-
Notifications
You must be signed in to change notification settings - Fork 194
Inference documentation improvements #1421
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
I like the changes so far, @capjamesg lmk when done |
|
||
// Skip links that start with the excluded domains | ||
if ( | ||
!href.startsWith('https://inference.roboflow.com') && |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
https://inference.roboflow.com
// Skip links that start with the excluded domains | ||
if ( | ||
!href.startsWith('https://inference.roboflow.com') && | ||
!href.startsWith('http://inference.roboflow.com') && |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High
http://inference.roboflow.com
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 1 day ago
To fix the issue, we need to parse the URL and validate its host explicitly. Instead of using startsWith
, we should use the URL
constructor to extract the host of the URL and compare it against a whitelist of allowed hosts. This ensures that only the exact domains or subdomains we intend to allow are matched.
Steps to fix:
- Replace the
startsWith
checks with a single check that parses the URL using theURL
constructor. - Compare the parsed host against a whitelist of allowed hosts.
- Ensure that the logic handles invalid URLs gracefully by wrapping the parsing in a
try-catch
block.
-
Copy modified lines R137-R149
@@ -136,6 +136,15 @@ | ||
if ( | ||
!href.startsWith('https://inference.roboflow.com') && | ||
!href.startsWith('http://inference.roboflow.com') && | ||
!href.startsWith('http://127.0.0.1') && | ||
!href.startsWith('https://127.0.0.1') | ||
(() => { | ||
try { | ||
const url = new URL(href); | ||
const allowedHosts = [ | ||
'inference.roboflow.com', | ||
'127.0.0.1' | ||
]; | ||
return !allowedHosts.includes(url.host); | ||
} catch (e) { | ||
// If the URL is invalid, treat it as not allowed | ||
return true; | ||
} | ||
})() | ||
) { |
Description
This PR contains several improvements to the Inference documentation.
The philosophy for this change maps to our strategy to be Workflows-first. Running a model should be a one-block Workflow. Users should be able to build complex, multi-stage Workflows as easily as possible.
The following changes have been made:
Type of change
How has this change been tested, please provide a testcase or example of how you tested the change?
This change can be tested by running
mkdocs serve
and clicking around.Any specific deployment considerations
We need to set a
GHOST_API_KEY
constant in our Actions secrets so the docs build can pull the latest posts from the Roboflow blog that have been marked as tutorials.Docs
N/A