Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency @backstage/plugin-scaffolder-backend to v1.15.0 [security] - autoclosed #195

Closed
wants to merge 1 commit into from
Closed

fix(deps): update dependency @backstage/plugin-scaffolder-backend to v1.15.0 [security] - autoclosed #195

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 21, 2023 •
edited
Loading

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@backstage/plugin-scaffolder-backend (source) 1.10.1 -> 1.15.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-35926

The Backstage scaffolder-backend plugin uses a templating library that requires a sandbox, as it by design allows for code injection. The library used for this sandbox so far has been vm2, but in light of several past vulnerabilities and existing vulnerabilities that may not have a fix, the plugin has switched to using a different sandbox library.

Impact

A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data.

Patches

This is vulnerability is fixed in version 1.15.0 of @backstage/plugin-scaffolder-backend.

Workarounds

Note that the Backstage Threat Model states that scaffolder templates are considered to be a sensitive area that with the recommendation that you control access and perform manual reviews of changes to the scaffolder templates. The exploit is of a nature where it is easily discoverable in manual review.

Release Notes

backstage/backstage (@​backstage/plugin-scaffolder-backend)

v1.15.0

Compare Source

Minor Changes

  • 84b0e47: Add TargetBranchName variable and output for the publish:gitlab:merge-request and publish:github:pull-request s'cascaffolder actions.

  • 6a694ce: Add a scaffolder action that pull-requests for bitbucket server

  • 1948845: Added github:deployKey:create and github:environment:create scaffolder actions. You will need to add read/write permissions to your GITHUB_TOKEN and/or Github Backstage App for Repository Administration (for deploy key functionality) and Environments (for Environment functionality)

  • df84117: Add support for Repository Variables and Secrets to the publish:github and github:repo:create scaffolder actions. You will need to add read/write permissions to your GITHUB_TOKEN and/or Github Backstage App for Repository Secrets and Variables

    Upgrade octokit introduces some breaking changes.

Patch Changes

v1.14.0

Compare Source

Minor Changes

  • 67115f5: Expose both types of scaffolder permissions and rules through the metadata endpoint.

    The metadata endpoint now correctly exposes both types of scaffolder permissions and rules (for both the template and action resource types) through the metadata endpoint.

  • a73b3c0: Add ability to use defaultNamespace and defaultKind for scaffolder action catalog:fetch

Patch Changes

v1.13.1

Compare Source

This release bumps the minimum required version of vm2 to 3.9.17

v1.13.0

Compare Source

Minor Changes

  • 2b15cb4: The non-PR/MR Git Actions now return the commit hash of the commit pushed as a new output called commitHash, isomorphic-git is now on version 1.23.0

  • 30ffdae: Added fetch:plain:file action to fetch a single file, this action is also added to the list of built-in actions.

  • 65e989f: Added the possibility to authorize parameters and steps of a template

    The scaffolder plugin is now integrated with the permission framework.
    It is possible to toggle parameters or actions within templates by marking each section with specific tags, inside a backstage:permissions property under each parameter or action. Each parameter or action can then be permissioned by using a conditional decision containing the scaffolderTemplateRules.hasTag rule.

  • 3b68b09: Renamed permissionApi router option to permissions

  • bcae5aa: Added the possibility to authorize actions

    It is now possible to decide who should be able to execute certain actions or who should be able to pass specific input to specified actions.

    Some of the existing utility functions for creating conditional decisions have been renamed:

    • createScaffolderConditionalDecision has been renamed to createScaffolderActionConditionalDecision
    • scaffolderConditions has been renamed to scaffolderTemplateConditions

  • d7c8c22: Allow for a commit message to differ from the PR title when publishing a GitHub pull request.

  • 95ea9f6: Provide some more default filters out of the box and refactoring how the filters are applied to the SecureTemplater.

    • parseEntityRef will take an string entity triplet and return a parsed object.
    • pick will allow you to reference a specific property in the piped object.

    So you can now combine things like this: ${{ parameters.entity | parseEntityRef | pick('name') }} to get the name of a specific entity, or ${{ parameters.repoUrl | parseRepoUrl | pick('owner') }} to get the owner of a repo.

Patch Changes

v1.12.0

Compare Source

Minor Changes
  • 7d724d8: Added the ability to be able to define an actions input and output schema using zod instead of hand writing types and jsonschema
Patch Changes

v1.11.0

Compare Source

Minor Changes
  • 0b2952e: Added the option to overwrite files in the targetPath of the template:fetch action
  • 1271549: Renamed the export scaffolderCatalogModule to catalogModuleTemplateKind in order to follow the new recommended naming patterns of backend system items. This is technically a breaking change but in an alpha export, so take care to change your imports if you have already migrated to the new backend system.
Patch Changes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot changed the title fix(deps): update dependency @backstage/plugin-scaffolder-backend to v1.15.0 [security] fix(deps): update dependency @backstage/plugin-scaffolder-backend to v1.15.0 [security] - autoclosed Oct 27, 2023
@renovate renovate bot closed this Oct 27, 2023
@renovate renovate bot deleted the renovate/npm-@backstage/plugin-scaffolder-backend-vulnerability branch October 27, 2023 06:47
@renovate renovate bot changed the title fix(deps): update dependency @backstage/plugin-scaffolder-backend to v1.15.0 [security] - autoclosed fix(deps): update dependency @backstage/plugin-scaffolder-backend to v1.15.0 [security] Oct 27, 2023
@renovate renovate bot reopened this Oct 27, 2023
@renovate renovate bot restored the renovate/npm-@backstage/plugin-scaffolder-backend-vulnerability branch October 27, 2023 06:48
@renovate renovate bot force-pushed the renovate/npm-@backstage/plugin-scaffolder-backend-vulnerability branch 2 times, most recently from 9a23f32 to 2273b1b Compare October 28, 2023 19:50
@renovate renovate bot force-pushed the renovate/npm-@backstage/plugin-scaffolder-backend-vulnerability branch 6 times, most recently from 30c8261 to 7e9aad1 Compare November 12, 2023 23:00
@renovate renovate bot force-pushed the renovate/npm-@backstage/plugin-scaffolder-backend-vulnerability branch 2 times, most recently from 7558825 to 98400f3 Compare November 16, 2023 11:12
@renovate renovate bot force-pushed the renovate/npm-@backstage/plugin-scaffolder-backend-vulnerability branch 3 times, most recently from 558f602 to d541a2a Compare December 9, 2023 15:57
@renovate renovate bot force-pushed the renovate/npm-@backstage/plugin-scaffolder-backend-vulnerability branch from d541a2a to c8a94b9 Compare December 13, 2023 13:37
@renovate renovate bot force-pushed the renovate/npm-@backstage/plugin-scaffolder-backend-vulnerability branch 4 times, most recently from 2a8cfec to 0a8a27e Compare January 21, 2024 01:04
@renovate renovate bot force-pushed the renovate/npm-@backstage/plugin-scaffolder-backend-vulnerability branch from 0a8a27e to 2251389 Compare January 21, 2024 16:24
@renovate renovate bot changed the title fix(deps): update dependency @backstage/plugin-scaffolder-backend to v1.15.0 [security] fix(deps): update dependency @backstage/plugin-scaffolder-backend to v1.15.0 [security] - autoclosed Jan 21, 2024
@renovate renovate bot closed this Jan 21, 2024
@renovate renovate bot deleted the renovate/npm-@backstage/plugin-scaffolder-backend-vulnerability branch January 21, 2024 21:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@jvilimek jvilimek

Labels
dependencies packages
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@jvilimek