@sap-cloud-sdk security vulnerability

Aperta
  • Qualcosa non va?
#6,989 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
node.js, typescript
Ambito
backend, security

Direzione di ricerca

Start by installing @sap-cloud-sdk/[email protected] and run the listed npm ls commands to reproduce each dependency chain. Review the published dependency versions for axios, form-data, @sap-cloud-sdk/util, logform, and jks-js, then verify that the resulting tree satisfies the stated SDOL-005 cutoff and no longer includes the four flagged packages.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
Describe the Bug

Running an SDOL-005 OSS compliance scan on our project
(agent-extensibility-engine) flagged 4 transitive dependencies pulled
through @sap-cloud-sdk/[email protected] as violations.

SDOL-005 rule: All transitive dependencies must have been published
after 16 September 2023 (36-month rolling cutoff).

None of these 4 packages appear in our package.json — they are pulled
in automatically by @sap-cloud-sdk/connectivity. We have no control
over their versions from our side.

Steps to Reproduce

Install @sap-cloud-sdk/connectivity in any Node.js project:
npm install @sap-cloud-sdk/[email protected]

Run the dependency tree for each flagged package:
npm ls agent-base
npm ls asynckit
npm ls @colors/colors
npm ls node-rsa

Observe the chains:

@sap-cloud-sdk/[email protected]
└── [email protected]
└── [email protected]
└── [email protected] ← VIOLATION (published 2021)

@sap-cloud-sdk/[email protected]
└── [email protected]
└── [email protected]
└── [email protected] ← VIOLATION (published 2016)

@sap-cloud-sdk/[email protected]
└── @sap-cloud-sdk/[email protected]
└── [email protected]
└── @colors/[email protected] ← VIOLATION (published 2023-07-10)

@sap-cloud-sdk/[email protected]
└── [email protected]
└── [email protected] ← VIOLATION (published 2020)

Run SDOL-005 scan — all 4 packages are flagged.

@sap-cloud-sdk/connectivity should ensure all its transitive dependencies
comply with SAP's SDOL-005 policy — i.e., all packages in the dependency
tree should have been published after 16 September 2023.

Specifically:

axios should be upgraded to a version that pulls https-proxy-agent@7+
so that agent-base@7 is used instead of agent-base@6
form-data@5+ should be used so [email protected]+ is pulled in
logform inside @sap-cloud-sdk/util should pull @colors/[email protected]+
jks-js should be updated or replaced to remove the dependency on
[email protected] (last published 2020)

Expected Behavior

@sap-cloud-sdk/connectivity should ensure all its transitive dependencies
comply with SAP's SDOL-005 policy — i.e., all packages in the dependency
tree should have been published after 16 September 2023.

Specifically:

axios should be upgraded to a version that pulls https-proxy-agent@7+
so that agent-base@7 is used instead of agent-base@6
form-data@5+ should be used so [email protected]+ is pulled in
logform inside @sap-cloud-sdk/util should pull @colors/[email protected]+
jks-js should be updated or replaced to remove the dependency on
[email protected] (last published 2020)

Screenshots

No response

Used Versions
  • Node version via node -v: ...
  • NPM version via `npm -v: ...
  • SAP Cloud SDK version: ...
  • For CAP users, CAP version: ...
    @sap-cloud-sdk/connectivity 4.9.1
    @sap-cloud-sdk/util 4.9.1 (pulled transitively)
    axios 1.19.0 (pulled transitively)
    https-proxy-agent 5.0.1 (pulled transitively)
    form-data 4.0.6 (pulled transitively)
    jks-js 1.1.7 (pulled transitively)
    logform 2.7.0 (pulled transitively)
    Node.js v22.22.3
    npm 10.9.8
Code Examples

No response

Log File

No response

Affected Development Phase

Getting Started

Impact

Blocked

Timeline

No response

Additional Context

No response

Lingua principale
TypeScript
Stelle
221
Fork
79
Merge medio
13h 27m
PR unite (30g)
22

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di SAP/cloud-sdk-js

Tutte le issue di SAP/cloud-sdk-js

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.