pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-26 09:52:11 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): bump adm-zip >=0.6.0 + exact host matching in mitm DNS test (#7733)

Browse Source
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-07-19 11:15:24 -03:00
committed by GitHub
parent 8e383f5c02
commit 698b6eb00d
4 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
changelog.d/fixes/sec-adm-zip-codeql-host-match.md Normal file
View File

@@ -0,0 +1 @@
- fix(security): bump adm-zip to ^0.6.0 (dev transitive via promptfoo/onnxruntime-node) to clear the crafted-ZIP 4GB-allocation advisory, and tighten mitm DNS test host assertion to exact matching (CodeQL js/incomplete-url-substring-sanitization)

8
package-lock.json generated
View File

@@ -13121,14 +13121,14 @@
} }
}, },
"node_modules/adm-zip": { "node_modules/adm-zip": {
"version": "0.5.18", "version": "0.6.0",
"resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.18.tgz", "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
"integrity": "sha512-ufJnssQGbxzLNS1Ho9bCtX4rQKCCvoVuDLHoJyc3F9dOGDB4BkWs2Ci0kv53lqocAEQ/Cbi+I2XCsNYGqVYqng==", "integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
"dev": true, "dev": true,
"license": "MIT", "license": "MIT",
"optional": true, "optional": true,
"engines": { "engines": {
"node": ">=12.0" "node": ">=14.0"
} }
}, },
"node_modules/afinn-165": { "node_modules/afinn-165": {

3
package.json
View File

@@ -398,6 +398,7 @@
}, },
"node-gyp": { "node-gyp": {
"undici": "^6.27.0" "undici": "^6.27.0"
} },
"adm-zip": "^0.6.0"
} }
} }

2
tests/unit/mitm-dns-graceful-degrade-6127.test.ts
View File

@@ -81,7 +81,7 @@ test("provisionDnsEntries: a failing agent/custom step does not stop the others
}, },
addHostsDns: async (hosts: string[]) => { addHostsDns: async (hosts: string[]) => {
// Custom-hosts call must still happen even after default + agent errors. // Custom-hosts call must still happen even after default + agent errors.
if (hosts.includes("custom.example.com")) customCalled = true; if (hosts.some((h) => h === "custom.example.com")) customCalled = true;
}, },
getAgentStates: () => getAgentStates: () =>
[{ dns_enabled: true, agent_id: "__nonexistent_agent__" }] as never, [{ dns_enabled: true, agent_id: "__nonexistent_agent__" }] as never,