|
8 | 8 | checkoutOnSecurityReleaseBranch,
|
9 | 9 | NEXT_SECURITY_RELEASE_REPOSITORY,
|
10 | 10 | validateDate,
|
11 |
| - getSummary, |
12 | 11 | commitAndPushVulnerabilitiesJSON,
|
13 | 12 | NEXT_SECURITY_RELEASE_FOLDER
|
14 | 13 | } from './security-release/security-release.js';
|
@@ -84,6 +83,7 @@ export default class SecurityBlog {
|
84 | 83 | const releaseDate = new Date(content.releaseDate);
|
85 | 84 | const template = this.getSecurityPostReleaseTemplate();
|
86 | 85 | const data = {
|
| 86 | + // TODO: read from pre-sec-release |
87 | 87 | annoucementDate: await this.getAnnouncementDate(cli),
|
88 | 88 | releaseDate: this.formatReleaseDate(releaseDate),
|
89 | 89 | affectedVersions: this.getAffectedVersions(content),
|
@@ -205,46 +205,25 @@ export default class SecurityBlog {
|
205 | 205 | const reports = content.reports;
|
206 | 206 | let template = '';
|
207 | 207 | for (const report of reports) {
|
208 |
| - let cveId = report.cve_ids?.join(', '); |
| 208 | + const cveId = report.cveIds?.join(', '); |
209 | 209 | if (!cveId) {
|
210 |
| - // ask for the CVE ID |
211 |
| - // it should have been created with the step `--request-cve` |
212 |
| - cveId = await this.cli.prompt(`What is the CVE ID for vulnerability https://hackerone.com/reports/${report.id} ${report.title}?`, { |
213 |
| - questionType: 'input', |
214 |
| - defaultAnswer: 'TBD' |
215 |
| - }); |
216 |
| - report.cve_ids = [cveId]; |
217 |
| - content[kChanged] = true; |
| 210 | + this.cli.error(`CVE ID for vulnerability ${report.link} ${report.title} not found`); |
| 211 | + process.exit(1); |
218 | 212 | }
|
219 | 213 | template += `## ${report.title} (${cveId}) - (${report.severity.rating})\n\n`;
|
220 | 214 | if (!report.summary) {
|
221 |
| - const fetchIt = await this.cli.prompt(`Summary missing for vulnerability https://hackerone.com/reports/${report.id} ${report.title}.\ |
222 |
| - Do you want to try fetch it from HackerOne??`, { |
223 |
| - questionType: 'confirm', |
224 |
| - defaultAnswer: true |
225 |
| - }); |
226 |
| - |
227 |
| - if (fetchIt) { |
228 |
| - report.summary = await getSummary(report.id, this.req); |
229 |
| - content[kChanged] = true; |
230 |
| - } |
231 |
| - |
232 |
| - if (!report.summary) { |
233 |
| - this.cli.error(`Summary missing for vulnerability https://hackerone.com/reports/${report.id} ${report.title}. Please create it before continuing.`); |
234 |
| - process.exit(1); |
235 |
| - } |
| 215 | + this.cli.error(`Summary missing for vulnerability ${report.link} ` + |
| 216 | + `${report.title}. Please create it before continuing.`); |
| 217 | + process.exit(1); |
236 | 218 | }
|
| 219 | + |
237 | 220 | template += `${report.summary}\n\n`;
|
238 | 221 | const releaseLines = report.affectedVersions.join(', ');
|
239 | 222 | template += `Impact:\n\n- This vulnerability affects all users\
|
240 | 223 | in active release lines: ${releaseLines}\n\n`;
|
241 | 224 | if (!report.patchAuthors) {
|
242 |
| - const author = await this.cli.prompt(`Who fixed vulnerability https://hackerone.com/reports/${report.id} ${report.title}? If multiple use & as separator`, { |
243 |
| - questionType: 'input', |
244 |
| - defaultAnswer: 'TBD' |
245 |
| - }); |
246 |
| - report.patchAuthors = author.split('&').map((p) => p.trim()); |
247 |
| - content[kChanged] = true; |
| 225 | + this.cli.error(`Missing patch author for vulnerability ${report.link} ${report.title}`); |
| 226 | + process.exit(1); |
248 | 227 | }
|
249 | 228 | template += `Thank you, to ${report.reporter} for reporting this vulnerability\
|
250 | 229 | and thank you ${report.patchAuthors.join(' and ')} for fixing it.\n\n`;
|
|
0 commit comments