Skip to content

Commit cf02aea

Browse files
sofiaoreissofiaoreis
committed
example showing on the top
1 parent 3878cd2 commit cf02aea

File tree

6 files changed

+334
-318
lines changed

6 files changed

+334
-318
lines changed

‎docs/assets/index-Cz6YfT2b.css renamed to ‎docs/assets/index-BUSHk0wu.css

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/assets/index-BZkNAiJy.js

Lines changed: 254 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/assets/index-sOQLsvks.js

Lines changed: 0 additions & 286 deletions
This file was deleted.

‎docs/index.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@
1313
<meta property="og:type" content="website" />
1414
<meta property="og:image" content="" />
1515

16-
<script type="module" crossorigin src="/assets/index-sOQLsvks.js"></script>
17-
<link rel="stylesheet" crossorigin href="/assets/index-Cz6YfT2b.css">
16+
<script type="module" crossorigin src="/assets/index-BZkNAiJy.js"></script>
17+
<link rel="stylesheet" crossorigin href="/assets/index-BUSHk0wu.css">
1818
</head>
1919

2020
<body>

‎src/components/Hero.tsx

Lines changed: 76 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,60 @@
11
import { Button } from '@/components/ui/button';
2-
import { FiArrowDown, FiGithub } from 'react-icons/fi';
2+
import { FiArrowDown, FiGithub, FiRefreshCw } from 'react-icons/fi';
33
import { Link } from 'react-router-dom';
4+
import { useState } from 'react';
45

