Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(cli): patch security vulnerability in https-proxy-agent (npm advisory 1184) #4603

Merged
merged 5 commits into from
Oct 21, 2019
Merged

fix(cli): patch security vulnerability in https-proxy-agent (npm advisory 1184) #4603

merged 5 commits into from
Oct 21, 2019

Conversation

rix0rrr
Copy link
Contributor

@rix0rrr rix0rrr commented Oct 21, 2019 •
edited by eladb

Package https-proxy-agent has a security vulnerability which has
required a major version bump to address: https://hackerone.com/reports/541502, https://www.npmjs.com/advisories/1184

We depend on this package via 2 other packages (proxy-agent and
pac-proxy-agent), both of which have had a GitHub PR applied to bump
their dependencies on the vulnerable package, but both of which have
not released that change.

Vendor in both packages with updated dependencies to eliminate the
dependency on the vulnerable version of https-proxy-agent.

Internal reference: t/P29683837

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@rix0rrr
chore(cli): vendor in all dependencies that depend on vulnerable package
0c3cca4 
Package `https-proxy-agent` has a security vulnerability which has
required a major version bump to address: https://hackerone.com/reports/541502

We depend on this package via 2 other packages (`proxy-agent` and
`pac-proxy-agent`), both of which have had a GitHub PR applied to bump
their dependencies on the vulnerable package, but both of which have
not released that change.

Vendor in both packages with updated dependencies to eliminate the
dependency on the vulnerable version of `https-proxy-agent`.

Internal reference: t/P29683837
@mergify
Copy link
Contributor

mergify bot commented Oct 21, 2019

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

  • PR title type(scope): text
    • type: fix, feat, refactor go into CHANGELOG, chore is hidden
    • scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
    • text: use all lower-case, do not end with a period, do not include issue refs
  • PR Description
    • Rationale: describe rationale of change and approach taken
    • Issues: indicate issues fixed via: fixes #xxx or closes #xxx
    • Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
  • Testing
    • Unit test added. Prefer to add a new test rather than modify existing tests
    • CLI or init templates change? Re-run/add CLI integration tests
  • Documentation
    • README: update module README to describe new features
    • API docs: public APIs must be documented. Copy from official AWS docs when possible
    • Design: for significant features, follow design process

RomainMuller
RomainMuller suggested changes Oct 21, 2019
View reviewed changes
Copy link
Contributor

@RomainMuller RomainMuller left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe this way can work in the mono-repo, but I suspect it'll fail once the packages are consumed from npm pack output (e.g. when consuming from the registry). I believe npm install will attempt to resolve the dependency closure before it goes to install anything, which in this case will fail (because the nested vendor directory won't be there yet.

My recommendation would be to:

  • Vendor-in tarballs for the fixed packages (instead of their source - it'll be leaner)
    • Make sure the vendor directory is .npmignored
  • Refer to the tarballs from the dependencies section
  • Add the fixed up packages to bundledDependencies, so they are not resolved from registry but simply inherited from the CLI's tarball itself

Obviously, strongly recommend running integration tests on the resulting packages, to make sure they're installable (and have the correct (aka fixed) versions of those two libraries.

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@eladb
Copy link
Contributor

eladb commented Oct 21, 2019

@RomainMuller wrote:

which in this case will fail (because the nested vendor directory won't be there yet.

Why wouldn’t the vendor directory be there? We want to include it in our tarball.

@eladb eladb changed the title chore(cli): vendor in all dependencies that depend on vulnerable package fix(cli): patch security vulnerability in https-proxy-agent (https://hackerone.com/reports/541502) Oct 21, 2019
@eladb
Copy link
Contributor

eladb commented Oct 21, 2019

Okay @RomainMuller seems to be right (a lot):

❯ npm i /Users/benisrae/code/cdk/aws-cdk/packages/aws-cdk/aws-cdk-1.13.1.tgz
npm ERR! code ENOLOCAL
npm ERR! Could not install "../../code/cdk/aws-cdk/packages/aws-cdk/aws-cdk-1.13.1.tgz/vendored/proxy-agent" as it is not a directory and is not a file with a name ending in .tgz, .tar.gz or .tar

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/benisrae/.npm/_logs/2019-10-21T13_32_11_060Z-debug.log

@eladb eladb changed the title fix(cli): patch security vulnerability in https-proxy-agent (https://hackerone.com/reports/541502) fix(cli): patch security vulnerability in https-proxy-agent (npm advisory 1184) Oct 21, 2019
@SomayaB SomayaB added the contribution/core This is a PR that came from AWS. label Oct 21, 2019
@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • Result: FAILED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • Result: FAILED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify
Copy link
Contributor

mergify bot commented Oct 21, 2019

Thank you for contributing! Your pull request is now being automatically merged.

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit ddb05f9 into master Oct 21, 2019
@mergify mergify bot deleted the huijbers/vendor-cli-deps branch October 21, 2019 17:09
@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

eladb pushed a commit that referenced this pull request Oct 21, 2019
Revert "fix(cli): patch security vulnerability in https-proxy-agent (…
816cbec 
…npm advisory 1184) (#4603)"

This reverts commit ddb05f9.
shivlaks pushed a commit that referenced this pull request Oct 21, 2019
@shivlaks
Revert "fix(cli): patch security vulnerability in https-proxy-agent (…
71621b6 
…npm advisory 1184) (#4603)" (#4611)

This reverts commit ddb05f9.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@RomainMuller RomainMuller RomainMuller approved these changes

@eladb eladb Awaiting requested review from eladb

Assignees

@shivlaks shivlaks

Labels
contribution/core This is a PR that came from AWS.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@rix0rrr @aws-cdk-automation @eladb @RomainMuller @SomayaB @shivlaks