Skip to content

Commit 1092669

Browse files
achrinzaachrinza
committed
ci: misc fixes
- Fixed commitlint - Fixed Git submodules not being pulled - Fixed CPE - Fixed CSAF validation script passing validation exit code Signed-off-by: Rifa Achrinza <[email protected]>
1 parent 82012f8 commit 1092669

File tree

5 files changed

+191
-180
lines changed

5 files changed

+191
-180
lines changed

‎.github/workflows/ci.yaml

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,15 @@ jobs:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- uses: actions/checkout@v2
13+
with:
14+
submodules: true
1315
- uses: actions/setup-node@v2
1416
with:
1517
node-version: 16
16-
- run: npm ci --ignore-scripts
17-
- run: |
18+
- name: Install tools
19+
run: npm ci --ignore-scripts
20+
- name: Run code lint
21+
run: |
1822
npm run-script --ignore-scripts prettier:check
1923
npm run-script --ignore-scripts validate-csaf20
2024
commit-lint:
@@ -28,6 +32,7 @@ jobs:
2832
- uses: actions/setup-node@v2
2933
with:
3034
node-version: 16
31-
- name: Install Tools
35+
- name: Install tools
3236
run: npm ci --ignore-scripts
33-
- run: npx commitlint --from=origin/master --to=HEAD --verbose
37+
- name: Run commit lint
38+
run: npx commitlint --from=origin/main --to=HEAD --verbose

