Potential fix for code scanning alert no. 3: Reflected server-side cross-site scripting

[gmorador-tribu]

Potential fix for https://github.com/hypothesis/bouncer/security/code-scanning/3

To fix this without changing behavior, normalize/encode group before inserting it into fragment, the same way q is handled. The best minimal fix is to percent-encode group using urllib.parse.quote(..., safe="") when reading it from request.params. This preserves intended semantics (group still passed in fragment) while preventing injection payloads from being reflected as active markup/script.

In bouncer/views.py, inside goto_url:

• Change the group assignment (currently raw request.params.get("group", "")) to a quoted value.
• Keep existing logic unchanged otherwise.

No new imports are required because parse is already imported from urllib.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses code scanning alert #3 (reflected server-side XSS) by ensuring the group query parameter is percent-encoded before being embedded into the client URL fragment generated by goto_url.

Changes:

• Percent-encode the group request parameter using urllib.parse.quote(..., safe="") before inserting it into the URL fragment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gmorador-tribu]

@copilot also add the unit test for edge cases

[Copilot]

Added three edge case tests in commit c3f146a:

• test_it_percent_encodes_group_with_special_characters: verifies a <script>alert("xss")</script> payload is fully encoded and raw < never appears in the output URLs
• test_it_percent_encodes_group_with_angle_brackets_and_quotes: verifies <"group"> → %3C%22group%22%3E
• test_it_percent_encodes_group_with_ampersand_and_equals: verifies group&id=1 → group%26id%3D1

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /usr/bin/python3 python3 -m pytest tests/unit/bouncer/views_test.py -x -q (dns block)
• www.example.com
  • Triggering command: /usr/bin/python3 python3 -m pytest tests/unit/bouncer/views_test.py -x -q (dns block)
• www.youtube.com
  • Triggering command: /usr/bin/python3 python3 -m pytest tests/unit/bouncer/views_test.py -x -q (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)