From 9d33ff104aafcdb2cf0e9a7f52926f5ed564c99f Mon Sep 17 00:00:00 2001
From: Sergio Garcia <hello@mistercloudsec.com>
Date: Fri, 1 Aug 2025 19:29:47 +0800
Subject: [PATCH] Potential fix for code scanning alert no. 55: Server-side
 request forgery

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 ui/actions/scans/scans.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ui/actions/scans/scans.ts b/ui/actions/scans/scans.ts
index 80505b3ca1..d6c996fee0 100644
--- a/ui/actions/scans/scans.ts
+++ b/ui/actions/scans/scans.ts
@@ -278,6 +278,13 @@ export const getComplianceCsv = async (
   scanId: string,
   complianceId: string,
 ) => {
+  // Only allow alphanumeric, dash, and underscore for IDs
+  const idPattern = /^[a-zA-Z0-9_-]+$/;
+  if (!idPattern.test(scanId) || !idPattern.test(complianceId)) {
+    return {
+      error: "Invalid scan or compliance ID format.",
+    };
+  }
   const headers = await getAuthHeaders({ contentType: false });
 
   const url = new URL(