‎advisories/lbsa-20201130.csaf.json

Lines changed: 160 additions & 172 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,131 @@
11
{
2-
"document": {
3-
"acknowledgments": [
2+
"document": {
3+
"acknowledgments": [
4+
{
5+
"names": ["Olivier Beg", "Samuel Erb"]
6+
}
7+
],
8+
"category": "security_advisory",
9+
"csaf_version": "2.0",
10+
"distribution": {
11+
"text": "Disclosure is not limited.",
12+
"tlp": {
13+
"label": "WHITE"
14+
}
15+
},
16+
"lang": "en",
17+
"notes": [
18+
{
19+
"audience": "all",
20+
"category": "description",
21+
"text": "It's a similar issue as https://snyk.io/vuln/SNYK-JS-LODASH-73638, where the following description is quoted from.\n\n> Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `_proto_`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n>\n> There are two main ways in which the pollution of prototypes occurs:\n>\n> - Unsafe Object recursive merge\n> - Property definition by path"
22+
},
23+
{
24+
"audience": "all",
25+
"category": "summary",
26+
"text": "`@loopback/rest` allows REST APIs to have `constructor` in the JSON payload, which is vulnerable to prototype pollution."
27+
}
28+
],
29+
"publisher": {
30+
"category": "vendor",
31+
"name": "The LoopBack Maintainers",
32+
"namespace": "https://loopback.io"
33+
},
34+
"references": [
35+
{
36+
"category": "self",
37+
"summary": "Security Advisory 11-30-2020 CSAF document",
38+
"url": "https://loopback.io/doc/en/sec/lbsa-2020-11-30.csaf.json"
39+
},
40+
{
41+
"category": "self",
42+
"summary": "Security Advisory 11-30-2020 HTML document",
43+
"url": "https://loopback.io/doc/en/sec/Security-advisory-11-30-2020.html"
44+
},
45+
{
46+
"summary": "X-Force Vulnerability Report",
47+
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192706"
48+
}
49+
],
50+
"title": "Security Advisory 11-30-2020",
51+
"tracking": {
52+
"current_release_date": "2022-01-17T00:00:00.000Z",
53+
"id": "lbsa-20201130",
54+
"initial_release_date": "2022-01-17T00:00:00.000Z",
55+
"revision_history": [
456
{
5-
"names": [
6-
"Olivier Beg",
7-
"Samuel Erb"
8-
]
57+
"date": "2022-01-18T00:00:00.000Z",
58+
"number": "1.0.0",
59+
"summary": "Initial version."
960
}
1061
],
11-
"category": "security_advisory",
12-
"csaf_version": "2.0",
13-
"distribution": {
14-
"text": "Disclosure is not limited.",
15-
"tlp": {
16-
"label": "WHITE"
17-
}
62+
"status": "final",
63+
"version": "1.0.0"
64+
}
65+
},
66+
"product_tree": {
67+
"branches": [
68+
{
69+
"branches": [
70+
{
71+
"branches": [
72+
{
73+
"branches": [
74+
{
75+
"branches": [
76+
{
77+
"category": "product_version",
78+
"name": "Version 8.0.0",
79+
"product": {
80+
"name": "@loopback/rest - Version 8.0.0",
81+
"product_id": "1",
82+
"product_identification_helper": {
83+
"cpe": "cpe:2.3:a:loopback:loopback_rest:8.0.0:*:*:*:*:*:*:*",
84+
"purl": "pkg:npm/%40loopback/[email protected]"
85+
}
86+
}
87+
},
88+
{
89+
"category": "product_version",
90+
"name": "Version 9.0.0",
91+
"product": {
92+
"name": "@loopback/rest - Version 9.0.0",
93+
"product_id": "2",
94+
"product_identification_helper": {
95+
"cpe": "cpe:2.3:a:loopback:loopback_rest:9.0.0:*:*:*:*:*:*:*",
96+
"purl": "pkg:npm/%40loopback/[email protected]"
97+
}
98+
}
99+
}
100+
],
101+
"category": "product_name",
102+
"name": "@loopback/rest"
103+
}
104+
],
105+
"category": "product_family",
106+
"name": "LoopBack 4"
107+
}
108+
],
109+
"category": "product_family",
110+
"name": "LoopBack"
111+
}
112+
],
113+
"category": "vendor",
114+
"name": "The LoopBack Maintainers"
115+
}
116+
]
117+
},
118+
"vulnerabilities": [
119+
{
120+
"cve": "CVE-2020-4988",
121+
"cwe": {
122+
"id": "CWE-1321",
123+
"name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"
124+
},
125+
"id": {
126+
"system_name": "IBM X-Force ID",
127+
"text": "192706"
18128
},
19-
"lang": "en",
20129
"notes": [
21130
{
22131
"audience": "all",
@@ -29,173 +138,52 @@
29138
"text": "`@loopback/rest` allows REST APIs to have `constructor` in the JSON payload, which is vulnerable to prototype pollution."
30139
}
31140
],
32-
"publisher": {
33-
"category": "vendor",
34-
"name": "The LoopBack Maintainers",
35-
"namespace": "https://loopback.io"
141+
"product_status": {
142+
"first_affected": ["1"],
143+
"fixed": ["2"]
36144
},
37145
"references": [
38146
{
39-
"category": "self",
40-
"summary": "Security Advisory 11-30-2020 CSAF document",
41-
"url": "https://loopback.io/doc/en/sec/lbsa-2020-11-30.csaf.json"
42-
},
43-
{
44-
"category": "self",
45-
"summary": "Security Advisory 11-30-2020 HTML document",
46-
"url": "https://loopback.io/doc/en/sec/Security-advisory-11-30-2020.html"
147+
"summary": "GitHub pull request",
148+
"url": "https://github.com/loopbackio/loopback-next/pull/6676"
47149
},
48150
{
49151
"summary": "X-Force Vulnerability Report",
