mirror of
https://github.com/lancedikson/bowser
synced 2026-09-23 04:24:54 +00:00
982a91d5e8
Code scanning (js/polynomial-redos, alerts #16 and #17) ------------------------------------------------------- bowser applies these regexps to attacker-controlled User-Agent strings, and four of them ran in quadratic time: * The "Something else" fallback used /^(.*)\/(.*) / and /^(.*)\/(.*)[ \t]\((.*)/. Two unbounded `.*` before a required literal make the split ambiguous, so a UA of "/a" repeated backtracks O(n^2). Greedy `(.*)` always picks the last `/` that still has the delimiter after it, so the second group can never span a `/` -- narrowing it to `[^/]*` is exactly equivalent and removes the ambiguity. Verified identical on 1,000,000 fuzzed inputs and on the full acceptance corpus. * The Linespider and SlackBot version regexps used `(?:-[-\w]+)?` before a required `[\s/]`. Since `[-\w]` and `[\s/]` are disjoint the backtracking is pure waste, but the engine still walks it once per start position, so "linespider-" repeated is quadratic. Bounding the run to `{1,64}` makes it linear; no real bot-name suffix approaches 64 characters. A sweep of all 253 regexp literals in src/ (fuzzed for superlinear scaling, with the four pre-fix patterns used to confirm the detector works) reports no remaining superlinear regexps. test/unit/redos.js locks this in. Actions (actions/missing-workflow-permissions, alerts #5 and #15) ----------------------------------------------------------------- merge-to-master.yml and draft-or-update-next-release.yml had no `permissions` block and so inherited the default token. Both now declare least privilege, matching publish.yml and pull-request.yml. Dependabot (22 open alerts, all development scope) -------------------------------------------------- bowser ships no runtime dependencies, so none of these reached consumers, but they were live in CI. `pnpm audit` goes from 29 advisories to 0: * jsdoc 3 -> 4 (with docdash 1 -> 2) drops taffydb, which has no patched release, and picks up current markdown-it/linkify-it. * coveralls -> coveralls-next 6 drops `request`, which is deprecated with no patched release, along with form-data, qs 6.5.x, uuid 3 and tough-cookie 2. Same `coveralls` bin and same stdin contract; lcov conversion verified. * gh-pages 3 -> 6 clears the critical prototype pollution advisory. * pnpm overrides pin the remaining transitive-only advisories to the lowest patched release on each existing major. Verified: pnpm audit clean, lint clean, 346 tests pass (the acceptance corpus runs against both src/ and the built es5.js), build, package smoke test, and doc generation.
41 lines
1.1 KiB
YAML
41 lines
1.1 KiB
YAML
name: "Merge to master"
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Get branch name
|
|
shell: bash
|
|
run: echo "BRANCH_NAME=$(echo ${GITHUB_REF#refs/heads/} | tr / -)" >> $GITHUB_ENV
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v4
|
|
|
|
# tsdown requires Node ^22.18.0 || >=24.11.0. The published artifacts are
|
|
# still ES5 — see the `pack-smoke` job in pull-request.yml.
|
|
- name: Set up node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "24"
|
|
cache: pnpm
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
- run: pnpm build
|
|
|
|
# `pnpm test` already runs ava under nyc; this only reports the result.
|
|
- run: pnpm test && pnpm exec nyc report --reporter=text-lcov | pnpm exec coveralls
|
|
env:
|
|
COVERALLS_SERVICE_NAME: GithubActions
|
|
COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
|
|
COVERALLS_GIT_BRANCH: ${{ env.BRANCH_NAME }}
|