Bump loader-utils from 1.4.0 to 1.4.2 in /research-hub-web by dependabot[bot] · Pull Request #362 · UoA-eResearch/hub-stack

dependabot · 2022-11-29T00:48:36Z

Bumps loader-utils from 1.4.0 to 1.4.2.

Release notes

v1.4.2

1.4.2 (2022-11-11)

Bug Fixes

ReDoS problem (#226) (17cbf8f)

v1.4.1

1.4.1 (2022-11-07)

Bug Fixes

security problem (#220) (4504e34)

Changelog

Sourced from loader-utils's changelog.

1.4.2 (2022-11-11)

Bug Fixes

ReDoS problem (#226) (17cbf8f)

1.4.1 (2022-11-07)

Bug Fixes

security problem (#220) (4504e34)

Commits

331ad50 chore(release): 1.4.2
17cbf8f fix: ReDoS problem (#226)
8f082b3 chore(release): 1.4.1
4504e34 fix: security problem (#220)
See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [cypress-commands](https://github.com/Lakitna/cypress-commands) from 1.1.0 to 2.0.1. - [Release notes](https://github.com/Lakitna/cypress-commands/releases) - [Changelog](https://github.com/Lakitna/cypress-commands/blob/develop/CHANGELOG.md) - [Commits](Lakitna/cypress-commands@1.1.0...2.0.1) --- updated-dependencies: - dependency-name: cypress-commands dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

* generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * article simplification * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * case-studys page refactor * fixed width cards, minor article change * changed equipment page * changes to events * changed fundings page * changes to service page * changes to software page * changes to subhubs and standard card * set image height * removed app-cards from featured component * removed old cards components * fixed featured layout * better spacing on featured component * fixed lock icon size * fixed article layout * fixed mobile card width * fixed clickable cards * generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * article simplification * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * case-studys page refactor * fixed width cards, minor article change * changed equipment page * changes to events * changed fundings page * changes to service page * changes to software page * changes to subhubs and standard card * set image height * removed app-cards from featured component * removed old cards components * fixed featured layout * better spacing on featured component * fixed lock icon size * fixed article layout * fixed mobile card width * fixed clickable cards * generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * article simplification * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * case-studys page refactor * fixed width cards, minor article change * changed equipment page * changes to events * changed fundings page * changes to service page * changes to software page * changes to subhubs and standard card * set image height * removed app-cards from featured component * removed old cards components * fixed featured layout * better spacing on featured component * fixed lock icon size * fixed article layout * fixed mobile card width * fixed clickable cards * generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * fixed width cards, minor article change * fixed clickable cards * minor fixes * article layout fixes * fixes for case studies layout * more layout fixes * fixed unit tests * fix for equipment table * upgraded e2e test with cypress types, fixed e2e tests * fixed inconsistent bottom margin * mat-icon white on subhub child card * added missing case study references * fixed 3 column layout being too narrow * fixed you-might-be-interested-in id * fixed featured layout * fixed missing funding purpose * fixed body media error * fix nulls error on subhub pages * fixed title underline * Revert "fixed title underline" This reverts commit d92ba98. * fixed subhub child card underline Co-authored-by: Rose McColl <rosemccoll@hotmail.com>

…stack-local

…ypress-commands-2.0.1

…search-hub-web/cypress-commands-2.0.1 Bump cypress-commands from 1.1.0 to 2.0.1 in /research-hub-web

* initial commit for content graph * added resolver and adjustments, highlight node on hover * update lockfile version * minor fixes for null checks * added auth guard to graph route * first version of node info box * added node highlighting * improved details list and highlighting * first version of graph legend in drawer * layout fixes * layout improvements * renamed graph-legend to graph-filter * added legend, added dev env * added graph link to footer * fixed capitalisation * some fixes for unit tests * more fixes for tests * exclude GraphFilter test for now * added graph API to CSP headers (dev) * renamed graph-container * refactored graph into component * tidy up field order * changed loading behaviour, removed route resolver * fixed canvas width, colour changes * fixed color legend and search box * minor improvements * many UI improvements, added contentful link to env files * updated test and prod environment files with graph api url * some fixes for unit tests * more fixes for unit tests * minor improvements for node details UI * added graph api to csp headers in cloudfront functions * rebuild package-lock.json * added esbuild dep

* Add token references for CI build * Add missing package * Fix npm shrinkwrap issue * Fix wrong org id * Update readme * Update documentation * Add indentation and minor fixes to README * FIx minor heading issue with readme Co-authored-by: Lukas Trombach <19306765+Trombach@users.noreply.github.com>

Co-authored-by: rosemcc <rosemccoll@hotmail.com> Co-authored-by: Lukas Trombach <19306765+Trombach@users.noreply.github.com>

* chore: version update * CHORE: update versions * HOTFIX * Chore: version changes Co-authored-by: Rose <31844476+rosemcc@users.noreply.github.com> Co-authored-by: rosemcc <rosemccoll@hotmail.com> Co-authored-by: Lukas Trombach <lukas.trombach@auckland.ac.nz> Co-authored-by: Lukas Trombach <19306765+Trombach@users.noreply.github.com> Co-authored-by: etan221 <eric.tan@auckland.ac.nz>

Change feedback button text

* add initial modules and components * update search lambda * update and add new graphQL queries * add capability type to standard card * add components to routes * add capability list * reuse article default banner for capability card for now * add capability display name to pipe * first version of capability page * make tests runnable * add capability page type to search types * add navbar link to subhub * add capability list unit test * make e2e tests runnable * fix unit test * fix unit tests * add capability unit test * decapitalised navbar link * added new card background for capability * add capability e2e tests and fixture * fix capability not showing in search results * fix e2e test * add capability type to content graph * remove navbar link to be added later * fix standard card default image loading * lowercase sign in/out * move support materials to the top * fix unit test * fix navbar e2e test * move contacts to the top * minor fix for standard images * simplify standard card component * add comment explaining image height

update package versions

Bumps [loader-utils](https://github.com/webpack/loader-utils) from 1.4.0 to 1.4.2. - [Release notes](https://github.com/webpack/loader-utils/releases) - [Changelog](https://github.com/webpack/loader-utils/blob/v1.4.2/CHANGELOG.md) - [Commits](webpack/loader-utils@v1.4.0...v1.4.2) --- updated-dependencies: - dependency-name: loader-utils dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/linting.yml

+    name: Run linters
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v2
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v1
+        with:
+          node-version: 14
+
+      - name: Install Node.js dependencies
+        working-directory: ./research-hub-web
+        run: npm ci
+
+      - name: Install Angular CLI
+        run: npm install -g @angular/cli
+
+      - name: ng lint
+        working-directory: ./research-hub-web
+        run: ng lint


In general, this problem is fixed by adding a permissions: block to the workflow or to each job, specifying the minimal scopes required. For a pure linting job that only checks out code and runs local commands, contents: read is typically sufficient, and setting it at the workflow level will apply to all jobs that do not override it.

For this specific file, the simplest, least-invasive fix is to add a root-level permissions: block after the on: section and before jobs:. This block should restrict the GITHUB_TOKEN to read-only repository contents, which is adequate for actions/checkout and does not change any existing behavior of the linters themselves. No imports or other code changes are needed.

Concretely:

Edit .github/workflows/linting.yml.

Insert:
permissions: contents: read
between line 12 (the end of the on: block) and line 13 (jobs:).

Leave the rest of the workflow unchanged.

.github/workflows/sentry.yml

+    name: Create Sentry Release
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v2
+      - name: Get Branch
+        id: var
+        run: echo ::set-output name=branch::${GITHUB_REF#refs/*/}
+      - name: Output Branch
+        run: echo ${{ steps.var.outputs.branch }}
+      - name: Notify Sentry
+        # https://github.com/getsentry/action-release
+        uses: getsentry/action-release@v1.1.6
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: university-of-auckland-7o
+          SENTRY_PROJECT: research-hub
+        with:
+          environment: ${{ steps.var.outputs.branch }}


In general, the fix is to declare a permissions block with least-privilege settings, either at the workflow root or on the specific job. Since this workflow only checks out code and talks to Sentry using a secret (no GitHub-side writes are evident), contents: read is a safe minimal scope. If later steps require more, they can be added explicitly.

The best minimal change without altering functionality is to add a permissions block under the sentry-release job definition (line 13 onwards). This way, only this job’s GITHUB_TOKEN is constrained and we don’t assume anything about other jobs that might exist in this file (none are shown). Concretely, in .github/workflows/sentry.yml, under jobs: sentry-release: name: Create Sentry Release, insert:

permissions: contents: read

aligned with runs-on (same indentation level as runs-on). No imports or additional definitions are needed; GitHub Actions natively understands permissions.

.github/workflows/sentry.yml

+        run: echo ${{ steps.var.outputs.branch }}
+      - name: Notify Sentry
+        # https://github.com/getsentry/action-release
+        uses: getsentry/action-release@v1.1.6


hub-search-proxy/handler.js

+
+module.exports.search = async (event, context) => {
+    try {
+        console.log(`Received query: ${event.body}`);


In general, to fix log injection you should sanitize or normalize any user-controlled input before logging it. For plain-text logs, the minimum is to remove or neutralize newline and carriage return characters (and optionally other control characters), and clearly delimit logged user data.

For this specific code, the best minimal fix without changing existing functionality is to sanitize event.body before interpolating it into the log message on line 53. We can create a sanitized version of the string that strips \r and \n (and optionally other control characters) using String.prototype.replace, then log that sanitized value instead of the raw body. This keeps the semantics of logging the entire body while eliminating the ability to inject new log lines.

Concretely in hub-search-proxy/handler.js:

Immediately before console.log(Received query: ${event.body}); introduce a new local variable, e.g. const sanitizedBody = String(event.body).replace(/[\r\n]/g, ' ');.

Change the console.log call to use sanitizedBody.

Optionally, wrap the user-controlled portion in clear delimiters (e.g. brackets) to emphasize boundaries, but this is not strictly necessary for the minimal fix.
No new imports are required; this uses standard JavaScript string methods.

rosemcc and others added 30 commits November 8, 2021 14:13

Merge branch 'master' into expandable-page-part

92ae5b6

unit tests with mat harness, some cleanups

30077a9

remove unneeded expansion-panel style overrides

5b3e5a5

hide summary in mobile view

05c67dd

Merge branch 'master' into content-pages-refactor

2a23346

merge changes to article.component

a823c0c

Merge branch 'master' into content-pages-refactor

f644f4e

more changes

9b16683

fixes and 404 redirect

11e269c

move cypress-commands and jasmine to dev dependencies, remove browser…

3ecf0eb

…stack-local

Merge branch 'master' into dependabot/npm_and_yarn/research-hub-web/c…

c632cc1

…ypress-commands-2.0.1

Merge pull request #171 from UoA-eResearch/dependabot/npm_and_yarn/re…

bc92bbb

…search-hub-web/cypress-commands-2.0.1 Bump cypress-commands from 1.1.0 to 2.0.1 in /research-hub-web

breadcrumb refactor

24bf09c

final changes to article

b97f2c8

final changes to case study

f1eaefd

removed unused import from article

47b7122

final changes to equipment

af1fdf3

final changes to event

b0d934f

final changes to funding

e5f8f17

changes to subhub component

9c21a36

changes to service

68bd9f9

changes to software

ed7868d

fix scrolling home page image on iOS

0e533f0

reduce logo height on smaller screens

caded95

numbered lists on mobile safari

4021ed8

fix for dynamic routing

bce4a6c

Merge branch 'master' into content-pages-refactor

7fa37c8

provide other storage options for localforage

598aad3

rosemcc and others added 18 commits March 21, 2022 12:14

Merge remote-tracking branch 'origin/prod' into rc2.6.1

b2ade0c

chore: version update

65df05a

fix router issue in unit test

040de04

Merge branch 'hotfix-unittest'

fa7301f

Merge branch 'master' into rc2.6.1

ac37094

Merge branch 'rc2.6.1'

6744388

chore: update dependabot reviewers

ef4f4ac

avoid contentful export size limit error

2bb642f

Merge branch 'hotfix-search-proxy-bulk-loading'

d241d84

use query for feedback link in footer (#281)

28a3bc8

hotfix unit tests

5f6d96a

Chore: version changes (#286)

62edd81

new landscape logo (#299)

2b4321c

Co-authored-by: rosemcc <rosemccoll@hotmail.com> Co-authored-by: Lukas Trombach <19306765+Trombach@users.noreply.github.com>

Change feedback button text

7e60ebf

Merge pull request #320 from UoA-eResearch/change-feedback-button-text

39c4f2f

Change feedback button text

dependabot bot added the dependencies Pull requests that update a dependency file label Nov 29, 2022

dependabot bot requested review from Trombach, cakr322 and eric-el-tan November 29, 2022 00:48

Trombach and others added 4 commits December 1, 2022 17:09

update package versions

0dd43ee

Merge pull request #369 from UoA-eResearch/rc2.8.0

ee96dc4

update package versions

dependabot bot force-pushed the dependabot/npm_and_yarn/research-hub-web/loader-utils-1.4.2 branch from 4d5696b to 0f1856d Compare December 2, 2022 01:13

lugn621 force-pushed the dependabot/npm_and_yarn/research-hub-web/loader-utils-1.4.2 branch from 0f1856d to b7a6dea Compare April 2, 2026 02:11

github-advanced-security bot found potential problems Apr 2, 2026

View reviewed changes

@@ -50,7 +50,8 @@
             module.exports.search = async (event, context) => {
                 try {
-                    console.log(`Received query: ${event.body}`);
+                    const sanitizedBody = String(event.body).replace(/[\r\n]/g, ' ');
+                    console.log(`Received query: ${sanitizedBody}`);
                     const requestBody = JSON.parse(event.body);
                     let queryString = '';
                     let size = 10;

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump loader-utils from 1.4.0 to 1.4.2 in /research-hub-web#362

Bump loader-utils from 1.4.0 to 1.4.2 in /research-hub-web#362
dependabot[bot] wants to merge 2111 commits intomasterfrom
dependabot/npm_and_yarn/research-hub-web/loader-utils-1.4.2

dependabot bot commented on behalf of github Nov 29, 2022 •

edited

Loading

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

@@ -10,6 +10,9 @@
                 branches:
                   - master
+            permissions:
+              contents: read
             jobs:
               run-linters:
                 name: Run linters

Conversation

dependabot bot commented on behalf of github Nov 29, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.4.2

1.4.2 (2022-11-11)

Bug Fixes

v1.4.1

1.4.1 (2022-11-07)

Bug Fixes

1.4.2 (2022-11-11)

Bug Fixes

1.4.1 (2022-11-07)

Bug Fixes

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Uh oh!

Check warning

Uh oh!

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

dependabot bot commented on behalf of github Nov 29, 2022 •

edited

Loading