Bump the npm_and_yarn at /research-hub-web security update group in /research-hub-web with 1 update#427
Conversation
Expandable page part
Add capabilities navbar link
Change activities label to research stage
Bugfix/update csp
Fix failed start up due to Contentful type changes
…search-stage-url RSM-3036: stage: replace search with url
…rsion Update linting.yml
Feature/rsm 3250 search logic
Bumps the npm_and_yarn at /research-hub-web security update group in /research-hub-web with 1 update: [cross-undici-fetch](https://github.com/ardatan/whatwg-node/tree/HEAD/packages/cross-undici-fetch). - [Release notes](https://github.com/ardatan/whatwg-node/releases) - [Commits](https://github.com/ardatan/whatwg-node/commits/HEAD/packages/cross-undici-fetch) --- updated-dependencies: - dependency-name: cross-undici-fetch dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
|
Dependabot tried to add |
lugn621
force-pushed
the
dependabot/npm_and_yarn/research-hub-web/cross-undici-fetch-0.1.33
branch
from
bd4962b to
16aac4f
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Run linters | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Check out Git repository | ||
| uses: actions/checkout@v2 | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v1 | ||
| with: | ||
| node-version: 18 | ||
|
|
||
| - name: Install Node.js dependencies | ||
| working-directory: ./research-hub-web | ||
| run: npm ci --force | ||
|
|
||
| - name: Install Angular CLI | ||
| run: npm install -g @angular/cli | ||
|
|
||
| - name: ng lint | ||
| working-directory: ./research-hub-web | ||
| run: ng lint |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 days ago
To fix the problem, declare explicit least-privilege GITHUB_TOKEN permissions for this workflow or specifically for the run-linters job. Since the job only checks out code and runs local lint commands, it only needs read access to repository contents; it does not need any write permissions or access to other scopes.
The best minimal fix without altering functionality is to add a permissions block to the workflow root (so it applies to all jobs by default) specifying contents: read. This documents the permission requirement and ensures that even if organization defaults are permissive, this workflow’s token will be restricted. Concretely, in .github/workflows/linting.yml, insert:
permissions:
contents: readafter the on: block and before jobs:. No imports or additional methods are needed; this is pure workflow configuration.
| @@ -10,6 +10,9 @@ | ||
| branches: | ||
| - master | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| run-linters: | ||
| name: Run linters |
| name: Create Sentry Release | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Check out Git repository | ||
| uses: actions/checkout@v2 | ||
| - name: Get Branch | ||
| id: var | ||
| run: echo ::set-output name=branch::${GITHUB_REF#refs/*/} | ||
| - name: Output Branch | ||
| run: echo ${{ steps.var.outputs.branch }} | ||
| - name: Notify Sentry | ||
| # https://github.com/getsentry/action-release | ||
| uses: getsentry/action-release@v1.1.6 | ||
| env: | ||
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | ||
| SENTRY_ORG: university-of-auckland-7o | ||
| SENTRY_PROJECT: research-hub | ||
| with: | ||
| environment: ${{ steps.var.outputs.branch }} No newline at end of file |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 days ago
In general, fix this by adding a permissions section that grants only the minimal needed scopes to the GITHUB_TOKEN. This can be set at the root of the workflow (affecting all jobs) or within the specific job; here, we’ll add it at the job level for sentry-release.
The sentry-release job only needs to check out code and send a release notification to Sentry using SENTRY_AUTH_TOKEN. It does not need to push commits, create releases/tags in GitHub, or modify issues/PRs. Therefore, we can safely set permissions: contents: read for this job. This explicitly restricts the GITHUB_TOKEN to read-only access to repository contents while preserving all existing functionality.
Concretely: in .github/workflows/sentry.yml, under jobs: sentry-release: name: Create Sentry Release and before runs-on: ubuntu-latest, insert:
permissions:
contents: readNo imports or additional methods are required.
| @@ -12,6 +12,8 @@ | ||
| jobs: | ||
| sentry-release: | ||
| name: Create Sentry Release | ||
| permissions: | ||
| contents: read | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: |
| run: echo ${{ steps.var.outputs.branch }} | ||
| - name: Notify Sentry | ||
| # https://github.com/getsentry/action-release | ||
| uses: getsentry/action-release@v1.1.6 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
|
|
||
| module.exports.search = async (event, context) => { | ||
| try { | ||
| console.log(`Received query: ${event.body}`); |
Check warning
Code scanning / CodeQL
Log injection Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 days ago
In general, to fix log injection arising from user input, sanitize the input before logging by removing or neutralizing characters that can alter log structure (such as \n and \r), and clearly mark which parts of the log entry come from user input. For plain-text logs, replacing all newline and carriage return characters with safe alternatives (or removing them) is usually sufficient.
For this specific code, the best fix with minimal behavioral change is to create a sanitized version of event.body just for logging, leaving the original event.body intact for subsequent parsing. Right before logging, we can convert event.body to a string (in case it is not already) and remove \r and \n using String.prototype.replace with a regular expression. Then we log the sanitized string instead of the raw event.body. The rest of the function, including JSON.parse(event.body), remains unchanged.
Concretely, in hub-search-proxy/handler.js inside module.exports.search, we will replace:
console.log(`Received query: ${event.body}`);with something like:
const rawBodyForLog = String(event.body);
const sanitizedBodyForLog = rawBodyForLog.replace(/[\r\n]/g, '');
console.log(`Received query: ${sanitizedBodyForLog}`);This requires no new imports and does not affect how the request body is used later in the code.
| @@ -50,7 +50,9 @@ | ||
|
|
||
| module.exports.search = async (event, context) => { | ||
| try { | ||
| console.log(`Received query: ${event.body}`); | ||
| const rawBodyForLog = String(event.body); | ||
| const sanitizedBodyForLog = rawBodyForLog.replace(/[\r\n]/g, ''); | ||
| console.log(`Received query: ${sanitizedBodyForLog}`); | ||
| const requestBody = JSON.parse(event.body); | ||
| let queryString = ''; | ||
| let size = 10; |
7 participants
Bumps the npm_and_yarn at /research-hub-web security update group in /research-hub-web with 1 update: cross-undici-fetch.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.