false positive: GHSA-4fm3-j964-p869
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Domain
- security
Research direction
Start by reviewing the GHSA-4fm3-j964-p869 advisory linked in the issue and the claims about @builder.io/dev-tools. Verify whether the trycloudflare.com URL was company-owned, limited to internal testing, and no longer live; done means deciding whether the advisory should be removed or otherwise updated.
Written by the indexing model from the issue text.
Description
Hi there,
I am reaching out on behalf of Builder.io regarding GHSA-4fm3-j964-p869 which we believe to be a false positive. The code in question in the report was added intentionally. The trycloudflare.com proxy URL that was included as part of the affected @builder.io/dev-tools version went to company-owned infrastructure and was deployed to a version of @builder.io/dev-tools that is only used internally by employees for testing purposes. Additionally, that proxy URL is no longer live.
We kindly request a review of this advisory, and we're happy to provide any clarifications needed to assist in removing it. Thank you!
- Dominant language
- No language data
- Stars
- 2.5k
- Forks
- 772
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 46
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/advisory-database
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/advisory-database#9255 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#9164 · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#8994 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
github/advisory-database#8898 · 4 comments · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
github/advisory-database#8841 ·
All issues in github/advisory-database
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
oblt-aw/detector/security
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
setup tools wizard offers no GitHub auth path, and setup summary doesn't recognize `gh` CLI auth Openarea/auth comp/cli P3 tool/skills type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
NousResearch/hermes-agent#121131 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
trailofbits/skills#330 ·
-
accepted
Difficulty 2/5 1-3 hours Newbie friendliness 75/100