ci: bundle cds9 and compiler6 to re-enable pipeline

[danjoa]

alternative approach to #1184

To fix the issue, we need to ensure that backslashes are properly escaped in the _json_replacer function. This can be achieved by modifying the regular expression and replacement logic to handle backslashes (\) in addition to double quotes ("). Specifically:

1. Update the regular expression in _json_replacer to match both double quotes and backslashes.
2. Update the replacement logic to escape backslashes (\) as \\ and double quotes (") as \".

The fix will ensure that all occurrences of backslashes and double quotes are escaped, making the sanitization complete and robust.

---

To fix the issue, the replace method should be updated to use a regular expression with the global (g) flag. This ensures that all occurrences of '\n' in the string are replaced, not just the first one. Specifically, the string '\n' should be replaced with the regular expression /\n/g. This change will ensure that the stack trace is formatted as intended.

The fix will involve modifying line 111 where the replace method is used. No additional imports or dependencies are required.

---

To fix the issue, we will modify the merge function to block unsafe property names (__proto__ and constructor) from being merged. This approach is simple and effective, as it directly addresses the root cause of prototype pollution. Specifically:

1. Add a check to skip merging if the property name is __proto__ or constructor.
2. Ensure that the rest of the functionality remains unchanged.

The changes will be made in the merge function in cds9/lib/utils/cds-utils.js.

---

To fix the issue, we need to validate that the retrieved value (c) is a function before invoking it. This can be achieved by adding a check using typeof to ensure that c is a function. If c is not a function, the code should handle this case gracefully, such as by logging an error and returning an appropriate response to the client.

The changes will be made in the cds9/libx/_runtime/messaging/enterprise-messaging-utils/registerEndpoints.js file, specifically around line 109 where the callback is invoked. We will also ensure that the callbacks array only contains valid functions by filtering out any invalid entries.

To fix the issue, we need to replace all occurrences of the special characters <, >, and ... in the arg string. This can be achieved by using regular expressions with the global (g) flag in the replace method. Regular expressions ensure that all matches are replaced, not just the first one.

Specifically:

1. Replace < with an empty string using /</g.
2. Replace > with an empty string using />/g.
3. Replace ... with an empty string using /\.{3}/g.

This change ensures that all occurrences of these characters are removed from the arg string.

---

To fix the issue, we need to ensure that all occurrences of <, >, and ... in the argumentDefinition string are replaced. This can be achieved by using regular expressions with the global (g) flag instead of the replace method with a string argument. Regular expressions will ensure that all matches are replaced, not just the first one.

The specific changes are:

1. Replace the replace calls on line 132–134 with calls to replace using regular expressions.
2. Use /</g, />/g, and /\.\.\./g as the patterns to match all occurrences of <, >, and ..., respectively.

---

[patricebender]

@danjoa this seems to be a "Fass ohne Boden", we would need to bundle more than cds and cds-compiler:

npm error notarget No matching version found for @sap/cds-fiori@^2.

not sure if I would further proceed with this approach. :(

[danjoa]

@danjoa this seems to be a "Fass ohne Boden", we would need to bundle more than cds and cds-compiler:

npm error notarget No matching version found for @sap/cds-fiori@^2.

not sure if I would further proceed with this approach. :(

Try adding @sap/cds-fiori as well ... that one doesn't have dependencies and @sap/cds only has these two → so a "Fass mit Boden"

[danjoa]

If that approach works, we can also replace the unpacked folders by the tarballs from which they stem, and unpack the tarballs in the GitHub action

To fix the issue, we need to sanitize or escape the user-provided input (params.entity and params.service) before incorporating it into the response. Since the vulnerable code generates JavaScript, we should use a library that escapes input for safe inclusion in JavaScript contexts. A well-known library for this purpose is lodash.escape.

Steps to fix:

1. Import the lodash.escape library.
2. Use escape to sanitize params.service and params.entity in the _componentJs function before they are used in the metadata field of the returned JavaScript code.
3. Ensure that all other instances of params.service and params.entity in the file are similarly sanitized if they are used in contexts that could lead to XSS.

---

To fix the issue, we need to sanitize the user-controlled inputs (params.service and params.entity) before embedding them in the HTML response. This can be achieved by using a library like escape-html to escape special characters in the inputs, ensuring they are safely rendered as text rather than being interpreted as HTML or JavaScript.

Steps to fix:

1. Import the escape-html library at the top of the file.
2. Use escape-html to sanitize serviceName and entityName in the _html function before embedding them in the HTML response.

---

To fix the issue, the replace method should be updated to use a regular expression with the global (g) flag. This ensures that all occurrences of the $ character in the mountPoint string are replaced with \\$. This approach is robust and handles cases where mountPoint contains multiple $ characters.

The specific change involves replacing the current mountPoint.replace('$', '\\$') with mountPoint.replace(/\$/g, '\\$'). This uses a regular expression to match all $ characters globally.

---

[danjoa]

The findings from that CodeQL thingy look very interesting.... → can we have that on the original repos of @sap/cds et al as well?