Bugfix: Use of Kernel.open or IO.read or similar sinks with a non…

[arpitjain099]

There is a code improvement related to report_generators/base_consumer.py file. S

anitizing untrusted URLs is a common technique for preventing attacks such as request forgeries and malicious redirections. Usually, this is done by checking that the host of a URL is in a set of allowed hosts.

These improvements are coming from GitHub code scanning (CodeQL advisory). Please see screenshot attached below when implementing these advisories, the code scanning bugs are resolved. Please note that this is a code improvement and not a security finding. This change helps improve code security posture.

@benbalter please review this PR if/when you can. I understand that this project has not been maintained over the years so this supply chain risk still exists (this project being used in other maybe mission critical projects). I understand that you now work with GitHub -- these risks are pointed by GitHub codeql code scanning feature.

cc: @greggersh (I saw your name in project contributor list, apologies for the cold outreach).

[benbalter]

Thanks @arpitjain099. Tagging in @gbinal who may be able to merge this.

[arpitjain099]

Bumping this PR up so it can be reviewed again (apologies for the spam) @gbinal
cc: @benbalter

[arpitjain099]

Please merge this PR as it's already approved @benbalter
Thank you.

[arpitjain099]

Coming back around on this - PR is still approved and green. @benbalter or anyone else, happy to rebase if anything else is needed before merge. Thanks!