-
Notifications
You must be signed in to change notification settings - Fork 7
Aria label #35
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Aria label #35
Conversation
|
Hi! I'm VTEX IO CI/CD Bot and I'll be helping you to publish your app! 🤖 Please select which version do you want to release:
And then you just need to merge your PR when you are ready! There is no need to create a release commit/tag.
|
|
Beep boop 🤖 I noticed you didn't make any changes at the
In order to keep track, I'll create an issue if you decide now is not a good time
|
|
| "devDependencies": { | ||
| "@apollo/react-testing": "^3.1.4", | ||
| "@vtex/test-tools": "^3.1.0", | ||
| "vtex.css-handles": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.css-handles@1.0.0/public/@types/vtex.css-handles", |
Check failure
Code scanning / CodeQL
Dependency download using unencrypted communication channel High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix the problem, we need to change the protocol from HTTP to HTTPS for all the dependency URLs in the devDependencies section of the package.json file. This ensures that the dependencies are downloaded over a secure communication channel, mitigating the risk of MITM attacks.
- Open the
react/package.jsonfile. - Locate the
devDependenciessection. - Replace the
http://protocol withhttps://for all the URLs listed underdevDependencies.
-
Copy modified lines R13-R16
| @@ -12,6 +12,6 @@ | ||
| "@vtex/test-tools": "^3.1.0", | ||
| "vtex.css-handles": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.css-handles@1.0.0/public/@types/vtex.css-handles", | ||
| "vtex.native-types": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.native-types@0.7.5/public/@types/vtex.native-types", | ||
| "vtex.product-context": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.product-context@0.10.0/public/@types/vtex.product-context", | ||
| "vtex.render-runtime": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.render-runtime@8.132.3/public/@types/vtex.render-runtime" | ||
| "vtex.css-handles": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.css-handles@1.0.0/public/@types/vtex.css-handles", | ||
| "vtex.native-types": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.native-types@0.7.5/public/@types/vtex.native-types", | ||
| "vtex.product-context": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.product-context@0.10.0/public/@types/vtex.product-context", | ||
| "vtex.render-runtime": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.render-runtime@8.132.3/public/@types/vtex.render-runtime" | ||
| }, |
| "@apollo/react-testing": "^3.1.4", | ||
| "@vtex/test-tools": "^3.1.0", | ||
| "vtex.css-handles": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.css-handles@1.0.0/public/@types/vtex.css-handles", | ||
| "vtex.native-types": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.native-types@0.7.5/public/@types/vtex.native-types", |
Check failure
Code scanning / CodeQL
Dependency download using unencrypted communication channel High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
The best way to fix the problem is to change the protocol from HTTP to HTTPS for all the dependency URLs. HTTPS encrypts the data being transmitted, protecting it from MITM attacks and ensuring the integrity and authenticity of the downloaded dependencies.
To implement this fix, we need to update the URLs in the devDependencies section of the react/package.json file. Specifically, we will change the protocol from http to https for the following dependencies:
vtex.css-handlesvtex.native-typesvtex.product-contextvtex.render-runtime
-
Copy modified lines R13-R16
| @@ -12,6 +12,6 @@ | ||
| "@vtex/test-tools": "^3.1.0", | ||
| "vtex.css-handles": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.css-handles@1.0.0/public/@types/vtex.css-handles", | ||
| "vtex.native-types": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.native-types@0.7.5/public/@types/vtex.native-types", | ||
| "vtex.product-context": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.product-context@0.10.0/public/@types/vtex.product-context", | ||
| "vtex.render-runtime": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.render-runtime@8.132.3/public/@types/vtex.render-runtime" | ||
| "vtex.css-handles": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.css-handles@1.0.0/public/@types/vtex.css-handles", | ||
| "vtex.native-types": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.native-types@0.7.5/public/@types/vtex.native-types", | ||
| "vtex.product-context": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.product-context@0.10.0/public/@types/vtex.product-context", | ||
| "vtex.render-runtime": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.render-runtime@8.132.3/public/@types/vtex.render-runtime" | ||
| }, |
| "@vtex/test-tools": "^3.1.0", | ||
| "vtex.css-handles": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.css-handles@1.0.0/public/@types/vtex.css-handles", | ||
| "vtex.native-types": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.native-types@0.7.5/public/@types/vtex.native-types", | ||
| "vtex.product-context": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.product-context@0.10.0/public/@types/vtex.product-context", |
Check failure
Code scanning / CodeQL
Dependency download using unencrypted communication channel High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix the problem, we need to change the protocol from HTTP to HTTPS for all the dependencies listed in the devDependencies section of the react/package.json file. This ensures that the dependencies are downloaded over a secure communication channel, mitigating the risk of MITM attacks.