50152
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192706"
51153
}
52154
],
53-
"title": "Security Advisory 11-30-2020",
54-
"tracking": {
55-
"current_release_date": "2022-01-17T00:00:00.000Z",
56-
"id": "lbsa-20201130",
57-
"initial_release_date": "2022-01-17T00:00:00.000Z",
58-
"revision_history": [
59-
{
60-
"date": "2022-01-17T00:00:00.000Z",
61-
"number": "1.0.0",
62-
"summary": "Initial version."
63-
}
64-
],
65-
"status": "final",
66-
"version": "1.0.0"
67-
}
68-
},
69-
"product_tree": {
70-
"branches": [
155+
"remediations": [
71156
{
72-
"branches": [
73-
{
74-
"branches": [
75-
{
76-
"branches": [
77-
{
78-
"branches": [
79-
{
80-
"category": "product_version",
81-
"name": "Version 8.0.0",
82-
"product": {
83-
"name": "@loopback/rest - Version8.0.0",
84-
"product_id": "1",
85-
"product_identification_helper": {
86-
"cpe": "cpe:2.3:a:loopback:loopback_rest:8.0.0",
87-
"purl": "pkg:npm/%40loopback/[email protected]"
88-
}
89-
}
90-
},
91-
{
92-
"category": "product_version",
93-
"name": "Version 9.0.0",
94-
"product": {
95-
"name": "@loopback/rest - Version 9.0.0",
96-
"product_id": "2",
97-
"product_identification_helper": {
98-
"cpe": "cpe:2.3:a:loopback:loopback_rest:9.0.0",
99-
"purl": "pkg:npm/%40loopback/[email protected]"
100-
}
101-
}
102-
}
103-
],
104-
"category": "product_name",
105-
"name": "@loopback/rest"
106-
}
107-
],
108-
"category": "product_family",
109-
"name": "LoopBack 4"
110-
}
111-
],
112-
"category": "product_family",
113-
"name": "LoopBack"
114-
}
115-
],
116-
"category": "vendor",
117-
"name": "The LoopBack Maintainers"
157+
"category": "vendor_fix",
158+
"date": "2020-05-11T08:22:42.000Z",
159+
"details": "Upgrade to `@loopback/rest` 9.0.0 or later.",
160+
"product_ids": ["1"]
118161
}
119-
]
120-
},
121-
"vulnerabilities": [
122-
{
123-
"cve": "CVE-2020-4988",
124-
"cwe": {
125-
"id": "CWE-1321",
126-
"name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"
127-
},
128-
"id": {
129-
"system_name": "IBM X-Force ID",
130-
"text": "192706"
131-
},
132-
"notes": [
133-
{
134-
"audience": "all",
135-
"category": "description",
136-
"text": "It's a similar issue as https://snyk.io/vuln/SNYK-JS-LODASH-73638, where the following description is quoted from.\n\n> Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `_proto_`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n>\n> There are two main ways in which the pollution of prototypes occurs:\n>\n> - Unsafe Object recursive merge\n> - Property definition by path"
137-
},
138-
{
139-
"audience": "all",
140-
"category": "summary",
141-
"text": "`@loopback/rest` allows REST APIs to have `constructor` in the JSON payload, which is vulnerable to prototype pollution."
142-
}
143-
],
144-
"product_status": {
145-
"first_affected": [
146-
"1"
147-
],
148-
"fixed": [
149-
"2"
150-
]
151-
},
152-
"references": [
153-
{
154-
"summary": "GitHub pull request",
155-
"url": "https://github.com/loopbackio/loopback-next/pull/6676"
162+
],
163+
"scores": [
164+
{
165+
"cvss_v3": {
166+
"attackComplexity": "LOW",
167+
"attackVector": "NETWORK",
168+
"availabilityImpact": "LOW",
169+
"baseScore": 7.3,
170+
"baseSeverity": "HIGH",
171+
"confidentialityImpact": "LOW",
172+
"exploitCodeMaturity": "UNPROVEN",
173+
"integrityImpact": "LOW",
174+
"privilegesRequired": "NONE",
175+
"remediationLevel": "OFFICIAL_FIX",
176+
"reportConfidence": "CONFIRMED",
177+
"scope": "UNCHANGED",
178+
"temporalScore": 6.4,
179+
"temporalSeverity": "MEDIUM",
180+
"userInteraction": "NONE",
181+
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/RL:O/E:U/RC:C",
182+
"version": "3.0"
156183
},
157-
{
158-
"summary": "X-Force Vulnerability Report",
159-
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192706"
160-
}
161-
],
162-
"remediations": [
163-
{
164-
"category": "vendor_fix",
165-
"date": "2020-05-11T08:22:42.000Z",
166-
"details": "Upgrade to `@loopback/rest` 9.0.0 or later.",
167-
"product_ids": [
168-
"1"
169-
]
170-
}
171-
],
172-
"scores": [
173-
{
174-
"cvss_v3": {
175-
"attackComplexity": "LOW",
176-
"attackVector": "NETWORK",
177-
"availabilityImpact": "LOW",
178-
"baseScore": 7.3,
179-
"baseSeverity": "HIGH",
180-
"confidentialityImpact": "LOW",
181-
"exploitCodeMaturity": "UNPROVEN",
182-
"integrityImpact": "LOW",
183-
"privilegesRequired": "NONE",
184-
"remediationLevel": "OFFICIAL_FIX",
185-
"reportConfidence": "CONFIRMED",
186-
"scope": "UNCHANGED",
187-
"temporalScore": 6.4,
188-
"temporalSeverity": "MEDIUM",
189-
"userInteraction": "NONE",
190-
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/RL:O/E:U/RC:C",
191-
"version": "3.0"
192-
},
193-
"products": [
194-
"1"
195-
]
196-
}
197-
]
198-
}
199-
]
200-
}
201-
184+
"products": ["1"]
185+
}
186+
]
187+
}
188+
]
189+
}

0 commit comments

Comments
 (0)