[GHSA-6628-q6j9-w8vg] gRPC Reachable Assertion issue

[jonasfj]

Updates

• Affected products

Comments
The fix grpc/grpc@2485fa9 referenced in the description doesn't touch any code used by the Dart grpc implementation.

[darakian]

Hey there, is the dart code a parallel implementation?

[jonasfj]

is the dart code a parallel implementation?

Yes, if you look at the Dart package on pub.dev:
https://pub.dev/packages/grpc

It has pubspec.yaml with repository set to https://github.com/grpc/grpc-dart, see:
https://pub.dev/packages/grpc/pubspec

---

There is both a repository and a homepage field in the pubspec.yaml (some packages have both, some only have one of them, some link to a folder in a repository). But looking for github.com/<org>/<repo> with a regex works pretty reliably.

We have APIs that makes it easy to list all package names, and get the pubspec.yaml for each package, so it should be easy to create a mapping from package name to github repository. Feel free to hit me up for details jonasfj@google.com.

[jonasfj]

Actually, looking at NuGet (where I don't have any expertise), it seems like:

• https://github.com/grpc/grpc-dotnet contains the implementation for:
  • Grpc.AspNetCore
  • Grpc.Net.Client
  • Grpc.Net.ClientFactory
• https://github.com/grpc/grpc contains the implementation for:
  • Grpc.Core

Just by looking at the "Source repository" link on nuget.org.

[darakian]

Gotcha. I can go ahead and remove the dart package for this (and the other two). Looking at the nuget package it would see that Grpc.Core is an older implementation
https://github.com/grpc/grpc-dotnet#grpc-for-net-is-now-the-recommended-implementation
I'll update that as well 👍

We have APIs that makes it easy to list all package names, and get the pubspec.yaml for each package, so it should be easy to create a mapping from package name to github repository. Feel free to hit me up for details jonasfj@google.com.

The edge cases end up being the hard part for that mapping. Will reach out whenever I get to it though 😄

[advisory-database]

Hi @jonasfj! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!