Skip to content

Commit

Permalink
Update fetch url variable depending on environment.
Browse files Browse the repository at this point in the history
  • Loading branch information
kevl927-gov committed Apr 26, 2024
1 parent c32f086 commit 5e4a4bd
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions disaggregated-federal-contracting-data/js/main.js
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,11 @@ function buttonAction (event) {

(() => {
const fetchData = async year => {
const url = `https://api.sba.gov/disaggregated-data/fy${year}_data_aggregation.json`
//const url = `data/fy${year}_data_aggregation.json`
const url = window.location.href.indexOf("sba.gov") > -1

Check failure

Code scanning / CodeQL

Incomplete URL substring sanitization High

'
sba.gov
' can be anywhere in the URL, and arbitrary hosts may come before or after it.
? 'https://api.sba.gov/disaggregated-data/fy${year}_data_aggregation.json'
: `${window.location.href.slice(0, window.location.href.lastIndexOf('/'))}/data/fy${year}_data_aggregation.json`

const response = await fetch(url)
const response = await fetch(url)

if (response.ok) {
return await response.json();
Expand Down

0 comments on commit 5e4a4bd

Please sign in to comment.