Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] Remedy vulnerabilities #3184

Merged
merged 3 commits into from
Mar 3, 2024

Conversation

TomerShor
Copy link
Contributor

@TomerShor TomerShor commented Feb 29, 2024

Introduce fixes to remedy some vulnerabilities found by Snyk:

  • Replace "github.com/disintegration/imaging" with "github.com/anthonynsimon/bild", and modify the image function example accordingly.
  • Bump some packages
  • Sanitize paths in a python script to avoid path traversal
  • Escape regex expressions
  • Avoid insecure TLS communication by making it configurable
  • Sanitize invocation result data before returning it to the caller

Copy link
Contributor

@liranbg liranbg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Very well. Minor one

pkg/auth/types.go Outdated Show resolved Hide resolved
@TomerShor TomerShor marked this pull request as ready for review March 3, 2024 11:25
@TomerShor TomerShor merged commit eef9de5 into nuclio:development Mar 3, 2024
11 checks passed
@TomerShor TomerShor deleted the security-updates branch March 3, 2024 14:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants