fix: zip cross directory attack vulnerability #312
Merged
Annotations
2 errors and 1 warning
|
Run anc95/ChatGPT-CodeReview@main
HttpError: Resource not accessible by integration
at /home/runner/work/_actions/anc95/ChatGPT-CodeReview/main/action/index.cjs:3619:21
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async Job.doExecute (/home/runner/work/_actions/anc95/ChatGPT-CodeReview/main/action/index.cjs:34577:18)
{
err: {
type: 'AggregateError',
message: '\n' +
' HttpError: Resource not accessible by integration\n' +
' at /home/runner/work/_actions/anc95/ChatGPT-CodeReview/main/action/index.cjs:3619:21\n' +
' at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n' +
' at async Job.doExecute (/home/runner/work/_actions/anc95/ChatGPT-CodeReview/main/action/index.cjs:34577:18)',
stack: 'AggregateError: \n' +
' HttpError: Resource not accessible by integration\n' +
' at /home/runner/work/_actions/anc95/ChatGPT-CodeReview/main/action/index.cjs:3619:21\n' +
' at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n' +
' at async Job.doExecute (/home/runner/work/_actions/anc95/ChatGPT-CodeReview/main/action/index.cjs:34577:18)\n' +
' at /home/runner/work/_actions/anc95/ChatGPT-CodeReview/main/action/index.cjs:12925:19',
aggregateErrors: [
{
type: 'RequestError',
message: 'Resource not accessible by integration',
stack: 'HttpError: Resource not accessible by integration\n' +
' at /home/runner/work/_actions/anc95/ChatGPT-CodeReview/main/action/index.cjs:3619:21\n' +
' at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n' +
' at async Job.doExecute (/home/runner/work/_actions/anc95/ChatGPT-CodeReview/main/action/index.cjs:34577:18)',
name: 'HttpError',
status: 403,
response: {
url: 'https://api.github.com/repos/opentiny/tiny-engine-backend-java/issues/312/comments',
status: 403,
headers: {
'access-control-allow-origin': '*',
'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset, Warning',
connection: 'close',
'content-encoding': 'gzip',
'content-security-policy': "default-src 'none'",
'content-type': 'application/json; charset=utf-8',
date: 'Fri, 29 May 2026 07:57:19 GMT',
'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
server: 'github.com',
'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
'transfer-encoding': 'chunked',
vary: 'Accept-Encoding, Accept, X-Requested-With',
'x-accepted-github-permissions': 'issues=write; pull_requests=write',
'x-content-type-options': 'nosniff',
'x-frame-options': 'deny',
'x-github-api-version-selected': '2022-11-28',
'x-github-media-type': 'github.v3; format=json',
'x-github-request-id': '1401:2E7438:20A1F8F:7C4AD06:6A1946DF',
'x-ratelimit-limit': '5000',
'x-ratelimit-remaining': '4996',
'x-ratelimit-reset': '1780043732',
'x-ratelimit-resource': 'core',
'x-ratelimit-used': '4',
'x-xss-protection': '0'
},
data: {
message: 'Resource not accessible by integration',
documentation_url: 'https://docs.github.com/rest/issues/comments#create-an-issue-comment',
status: '403'
}
},
request: {
method: 'POST',
url: 'https://api.github.com/repos/opentiny/tiny-engine-backend-java/issues/312/comments',
headers: {
accept: 'application/vnd.github.v3+js
|
|
Run anc95/ChatGPT-CodeReview@main
Resource not accessible by integration
{
name: 'event',
id: '26625508282',
err: {
type: 'RequestError',
message: 'Resource not accessible by integration',
stack: 'HttpError: Resource not accessible by integration\n' +
' at /home/runner/work/_actions/anc95/ChatGPT-CodeReview/main/action/index.cjs:3619:21\n' +
' at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n' +
' at async Job.doExecute (/home/runner/work/_actions/anc95/ChatGPT-CodeReview/main/action/index.cjs:34577:18)',
name: 'HttpError',
status: 403,
response: {
url: 'https://api.github.com/repos/opentiny/tiny-engine-backend-java/issues/312/comments',
status: 403,
headers: {
'access-control-allow-origin': '*',
'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset, Warning',
connection: 'close',
'content-encoding': 'gzip',
'content-security-policy': "default-src 'none'",
'content-type': 'application/json; charset=utf-8',
date: 'Fri, 29 May 2026 07:57:19 GMT',
'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
server: 'github.com',
'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
'transfer-encoding': 'chunked',
vary: 'Accept-Encoding, Accept, X-Requested-With',
'x-accepted-github-permissions': 'issues=write; pull_requests=write',
'x-content-type-options': 'nosniff',
'x-frame-options': 'deny',
'x-github-api-version-selected': '2022-11-28',
'x-github-media-type': 'github.v3; format=json',
'x-github-request-id': '1401:2E7438:20A1F8F:7C4AD06:6A1946DF',
'x-ratelimit-limit': '5000',
'x-ratelimit-remaining': '4996',
'x-ratelimit-reset': '1780043732',
'x-ratelimit-resource': 'core',
'x-ratelimit-used': '4',
'x-xss-protection': '0'
},
data: {
message: 'Resource not accessible by integration',
documentation_url: 'https://docs.github.com/rest/issues/comments#create-an-issue-comment',
status: '403'
}
},
request: {
method: 'POST',
url: 'https://api.github.com/repos/opentiny/tiny-engine-backend-java/issues/312/comments',
headers: {
accept: 'application/vnd.github.v3+json',
'user-agent': 'probot/12.3.0 octokit-core.js/3.6.0 Node.js/20.20.2 (linux; x64)',
authorization: 'bearer [REDACTED]',
'content-type': 'application/json; charset=utf-8'
},
body: `{"body":"Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow [readme](https://github.com/anc95/ChatGPT-CodeReview) for more information"}`,
request: { retryCount: 1 }
},
event: {
id: '26625508282',
name: 'pull_request',
payload: {
action: 'synchronize',
after: '2f16f6def7d27c2fe91aeff50c1d80092e6b05c4',
before: '6badb4169d10004b8f564b868b939b815fbcd0c0',
number: 312,
organization: {
avatar_url: 'https://avatars.githubusercontent.com/u/108050589?v=4',
description: 'OpenTiny 是一套企业级前端开发解决方案，提供基于 Vue 的跨端、跨框架 TinyVue 组件库，包含基于 Angular 的 TinyNG 组件库，拥有灵活扩展的低代码引擎 TinyEngine，具备主题配置系统 TinyTheme / 中后台模板TinyPro/TinyCLI命令行等丰富的效率工具。',
events_url: 'https://api.github.com/orgs/opentiny/events',
hooks_url: 'https://api.github.com/orgs/opentiny/hooks',
id: 108050589,
issues_url: 'https://api.github.com/orgs/opentiny/issues',
login: 'opentiny',
members_url: 'https://api.github.com/orgs
|
|
Complete job
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: anc95/ChatGPT-CodeReview@main. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
background
wait
wait-all
cancel
Loading