Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
d390659
Add missing permissions
henrymercer Jan 24, 2025
9cd802e
Give only read-level `security-events` permission where possible
henrymercer Jan 24, 2025
3b34c67
Merge branch 'main' into henrymercer/add-permissions
henrymercer Jan 24, 2025
c22d1f3
Merge pull request #2720 from github/henrymercer/add-permissions
henrymercer Jan 24, 2025
da67fa0
Update changelog and version after v3.28.5
github-actions[bot] Jan 24, 2025
336c69e
Update checked-in dependencies
github-actions[bot] Jan 24, 2025
4b8aeab
Merge branch 'main' into mergeback/v3.28.5-to-main-f6091c01
henrymercer Jan 24, 2025
51bb5eb
Fix bug in getCredentials + tests
marcogario Jan 24, 2025
e7c0c9d
Merge pull request #2722 from github/mergeback/v3.28.5-to-main-f6091c01
Jan 24, 2025
ecf7232
Sanitize inputs
marcogario Jan 24, 2025
f6d19ed
Formatting
marcogario Jan 24, 2025
2bab9f7
Ensure artifacts are only uploaded in safe situations
aeisenberg Jan 25, 2025
5ff2464
Update changelog
aeisenberg Jan 25, 2025
f71067b
Stop using feature-flag support for determining if a feature is active
aeisenberg Jan 26, 2025
346d067
Fix CLI versions
aeisenberg Jan 27, 2025
a2c1b36
Iterate over each version
aeisenberg Jan 27, 2025
7c2eafa
Use ConfigureationError for exceptions
marcogario Jan 27, 2025
7fdbca3
build(deps-dev): bump the npm group with 4 updates
dependabot[bot] Jan 27, 2025
357e0ce
Update checked-in dependencies
github-actions[bot] Jan 27, 2025
297e89a
Merge pull request #2723 from github/marcogario/start-proxy_tests
aeisenberg Jan 27, 2025
c6b2861
Merge pull request #2731 from github/dependabot/npm_and_yarn/npm-e1e9…
aeisenberg Jan 27, 2025
62c322f
Add better comments around artifact upload tests
aeisenberg Jan 27, 2025
a879704
Clarify test fail;ure message
aeisenberg Jan 27, 2025
b494190
Merge pull request #2726 from github/aeisenberg/reenable-artifact-upload
aeisenberg Jan 27, 2025
64ad47c
Update changelog for v3.28.6
github-actions[bot] Jan 27, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Formatting
  • Loading branch information
marcogario committed Jan 24, 2025
commit f6d19ed42e810d6f0b26643bb590caf6aff04ea9
11 changes: 8 additions & 3 deletions lib/start-proxy.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion lib/start-proxy.js.map

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 5 additions & 1 deletion lib/start-proxy.test.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion lib/start-proxy.test.js.map

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

53 changes: 29 additions & 24 deletions src/start-proxy.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -82,29 +82,34 @@
});

test("getCredentials throws an error when non-printable characters are used", async (t) => {
const invalidCredentials = [
{ type: "nuget_feed", host: "1nuget.pkg.github.com", token: "abc\u0000" }, // Non-printable character in token
{ type: "nuget_feed", host: "2nuget.pkg.github.com\u0001" }, // Non-printable character in host
{ type: "nuget_feed", host: "3nuget.pkg.github.com", password: "ghi\u0002" }, // Non-printable character in password
{ type: "nuget_feed", host: "4nuget.pkg.github.com", password: "ghi\x00" }, // Non-printable character in password
];
const invalidCredentials = [
{ type: "nuget_feed", host: "1nuget.pkg.github.com", token: "abc\u0000" }, // Non-printable character in token
{ type: "nuget_feed", host: "2nuget.pkg.github.com\u0001" }, // Non-printable character in host
{
type: "nuget_feed",
host: "3nuget.pkg.github.com",
password: "ghi\u0002",
}, // Non-printable character in password
{ type: "nuget_feed", host: "4nuget.pkg.github.com", password: "ghi\x00" }, // Non-printable character in password
];

for (const invalidCredential of invalidCredentials) {
const credentialsInput = Buffer.from(
JSON.stringify([invalidCredential]),
).toString("base64");
for (const invalidCredential of invalidCredentials) {
const credentialsInput = Buffer.from(
JSON.stringify([invalidCredential]),
).toString("base64");

t.throws(
() =>
startProxyExports.getCredentials(
getRunnerLogger(true),
undefined,
credentialsInput,
undefined,
),
{
message: "Invalid credentials - fields must contain only printable characters",
},
);
}
});
t.throws(
() =>
startProxyExports.getCredentials(
getRunnerLogger(true),
undefined,
credentialsInput,
undefined,
),

Check failure

Code scanning / CodeQL

Untrusted data passed to external API with additional heuristic sources High Experimental

Call to ava.[callback].[param 't'].throws() [callback 0 result] with untrusted data from
e.password
.
{
message:
"Invalid credentials - fields must contain only printable characters",
},
);
}
});
18 changes: 13 additions & 5 deletions src/start-proxy.ts
Original file line number Diff line number Diff line change
Expand Up @@ -54,13 +54,13 @@ export function getCredentials(
let parsed: Credential[];
try {
parsed = JSON.parse(credentialsStr) as Credential[];
} catch (error) {
} catch {
// Don't log the error since it might contain sensitive information.
logger.error("Failed to parse the credentials data.");
throw new Error("Invalid credentials format.");
}

let out: Credential[] = [];
const out: Credential[] = [];
for (const e of parsed) {
if (e.url === undefined && e.host === undefined) {
// The proxy needs one of these to work. If both are defined, the url has the precedence.
Expand All @@ -73,13 +73,21 @@ export function getCredentials(
continue;
}


const isPrintable = (str: string | undefined): boolean => {
return str ? /^[\x20-\x7E]*$/.test(str) : true;
};

if (!isPrintable(e.type) || !isPrintable(e.host) || !isPrintable(e.url) || !isPrintable(e.username) || !isPrintable(e.password) || !isPrintable(e.token)) {
throw new Error("Invalid credentials - fields must contain only printable characters");
if (
!isPrintable(e.type) ||
!isPrintable(e.host) ||
!isPrintable(e.url) ||
!isPrintable(e.username) ||
!isPrintable(e.password) ||
!isPrintable(e.token)
) {
throw new Error(
"Invalid credentials - fields must contain only printable characters",
);
}

out.push({
Expand Down
Loading