fix(remediation): stop parent-update targets merging into install targets - #1113
Open
osfv wants to merge 1 commit into
Open
fix(remediation): stop parent-update targets merging into install targets#1113osfv wants to merge 1 commit into
osfv wants to merge 1 commit into
Conversation
…gets A within-range refresh (parent-update) target carries the vulnerable child's version under the parent's package name. Keyed by package name alone it merged with the direct install target for the same parent, and the child's higher version won the merge, so the plan pinned the parent to a version that does not exist (npm install axios@4.0.6, where 4.0.6 is form-data's version). Key parent-update targets separately, per parent and child, so they only merge with a refresh of the same child through the same parent. Install targets keep merging per package as before. Closes OWASP#1007
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed and why
suggestedFixCommandscould emit a version that does not exist for the package it names, e.g.npm install axios@4.0.6where 4.0.6 is form-data's version.The reported diagnosis (index-aligned lookup) pointed at the right area but the mechanism is slightly different. In
buildSuggestedFixCommandPlanthe accumulator is keyed by package name only. A transitive finding whose remediation is a within-range refresh produces aparent-updatetarget withpackage= the parent (axios) andtargetVersion= the child's version (4.0.6), because that target means "refresh form-data within axios's range", not "install axios@4.0.6". When a direct finding for axios also exists, the two land on the same key, andupsertTarget's "higher version wins" merge compares versions of two different packages, so form-data's 4.0.6 replaces axios's 1.19.0 and the merged target is emitted as a direct install.Fix: key
parent-updatetargets in their own keyspace, per parent and per child, so they only merge with a refresh of the same child through the same parent. Install targets (direct / parent-upgrade) keep merging per package exactly as before. Each finding keeps resolving to its own target throughfindFixTargetForFinding, and coverage counts are unchanged.For the repro in the issue the plan now emits
npm update axios && npm install axios@1.19.0 js-yaml@4.3.1. The refresh is kept rather than dropped becausenpm install axios@1.19.0alone does not guarantee npm re-resolves an already-lockedform-data@4.0.5that still satisfies the range.Tests:
tests/remediation/fix-commands-parent-update-merge.test.tscovers the issue repro, two refreshes of different children through the same parent, and the unchanged merge of repeated install targets.Verified against current main (#1084 / #1085 moved
findFirstFixedVersionbut do not touch this path).Note: #1007 is assigned to @alamb-hex. The maintainer's check-in on Sept 6 had no reply, so I went ahead; happy to close this in favour of theirs if they are still working on it.
Closes #1007