56
const Hero = () => {
7+
const [showAfterExample, setShowAfterExample] = useState(true);
8+
9+
const beforeExample = `URL sanitize: reject URLs containing bad data
10+
11+
Protocols (IMAP, POP3 and SMTP) that use the path part of a URL in a
12+
decoded manner now use the new Curl_urldecode() function to reject URLs
13+
with embedded control codes (anything that is or decodes to a byte value
14+
less than 32).
15+
16+
URLs containing such codes could easily otherwise be used to do harm and
17+
allow users to do unintended actions with otherwise innocent tools and
18+
applications. Like for example using a URL like
19+
pop3://pop3.example.com/1%0d%0aDELE%201 when the app wants a URL to get
20+
a mail and instead this would delete one.
21+
22+
This flaw is considered a security vulnerability: CVE-2012-0036
23+
24+
Security advisory at: http://curl.haxx.se/docs/adv_20120124.html
25+
26+
Reported by: Dan Fandrich`;
27+
28+
const beforeExplanation = "Covers the What/Why/How succinctly but lacks SECOM framing: no vuln-fix: header, 75-word tri-section, weakness metadata, or attribution/footer fields. To be fully SECOM-compliant it needs the standardized header, per-weakness block, CVSS/severity, and formal \"Reported-by/Reviewed-by/Signed-off-by\" lines.";
29+
30+
const afterExample = `vuln-fix: Sanitize URLs to reject malicious data (CVE-2012-0036)
31+
32+
libcurl IMAP/POP3/SMTP parsers accepted URL-path bytes that decode
33+
to ASCII control characters, enabling attackers to smuggle extra
34+
protocol commands—e.g. pop3://host/1%0D%0ADELE%201—and perform
35+
unintended mail operations. Any application that forwards
36+
untrusted URLs could thus silently delete or alter messages.
37+
The fix routes path decoding through Curl_urldecode(), which
38+
aborts when a decoded byte < 0x20 and returns CURLE_URL_MALFORMAT,
39+
preventing the crafted request from ever reaching the server.
40+
41+
Weakness: CWE-89
42+
Severity: High
43+
Detection: Manual
44+
Report: https://curl.se/docs/CVE-2012-0036.html
45+
46+
Reported-by: Dan Fandrich
47+
Signed-off-by: Daniel Stenberg ([email protected])
48+
49+
Resolves: #17940
50+
See also: #17937`;
51+
52+
const afterExplanation = "SECOM-compliant commit message. Uses the vuln-fix: header, concise What/Why/How body, and a weakness block with CWE, severity and report link.";
53+
54+
const toggleExample = () => {
55+
setShowAfterExample(!showAfterExample);
56+
};
57+
658
return (
759
<div className="relative pt-16 pb-32 overflow-hidden">
860
<div className="relative">
@@ -38,39 +90,35 @@ const Hero = () => {
3890
{/* Code example */}
3991
<div className="mx-auto max-w-7xl px-6 lg:px-8">
4092
<div className="mx-auto max-w-3xl overflow-hidden rounded-xl bg-gray-900 shadow-md">
41-
<div className="px-4 py-2 bg-gray-800 border-b border-gray-700 flex items-center">
42-
<div className="flex space-x-1.5">
43-
<div className="w-3 h-3 rounded-full bg-red-500"></div>
44-
<div className="w-3 h-3 rounded-full bg-yellow-500"></div>
45-
<div className="w-3 h-3 rounded-full bg-green-500"></div>
93+
<div className="px-4 py-2 bg-gray-800 border-b border-gray-700 flex items-center justify-between">
94+
<div className="flex items-center">
95+
<div className="flex space-x-1.5">
96+
<div className="w-3 h-3 rounded-full bg-red-500"></div>
97+
<div className="w-3 h-3 rounded-full bg-yellow-500"></div>
98+
<div className="w-3 h-3 rounded-full bg-green-500"></div>
99+
</div>
100+
<div className="ml-4 text-gray-200 text-sm">
101+
{showAfterExample ? "SECOM-Compliant" : "Original"} Security Commit Example
102+
</div>
46103
</div>
47-
<div className="ml-4 text-gray-200 text-sm">Security Commit Message Example</div>
104+
<Button
105+
variant="ghost"
106+
size="sm"
107+
className="text-gray-200 hover:text-white hover:bg-gray-700"
108+
onClick={toggleExample}
109+
>
110+
<FiRefreshCw className="mr-1" size={14} />
111+
Show {showAfterExample ? "Original" : "SECOM"}
112+
</Button>
48113
</div>
49114
<pre className="p-4 text-sm text-gray-300 overflow-x-auto bg-gray-900">
50115
<code>
51-
{`vuln-fix: Sanitize URLs to reject malicious data (CVE-2012-0036)
52-
53-
libcurl IMAP/POP3/SMTP parsers accepted URL-path bytes that decode
54-
to ASCII control characters, enabling attackers to smuggle extra
55-
protocol commands—e.g. pop3://host/1%0D%0ADELE%201—and perform
56-
unintended mail operations. Any application that forwards
57-
untrusted URLs could thus silently delete or alter messages.
58-
The fix routes path decoding through Curl_urldecode(), which
59-
aborts when a decoded byte < 0x20 and returns CURLE_URL_MALFORMAT,
60-
preventing the crafted request from ever reaching the server.
61-
62-
Weakness: CWE-89
63-
Severity: High
64-
Detection: Manual
65-
Report: https://curl.se/docs/CVE-2012-0036.html
66-
67-
Reported-by: Dan Fandrich
68-
Signed-off-by: Daniel Stenberg ([email protected])
69-
70-
Resolves: #17940
71-
See also: #17937`}
116+
{showAfterExample ? afterExample : beforeExample}
72117
</code>
73118
</pre>
119+
<div className="p-4 text-sm bg-gray-800 border-t border-gray-700 text-white">
120+
🍵 {showAfterExample ? afterExplanation : beforeExplanation}
121+
</div>
74122
</div>
75123
</div>
76124
</div>

‎src/pages/Index.tsx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ const Index = () => {
1212
<Header />
1313
<Hero />
1414
<About />
15-
<Examples />
15+
{/* <Examples /> */}
1616
{/* <BlogPreview /> */}
1717
<NewsSection />
1818
<Footer />

0 commit comments

Comments
 (0)