From 94147e8843898e0edd2664d0c46a4f42eb4adaa4 Mon Sep 17 00:00:00 2001 From: Aaron Dewes Date: Wed, 3 Apr 2024 20:18:13 +0200 Subject: [PATCH 1/4] feat(security): Add provenance (#416) * Enable provenance in package.json * Add necessary permissions to the release workflow --- .github/workflows/release.yml | 7 +++++++ package.json | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b0c7819..2ffa0ec 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,6 +6,13 @@ name: Release - next - beta - "*.x" +# These are recommended by the semantic-release docs: https://github.com/semantic-release/npm#npm-provenance +permissions: + contents: write # to be able to publish a GitHub release + issues: write # to be able to comment on released issues + pull-requests: write # to be able to comment on released pull requests + id-token: write # to enable use of OIDC for npm provenance + jobs: release: name: release diff --git a/package.json b/package.json index b2014af..be0345a 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,8 @@ "name": "@octokit/request-error", "version": "0.0.0-development", "publishConfig": { - "access": "public" + "access": "public", + "provenance": true }, "description": "Error class for Octokit request errors", "scripts": { From 3af20bd58fea6cc349bc191c725e78e9cc021da6 Mon Sep 17 00:00:00 2001 From: wolfy1339 Date: Fri, 5 Apr 2024 15:59:57 -0400 Subject: [PATCH 2/4] fix: upgrade `@octokit/types` to v13 --- package-lock.json | 30 +++++++++++++++--------------- package.json | 2 +- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/package-lock.json b/package-lock.json index 48126b0..939dbb7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,7 +9,7 @@ "version": "0.0.0-development", "license": "MIT", "dependencies": { - "@octokit/types": "^12.0.0", + "@octokit/types": "^13.1.0", "deprecation": "^2.0.0", "once": "^1.4.0" }, @@ -1412,9 +1412,9 @@ "dev": true }, "node_modules/@octokit/openapi-types": { - "version": "19.0.0", - "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-19.0.0.tgz", - "integrity": "sha512-PclQ6JGMTE9iUStpzMkwLCISFn/wDeRjkZFIKALpvJQNBGwDoYYi2fFvuHwssoQ1rXI5mfh6jgTgWuddeUzfWw==" + "version": "21.2.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-21.2.0.tgz", + "integrity": "sha512-xx+Xd6I7rYvul/hgUDqv6TeGX0IOGnhSg9IOeYgd/uI7IAqUy6DE2B6Ipv2M4mWoxaMcWjIzgTIcv8pMO3F3vw==" }, "node_modules/@octokit/tsconfig": { "version": "2.0.0", @@ -1423,11 +1423,11 @@ "dev": true }, "node_modules/@octokit/types": { - "version": "12.0.0", - "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.0.0.tgz", - "integrity": "sha512-EzD434aHTFifGudYAygnFlS1Tl6KhbTynEWELQXIbTY8Msvb5nEqTZIm7sbPEt4mQYLZwu3zPKVdeIrw0g7ovg==", + "version": "13.1.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.1.0.tgz", + "integrity": "sha512-nBwAFOYqVUUJ2AZFK4ZzESQptaAVqdTDKk8gE0Xr0o99WuPDSrhUC38x0F40xD9OUxXhOOuZKWNNVVLPSHQDvQ==", "dependencies": { - "@octokit/openapi-types": "^19.0.0" + "@octokit/openapi-types": "^21.0.0" } }, "node_modules/@pkgjs/parseargs": { @@ -5575,9 +5575,9 @@ } }, "@octokit/openapi-types": { - "version": "19.0.0", - "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-19.0.0.tgz", - "integrity": "sha512-PclQ6JGMTE9iUStpzMkwLCISFn/wDeRjkZFIKALpvJQNBGwDoYYi2fFvuHwssoQ1rXI5mfh6jgTgWuddeUzfWw==" + "version": "21.2.0", + "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-21.2.0.tgz", + "integrity": "sha512-xx+Xd6I7rYvul/hgUDqv6TeGX0IOGnhSg9IOeYgd/uI7IAqUy6DE2B6Ipv2M4mWoxaMcWjIzgTIcv8pMO3F3vw==" }, "@octokit/tsconfig": { "version": "2.0.0", @@ -5586,11 +5586,11 @@ "dev": true }, "@octokit/types": { - "version": "12.0.0", - "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.0.0.tgz", - "integrity": "sha512-EzD434aHTFifGudYAygnFlS1Tl6KhbTynEWELQXIbTY8Msvb5nEqTZIm7sbPEt4mQYLZwu3zPKVdeIrw0g7ovg==", + "version": "13.1.0", + "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.1.0.tgz", + "integrity": "sha512-nBwAFOYqVUUJ2AZFK4ZzESQptaAVqdTDKk8gE0Xr0o99WuPDSrhUC38x0F40xD9OUxXhOOuZKWNNVVLPSHQDvQ==", "requires": { - "@octokit/openapi-types": "^19.0.0" + "@octokit/openapi-types": "^21.0.0" } }, "@pkgjs/parseargs": { diff --git a/package.json b/package.json index be0345a..9932e2b 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "author": "Gregor Martynus (https://github.com/gr2m)", "license": "MIT", "dependencies": { - "@octokit/types": "^12.0.0", + "@octokit/types": "^13.1.0", "deprecation": "^2.0.0", "once": "^1.4.0" }, From 12a14f03dbfbbdc759c1c20a631b277892da09de Mon Sep 17 00:00:00 2001 From: wolfy1339 Date: Fri, 14 Feb 2025 17:26:10 -0500 Subject: [PATCH 3/4] fix: ReDos regex vulnerability, reported by @dayshift --- src/index.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/index.ts b/src/index.ts index 2626118..d4f4f65 100644 --- a/src/index.ts +++ b/src/index.ts @@ -76,7 +76,7 @@ export class RequestError extends Error { if (options.request.headers.authorization) { requestCopy.headers = Object.assign({}, options.request.headers, { authorization: options.request.headers.authorization.replace( - / .*$/, + /(? Date: Fri, 14 Feb 2025 17:26:20 -0500 Subject: [PATCH 4/4] test: ReDos regex vulnerability, reported by @dayshift --- test/request-error.test.ts | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/test/request-error.test.ts b/test/request-error.test.ts index a14be91..f74d443 100644 --- a/test/request-error.test.ts +++ b/test/request-error.test.ts @@ -10,6 +10,42 @@ const mockOptions: RequestErrorOptions = { }; describe("RequestError", () => { + test("Test ReDoS - attack string", () => { + const startTime = performance.now(); + const error = new RequestError("Oops", 500, { + request: { + method: "POST", + url: "https://api.github.com/foo", + body: { + bar: "baz", + }, + headers: { + authorization: "" + " ".repeat(100000) + "\n@", + }, + }, + response: { + status: 500, + url: "https://api.github.com/foo", + headers: { + "x-github-request-id": "1:2:3:4", + }, + data: { + foo: "bar", + }, + }, + }); + const endTime = performance.now(); + const elapsedTime = endTime - startTime; + const reDosThreshold = 2000; + expect(elapsedTime).toBeLessThanOrEqual(reDosThreshold); + if (elapsedTime > reDosThreshold) { + console.warn( + `🚨 Potential ReDoS Attack! getDuration method took ${elapsedTime.toFixed( + 2, + )} ms, exceeding threshold of ${reDosThreshold} ms.`, + ); + } + }); test("inherits from Error", () => { const error = new RequestError("test", 123, mockOptions); expect(error).toBeInstanceOf(Error);