Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: fixing vulnerability: server-side request forgery in axios #135

Merged
merged 12 commits into from
Aug 27, 2024

Conversation

jkalandaibm
Copy link
Collaborator

@jkalandaibm jkalandaibm commented Aug 21, 2024

PR summary

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

Fixes:
image

also due to the changes in in node-sdk-core, under the following PR: IBM/node-sdk-core@901ece0

I had to re-adjust the UT files to ensure the functions used for testing are pulled from ibm-cloud/sdk-test-utilities versus its original directory.
As a result of those needed manual changes, a PR generated by dependabot - #134 was failing.

Snippet of one of the many failing messages:

FAIL test/unit/direct-link.v1.test.js
  ● Test suite failed to run
    TypeError: Cannot destructure property 'getOptions' of 'unitTestUtils' as it is undefined.
      26 |
      27 | const {
    > 28 |   getOptions,
         |   ^
      29 |   checkUrlAndMethod,
      30 |   checkMediaHeaders,
      31 |   expectToBePromise,
      at Object.getOptions (test/unit/direct-link.v1.test.js:28:3)

PR Checklist

Please make sure that your PR fulfills the following requirements:

  • The commit message follows the Angular Commit Message Guidelines.
  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been added / updated (for bug fixes / features)

PR Type

  • Bugfix
  • Feature
  • Code style update (formatting, local variables)
  • Refactoring (no functional changes, no api changes)
  • New tests
  • Build/CI related changes
  • Documentation content changes
  • Other (please describe)

What is the current behavior?

What is the new behavior?

Does this PR introduce a breaking change?

  • Yes
  • [x ] No

Other information

dependency: none
Signed-off-by: jkalanda <[email protected]>
dependency: none
Signed-off-by: jkalanda <[email protected]>
dependency: none
Signed-off-by: jkalanda <[email protected]>
dependency: none
Signed-off-by: jkalanda <[email protected]>
dependency: none
Signed-off-by: jkalanda <[email protected]>
dependency: none
Signed-off-by: jkalanda <[email protected]>
dependency: none
Signed-off-by: jkalanda <[email protected]>
dependency: none
Signed-off-by: jkalanda <[email protected]>
@jkalandaibm
Copy link
Collaborator Author

@srukotla your fix didn't solve the problem. The builds are failing. Please review this.

Copy link
Collaborator

@arjunchauhanibm arjunchauhanibm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good

@jkalandaibm jkalandaibm merged commit b31748f into master Aug 27, 2024
4 checks passed
MalarvizhiK pushed a commit that referenced this pull request Aug 27, 2024
## [0.35.2](v0.35.1...v0.35.2) (2024-08-27)

### Bug Fixes

* fixing vulnerability: server-side request forgery in axios ([#135](#135)) ([b31748f](b31748f))
@MalarvizhiK
Copy link
Member

🎉 This PR is included in version 0.35.2 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants