fix(remediation): withhold cross-wired suggested fix targets - #1101
Closed
Ayush7614 wants to merge 1 commit into
Closed
fix(remediation): withhold cross-wired suggested fix targets#1101Ayush7614 wants to merge 1 commit into
Ayush7614 wants to merge 1 commit into
Conversation
Refs OWASP#1007. suggestedFixCommands could emit axios@4.0.6 - a version that never existed for axios and belongs to form-data in the same scan - producing an install command that fails outright and misreads as a 3-major breaking upgrade. Guard direct targets: when a target jumps 2+ majors AND exactly matches another package's installed/fixed version in the same scan, withhold it with an actionable skipped reason instead of emitting it. Also harden upsertTarget so one divergent-major finding cannot hijack the merged same-package target away from the conservative major line.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #1007.
Summary
suggestedFixCommandscould emitaxios@4.0.6— a version that never existed for axios and belongs toform-datain the same scan. The emittednpm install axios@4.0.6fails outright and misreads as a 3-major breaking upgrade when the real fix is an in-major patch (axios@1.19.0).Changes
isSuspectCrossWiredTarget()guard insrc/remediation/fix-commands.ts: a direct target that jumps 2+ majors AND exactly matches another package's installed/fixed version in the same scan is withheld with an actionable skipped reason instead of emitted.upsertTarget(): same-package findings that disagree on target major keep the conservative (lower-major) target, so one divergent finding cannot hijack the merged target.majorOf()helper for reuse and testing.Verification
tests/fix-commands-crosswire.test.ts: 6 tests pass (detector unit tests + end-to-end plan regression reproducing the axios/form-data/js-yaml scan from the issue).npm run buildpasses; existing classifier/fix-command tests unaffected.