Copilot commented on code in PR #5257:
URL: https://github.com/apache/zeppelin/pull/5257#discussion_r3294014057
##########
zeppelin-web-angular/projects/zeppelin-react/audit-filter.js:
##########
@@ -0,0 +1,91 @@
+const { execSync } = require('child_process');
+
+console.log('Running npm audit...');
+
+let stdout;
+try {
+ stdout = execSync('npm audit --json', { maxBuffer: 10 * 1024 * 1024
}).toString();
+ console.log('No vulnerabilities found.');
+ process.exit(0);
+} catch (e) {
+ if (e.stdout) {
+ stdout = e.stdout.toString();
+ } else {
+ console.error('npm audit failed to execute:', e.message);
+ process.exit(1);
+ }
+}
+
+let report;
+try {
+ report = JSON.parse(stdout);
+} catch (err) {
+ console.error('Failed to parse npm audit JSON output.');
+ process.exit(1);
+}
+
+// Advisory IDs for @antv/color-util and @antv/adjust malware
+const excludedAdvisories = new Set([1119329, 1119424]);
+const excludedPackages = new Set();
+
+// Pass 1: Identify all packages starting with @antv/ as excluded
+for (const name of Object.keys(report.vulnerabilities || {})) {
+ if (name.startsWith('@antv/')) {
+ excludedPackages.add(name);
+ }
Review Comment:
This filter suppresses every `@antv/*` package regardless of which advisory
npm reports. That means a future unrelated high/critical vulnerability in an
`@antv` package would be silently ignored by CI, even though the PR is only
intended to waive the two malware false-positive advisories. Please restrict
exclusion to the specific advisory IDs/GHSAs and only suppress transitive
packages whose `via` chain resolves exclusively to those advisories.
##########
zeppelin-web-angular/projects/zeppelin-react/audit-filter.js:
##########
@@ -0,0 +1,91 @@
+const { execSync } = require('child_process');
+
+console.log('Running npm audit...');
+
+let stdout;
+try {
+ stdout = execSync('npm audit --json', { maxBuffer: 10 * 1024 * 1024
}).toString();
+ console.log('No vulnerabilities found.');
+ process.exit(0);
+} catch (e) {
+ if (e.stdout) {
+ stdout = e.stdout.toString();
+ } else {
+ console.error('npm audit failed to execute:', e.message);
+ process.exit(1);
+ }
+}
+
+let report;
+try {
+ report = JSON.parse(stdout);
+} catch (err) {
+ console.error('Failed to parse npm audit JSON output.');
+ process.exit(1);
+}
+
+// Advisory IDs for @antv/color-util and @antv/adjust malware
+const excludedAdvisories = new Set([1119329, 1119424]);
+const excludedPackages = new Set();
+
+// Pass 1: Identify all packages starting with @antv/ as excluded
+for (const name of Object.keys(report.vulnerabilities || {})) {
+ if (name.startsWith('@antv/')) {
+ excludedPackages.add(name);
+ }
+}
+
+// Pass 2: Recursively check transitive vulnerabilities
+let changed = true;
+while (changed) {
+ changed = false;
+ for (const [name, vuln] of Object.entries(report.vulnerabilities || {})) {
+ if (excludedPackages.has(name)) continue;
+
+ // A vulnerability is excluded if all its "via" items are excluded
packages or advisories
+ const allViaExcluded = vuln.via.every(src => {
+ if (typeof src === 'string') {
+ return src.startsWith('@antv/') || excludedPackages.has(src);
+ }
+ return excludedAdvisories.has(src.source) || (src.name &&
src.name.startsWith('@antv/'));
+ });
+
+ if (allViaExcluded) {
+ excludedPackages.add(name);
+ changed = true;
+ }
+ }
+}
+
+// Pass 3: Collect any remaining high/critical vulnerabilities
+const remaining = [];
+for (const [name, vuln] of Object.entries(report.vulnerabilities || {})) {
+ if (excludedPackages.has(name)) continue;
+
+ const isHighOrCritical = vuln.severity === 'high' || vuln.severity ===
'critical';
+ if (isHighOrCritical) {
+ const unexcludedSources = vuln.via.filter(src => {
+ if (typeof src === 'string') {
+ return !src.startsWith('@antv/') && !excludedPackages.has(src);
+ }
+ return !excludedAdvisories.has(src.source) && (!src.name ||
!src.name.startsWith('@antv/'));
Review Comment:
Filtering remaining sources by the `@antv/` name prefix can hide an
unrelated high/critical `@antv` advisory from the final failure list. Please
only remove sources that match the explicitly approved false-positive advisory
IDs/GHSAs so future `@antv` security findings still fail the audit job.
##########
zeppelin-web-angular/projects/zeppelin-react/audit-filter.js:
##########
@@ -0,0 +1,91 @@
+const { execSync } = require('child_process');
+
+console.log('Running npm audit...');
+
+let stdout;
+try {
+ stdout = execSync('npm audit --json', { maxBuffer: 10 * 1024 * 1024
}).toString();
+ console.log('No vulnerabilities found.');
+ process.exit(0);
+} catch (e) {
+ if (e.stdout) {
+ stdout = e.stdout.toString();
+ } else {
+ console.error('npm audit failed to execute:', e.message);
+ process.exit(1);
+ }
+}
+
+let report;
+try {
+ report = JSON.parse(stdout);
+} catch (err) {
+ console.error('Failed to parse npm audit JSON output.');
+ process.exit(1);
+}
+
+// Advisory IDs for @antv/color-util and @antv/adjust malware
+const excludedAdvisories = new Set([1119329, 1119424]);
+const excludedPackages = new Set();
+
+// Pass 1: Identify all packages starting with @antv/ as excluded
+for (const name of Object.keys(report.vulnerabilities || {})) {
+ if (name.startsWith('@antv/')) {
+ excludedPackages.add(name);
+ }
+}
+
+// Pass 2: Recursively check transitive vulnerabilities
+let changed = true;
+while (changed) {
+ changed = false;
+ for (const [name, vuln] of Object.entries(report.vulnerabilities || {})) {
+ if (excludedPackages.has(name)) continue;
+
+ // A vulnerability is excluded if all its "via" items are excluded
packages or advisories
+ const allViaExcluded = vuln.via.every(src => {
+ if (typeof src === 'string') {
+ return src.startsWith('@antv/') || excludedPackages.has(src);
+ }
+ return excludedAdvisories.has(src.source) || (src.name &&
src.name.startsWith('@antv/'));
Review Comment:
This condition also treats any advisory whose npm-reported package name
starts with `@antv/` as excluded, independent of its advisory ID. A new
high/critical `@antv` advisory would therefore be filtered out before CI can
fail; please base the object-case exclusion on the approved advisory IDs/GHSAs
instead of the package name prefix.
##########
zeppelin-web-angular/projects/zeppelin-react/audit-filter.js:
##########
@@ -0,0 +1,91 @@
+const { execSync } = require('child_process');
Review Comment:
The new source file is missing the Apache license header used by the
module's JS/TS files, for example
`zeppelin-web-angular/projects/zeppelin-react/webpack.config.js:1` and
`zeppelin-web-angular/projects/zeppelin-react/src/main.ts:1`. Please add the
standard header at the top of this file to match the repository convention.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