- Locate the
react/package.jsonfile. - Identify all the dependencies that are being downloaded using the HTTP protocol.
- Change the protocol from HTTP to HTTPS for each of these dependencies.
-
Copy modified lines R13-R16
| @@ -12,6 +12,6 @@ | ||
| "@vtex/test-tools": "^3.1.0", | ||
| "vtex.css-handles": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.css-handles@1.0.0/public/@types/vtex.css-handles", | ||
| "vtex.native-types": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.native-types@0.7.5/public/@types/vtex.native-types", | ||
| "vtex.product-context": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.product-context@0.10.0/public/@types/vtex.product-context", | ||
| "vtex.render-runtime": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.render-runtime@8.132.3/public/@types/vtex.render-runtime" | ||
| "vtex.css-handles": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.css-handles@1.0.0/public/@types/vtex.css-handles", | ||
| "vtex.native-types": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.native-types@0.7.5/public/@types/vtex.native-types", | ||
| "vtex.product-context": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.product-context@0.10.0/public/@types/vtex.product-context", | ||
| "vtex.render-runtime": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.render-runtime@8.132.3/public/@types/vtex.render-runtime" | ||
| }, |
| "vtex.css-handles": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.css-handles@1.0.0/public/@types/vtex.css-handles", | ||
| "vtex.native-types": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.native-types@0.7.5/public/@types/vtex.native-types", | ||
| "vtex.product-context": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.product-context@0.10.0/public/@types/vtex.product-context", | ||
| "vtex.render-runtime": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.render-runtime@8.132.3/public/@types/vtex.render-runtime" |
Check failure
Code scanning / CodeQL
Dependency download using unencrypted communication channel High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
The best way to fix the problem is to change the protocol from HTTP to HTTPS for all the dependency URLs in the package.json file. This ensures that the dependencies are downloaded over a secure communication channel, protecting against potential MITM attacks.
To implement the changes:
- Locate the
package.jsonfile in thereactdirectory. - Update the URLs for the dependencies
vtex.css-handles,vtex.native-types,vtex.product-context, andvtex.render-runtimeto use the HTTPS protocol instead of HTTP.
-
Copy modified lines R13-R16
| @@ -12,6 +12,6 @@ | ||
| "@vtex/test-tools": "^3.1.0", | ||
| "vtex.css-handles": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.css-handles@1.0.0/public/@types/vtex.css-handles", | ||
| "vtex.native-types": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.native-types@0.7.5/public/@types/vtex.native-types", | ||
| "vtex.product-context": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.product-context@0.10.0/public/@types/vtex.product-context", | ||
| "vtex.render-runtime": "http://vtex.vtexassets.com/_v/public/typings/v1/vtex.render-runtime@8.132.3/public/@types/vtex.render-runtime" | ||
| "vtex.css-handles": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.css-handles@1.0.0/public/@types/vtex.css-handles", | ||
| "vtex.native-types": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.native-types@0.7.5/public/@types/vtex.native-types", | ||
| "vtex.product-context": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.product-context@0.10.0/public/@types/vtex.product-context", | ||
| "vtex.render-runtime": "https://vtex.vtexassets.com/_v/public/typings/v1/vtex.render-runtime@8.132.3/public/@types/vtex.render-runtime" | ||
| }, |
What problem is this solving?
ADA compliance for missing aria-label
How to test it?
With the theme linked see if the Container has an aria-label
Workspace