Skip to content

Conversation

@gbubemismith
Copy link
Contributor

🎟️ Tracking

📔 Objective

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation
    team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed
    issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

@gbubemismith gbubemismith requested a review from a team as a code owner January 14, 2026 02:09
@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Jan 14, 2026

Deploying contributing-docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: 89b1ad5
Status: ✅  Deploy successful!
Preview URL: https://8b333642.contributing-docs.pages.dev
Branch Preview URL: https://smith-update-azure-queue-log.contributing-docs.pages.dev

View logs

@gbubemismith gbubemismith marked this pull request as draft January 14, 2026 02:13
@github-actions
Copy link
Contributor

github-actions bot commented Jan 14, 2026

Logo
Checkmarx One – Scan Summary & Details4a640f85-06a2-4981-aefb-38b30a6d3351

New Issues (1)

Checkmarx found the following issues in this Pull Request

# Severity Issue Source File / Package Checkmarx Insight
1 HIGH CVE-2026-21884 Npm-react-router-5.3.4
detailsRecommended version: 7.12.0
Description: A XSS vulnerability exists in in React Router's "" API in Framework Mode when using the "getKey/storageKey" props during Server-...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package

- `globalSettings:events:connectionString` should not be set, or has the default value of
`UseDevelopmentStorage=true`
- `globalSettings:events:queueName` should be set to `"event"`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❓ Isn't there a default for this? And this is the legacy system we as Bitwarden no longer use, in favor of Rabbit of ASB.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The secrets example JSON updated and would cover this for compatibility reasons, but what I am not understanding is how this is used -- shouldn't the direct database writer for events be used?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For anyone running pwsh setup_secrets.ps1, the updated secrets will now include the necessary configuration. However, I noticed this change because I still use Azure Queue locally. Since we now check for both globalSettings:events:connectionString and globalSettings:events:queueName:

if (CoreHelpers.SettingHasValue(globalSettings.Events.ConnectionString) &&
            CoreHelpers.SettingHasValue(globalSettings.Events.QueueName))
{
    services.TryAddSingleton<IEventWriteService, AzureQueueEventWriteService>();
    return services;
}

Anyone still using Azure Queue who hasn't updated their secrets won't have AzureQueueEventWriteService registered, which would break their local event logging.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would prefer to break these engineers' local experiences in that case. We all need to upgrade. We almost outright removed the queueing logic altogether but left it in case someone in the field might.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh that makes sense. I will close this PR then. Thanks.

@gbubemismith gbubemismith marked this pull request as ready for review January 14, 2026 15:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants