Release: security remediation + updates#6
Merged
Conversation
Squash of GitLab main since the initial release. Supersedes GitHub Dependabot PR #2 (react-router/react-router-dom -> 7.18.0, ahead of 7.17.0). - Dependency security upgrades (concurrently 10, aws-cdk-lib 2.260, dompurify 3.4.10, vite 6.4.3, uuid 13.0.2, js-yaml/minimatch overrides) clearing the open Dependabot advisories; no-patch items risk-accepted. - CodeQL: HTML sanitization hardening, CFN response log redaction, unbiased crypto.randomInt for temp passwords. - Post-release workshop updates (fabrication, progress UI, specs).
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+33
to
+41
| "Response status: {}; physicalResourceId={}; stackId={}; requestId={}; " | ||
| "logicalResourceId={}; dataKeys={}".format( | ||
| responseStatus, | ||
| responseBody['PhysicalResourceId'], | ||
| event['StackId'], | ||
| event['RequestId'], | ||
| event['LogicalResourceId'], | ||
| list(responseData.keys()) if isinstance(responseData, dict) else [], | ||
| ) |
Comment on lines
+33
to
+41
| "Response status: {}; physicalResourceId={}; stackId={}; requestId={}; " | ||
| "logicalResourceId={}; dataKeys={}".format( | ||
| responseStatus, | ||
| responseBody['PhysicalResourceId'], | ||
| event['StackId'], | ||
| event['RequestId'], | ||
| event['LogicalResourceId'], | ||
| list(responseData.keys()) if isinstance(responseData, dict) else [], | ||
| ) |
Comment on lines
+33
to
+41
| "Response status: {}; physicalResourceId={}; stackId={}; requestId={}; " | ||
| "logicalResourceId={}; dataKeys={}".format( | ||
| responseStatus, | ||
| responseBody['PhysicalResourceId'], | ||
| event['StackId'], | ||
| event['RequestId'], | ||
| event['LogicalResourceId'], | ||
| list(responseData.keys()) if isinstance(responseData, dict) else [], | ||
| ) |
Comment on lines
+33
to
+41
| "Response status: {}; physicalResourceId={}; stackId={}; requestId={}; " | ||
| "logicalResourceId={}; dataKeys={}".format( | ||
| responseStatus, | ||
| responseBody['PhysicalResourceId'], | ||
| event['StackId'], | ||
| event['RequestId'], | ||
| event['LogicalResourceId'], | ||
| list(responseData.keys()) if isinstance(responseData, dict) else [], | ||
| ) |
Comment on lines
+33
to
+41
| "Response status: {}; physicalResourceId={}; stackId={}; requestId={}; " | ||
| "logicalResourceId={}; dataKeys={}".format( | ||
| responseStatus, | ||
| responseBody['PhysicalResourceId'], | ||
| event['StackId'], | ||
| event['RequestId'], | ||
| event['LogicalResourceId'], | ||
| list(responseData.keys()) if isinstance(responseData, dict) else [], | ||
| ) |
| let previous: string; | ||
| do { | ||
| previous = sanitized; | ||
| sanitized = sanitized.replace(SCRIPT_BLOCK_RE, '').replace(HTML_TAG_RE, ''); |
gibbsie
changed the title
gibbsie
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security sweep: remediate Dependabot & CodeQL alerts (deps, sanitization, logging, RNG)
Summary
Resolves the open Dependabot (61) and CodeQL Code Scanning (21) alerts on the repository. The bulk are fixed via dependency upgrades and targeted code changes; a small set of non-applicable / no-patch findings are risk-accepted with documented justifications. Backend + frontend builds, the full backend test suite, and
cdk synthare all green.Dependency upgrades (Dependabot)
shell-quote(viaconcurrently9→10)aws-cdk-lib2.100→2.260 (+aws-cdkCLI →2.1128)fast-uri,brace-expansion(high/mod)dompurifyoverride ^3.4.0→^3.4.9 (resolves 3.4.10)vite6.4.2→6.4.3 (frontend)@aws-sdk/s3-request-presigner+client-s3→^3.1070.0uuid13.0.0→13.0.2 (frontend)js-yamloverride →4.2.0minimatchoverride →9.0.9 (via@typescript-eslint)@smithy/util-stream^4.5.25Plus a semver-safe
npm audit fixacross root/frontend/backend lockfiles.esbuildwas intentionally not forced to 0.28.x: it is already at 0.25.11 (not flagged bynpm audit; the dev-server advisory is fixed at 0.25.0), and vite 6.4.3 pins^0.25— forcing 0.28 would break the frontend build.Code security fixes (CodeQL)
js/incomplete-multi-character-sanitization<scr<script>ipt>) can't reintroduce stripped tags. Plain-text contract + idempotency preserved.backend/src/utils/notifier-base.ts,validation.tsjs/bad-tag-filternotifier-base.ts,validation.tspy/clear-text-logging-sensitive-dataresponseDatakeys) instead of the full CFN response body; response contract unchangedcfnresponse.pyjs/biased-cryptographic-randomcrypto.randomInt(unbiased) for char selection and the Fisher–Yates shuffle; password guarantees preserveduser-management-resolver.tsRisk-accepted dismissals
Dependabot (7,
tolerable_risk):dompurifyGHSA-x4vx-rjvf-j5p4 (×2 manifests) — no upstream patch; all other dompurify advisories cleared by 3.4.10.thriftGHSA-526f-jxpj-jmg2 / GHSA-r67j-r569-jrwp — transitive via@databricks/sql(optional, lazily-loaded adapter); 526f unpatched, r67j pinned by parent.aws-sdk(v2) GHSA-j965-2qgj-vjmq — EOL, transitive only; tracked for AWS SDK v3 migration.uuidGHSA-w5hq-g745-h8pq<11.1.1(×2) — code uses onlyuuid.v4(); advisory affects v1/v3/v5/v6 generation we never call.Code Scanning (6) —
js/insufficient-password-hash:app-api-authorizer.ts(production) — false positive: the hashed value is a 256-bit CSPRNG API token (randomBytes(32)), not a user password; the offline-brute-force threat model doesn't apply and SHA-256 of a high-entropy token is standard token-storage practice.Verification
backend npm run build→ exit 0;frontend npm run build→ exit 0CDK_DOCKER=docker npx cdk synth→ exit 0, all 6 stacks synthesize; arbiter-stack CDK-synth suites green (Python Lambda layer bundled via Docker)