.com/ajax/libs/alpinejs/3.13.3/cdn.min.js"></script>

Check warning

Code scanning / CodeQL

Inclusion of functionality from an untrusted source Medium

Script loaded from content delivery network with no integrity check.
web/templates/base.html
<!-- User Switcher -->
<div class="flex items-center space-x-4">
<select class="bg-white text-gray-900 px-4 py-2 rounded w-96"
onchange="window.location.href='/?bsn=' + this.value">

Check warning

Code scanning / CodeQL

DOM text reinterpreted as HTML Medium

DOM text
Loading
is reinterpreted as HTML without escaping meta-characters.

Copilot Autofix AI 14 days ago

To fix the problem, we need to ensure that the value from the select element is properly encoded before being used in the URL. This can be achieved by using JavaScript's encodeURIComponent function, which encodes a URI component by replacing each instance of certain characters by one, two, three, or four escape sequences representing the UTF-8 encoding of the character.

The best way to fix the problem without changing existing functionality is to modify the onchange attribute to use encodeURIComponent(this.value) instead of this.value. This ensures that any special characters in the value are properly escaped, preventing potential XSS attacks.

Suggested changeset 1
web/templates/base.html

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/web/templates/base.html b/web/templates/base.html
--- a/web/templates/base.html
+++ b/web/templates/base.html
@@ -28,3 +28,3 @@
                         <select class="bg-white text-gray-900 px-4 py-2 rounded w-96"
-                                onchange="window.location.href='/?bsn=' + this.value">
+                                onchange="window.location.href='/?bsn=' + encodeURIComponent(this.value)">
                             {% for bsn_key, profile_data in all_profiles.items() %}
EOF
@@ -28,3 +28,3 @@
<select class="bg-white text-gray-900 px-4 py-2 rounded w-96"
onchange="window.location.href='/?bsn=' + this.value">
onchange="window.location.href='/?bsn=' + encodeURIComponent(this.value)">
{% for bsn_key, profile_data in all_profiles.items() %}
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
anneschuth and others added 6 commits February 24, 2025 21:28
@anneschuth
Voeg huurtoeslag UI templates toe en nieuwe test persoon Fatima
8792e7f
@anneschuth
Geef huurtoeslag een eigen indigo kleur in de UI
ef71df4
@pre-commit-ci
[pre-commit.ci] auto fixes from pre-commit.com hooks
fd39ebe 
for more information, see https://pre-commit.ci
@anneschuth
Fix service validation issues by adding missing output fields
b6b1ce8
@pre-commit-ci
[pre-commit.ci] auto fixes from pre-commit.com hooks
833d152 
for more information, see https://pre-commit.ci
@anneschuth
Fix FOREACH operation in engine to handle non-list values
9b95980 
The engine was trying to access operation["value"][0] but when operation["value"] is a dictionary
instead of a list, this caused a KeyError. Now it checks if it's a list first.

🤖 Generated with Claude Code
Co-Authored-By: Claude <[email protected]>
@anneschuth anneschuth merged commit b4f4ac6 into main Feb 24, 2025
6 checks passed
@anneschuth anneschuth deleted the huurtoeslag branch February 24, 2025 21:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@anneschuth