Skip to content

Full-prettier-run - #8605

Merged
jackkav merged 2 commits into
Kong:developfrom
jackkav:full-prettier-run
Apr 11, 2025
Merged

Full-prettier-run#8605
jackkav merged 2 commits into
Kong:developfrom
jackkav:full-prettier-run

Conversation

@jackkav

@jackkav jackkav commented Apr 11, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

removes markdown linting in favour of autoformatting

autoformats entire repo with npx prettier . --write

github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 11, 2025
View reviewed changes
Comment thread packages/insomnia-inso/src/cli.test.ts
input: string,
): Promise<{ code: number; error: ExecException | null; stdout: string; stderr: string }> => {
return new Promise(resolve =>
exec(input, { cwd: path.resolve(__dirname, '../../..') }, (error, stdout, stderr) =>

Check failure

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.detect-child-process.detect-child-process

Detected calls to child_process from a function argument `input`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.
Comment thread packages/insomnia-inso/src/db/adapters/git-adapter.ts
files.map(file =>
readAndInsertDoc(t, path.join(dir, '.insomnia', t, file)),
),
files.map(file => readAndInsertDoc(t, path.join(dir, '.insomnia', t, file))),

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
Comment thread packages/insomnia-inso/src/db/adapters/git-adapter.ts
files.map(file =>
readAndInsertDoc(t, path.join(dir, '.insomnia', t, file)),
),
files.map(file => readAndInsertDoc(t, path.join(dir, '.insomnia', t, file))),

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
Comment thread packages/insomnia-inso/src/db/adapters/git-adapter.ts
files.map(file =>
readAndInsertDoc(t, path.join(dir, '.insomnia', t, file)),
),
files.map(file => readAndInsertDoc(t, path.join(dir, '.insomnia', t, file))),

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
Comment thread packages/insomnia-inso/src/scripts/artifacts.ts
Comment on lines +21 to +31
return spawn(
'tar',
[
'-C',
'../binaries',
platform === 'win32' ? '-a -cf' : '-cJf',
platform === 'win32' ? `inso-windows-${version}.zip` : `inso-linux-${process.arch}-${version}.tar.xz`,
platform === 'win32' ? 'inso.exe' : 'inso',
],
{ cwd, shell: platform === 'win32' },
);

Check failure

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true

Found '$SPAWN' with '{shell: platform === 'win32'}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead.
Comment thread packages/insomnia/src/network/grpc/write-proto-file.ts
.map(f => f.name)
.reverse()
.slice(1),
protoFile.name,

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
Comment thread packages/insomnia/src/network/o-auth-2/get-token.ts
urlFailureRegex: authentication.redirectUrl ?
new RegExp(`${escapeRegex(authentication.redirectUrl)}.*([?&]error=)`, 'i') : /([?&]error=)/i,
urlSuccessRegex: authentication.redirectUrl
? new RegExp(`${escapeRegex(authentication.redirectUrl)}.*([?&]code=)`, 'i')

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp

RegExp() called with a `authentication` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
Comment thread packages/insomnia/src/network/o-auth-2/get-token.ts
? new RegExp(`${escapeRegex(authentication.redirectUrl)}.*([?&]code=)`, 'i')
: /([?&]code=)/i,
urlFailureRegex: authentication.redirectUrl
? new RegExp(`${escapeRegex(authentication.redirectUrl)}.*([?&]error=)`, 'i')

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp

RegExp() called with a `authentication` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
Comment thread packages/insomnia/src/ui/components/settings/plugins.tsx
const link = path.join(/^insomnia-plugin-/.test(plugin.name) ? PLUGIN_HUB_BASE : NPM_PACKAGE_BASE, plugin.name);
const link = path.join(
/^insomnia-plugin-/.test(plugin.name) ? PLUGIN_HUB_BASE : NPM_PACKAGE_BASE,
plugin.name,

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
Comment thread packages/insomnia/src/ui/routes/design.tsx
@@ -111,7 +103,7 @@

const spectralRulesetPath = path.join(
process.env['INSOMNIA_DATA_PATH'] || window.app.getPath('userData'),
`version-control/git/${gitRepositoryId}/other/.spectral.yaml`
`version-control/git/${gitRepositoryId}/other/.spectral.yaml`,

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
@jackkav
jackkav merged commit b30978e into Kong:develop Apr 11, 2025
@jackkav
jackkav deleted the full-prettier-run branch April 11, 2025 11:37
cwangsmv pushed a commit that referenced this pull request Apr 21, 2025
@jackkav @notjaywu
Full-prettier-run (#8605)
c54ef80 
* prettier

* remove markdown linting
@sentry

sentry Bot commented Apr 24, 2025 •
edited
Loading

Copy link
Copy Markdown

Suspect Issues

This pull request was deployed and Sentry observed the following issues:

  • ‼️ Error: net::ERR_UNEXPECTED AutoUpdater.?(src/main/updates) View Issue
  • ‼️ TypeError: Cannot read properties of null (reading 'constructor') Array.reduce(<anonymous>) View Issue
  • ‼️ Error: Test bump in root /index.html View Issue
  • ‼️ Error: Expected fetch controller: :r1f: app:///index.html View Issue
  • ‼️ TypeError: Cannot read properties of null (reading '_id') <object>.network.sendRequest(src/plugins/contex... View Issue

Did you find this useful? React with a 👍 or 👎

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pavkout pavkout pavkout approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jackkav @pavkout @github-advanced-security