Request to review GHSA-46qc-4j94-54hf and add patched versions
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 52/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 领域
- security
调研方向
从 GHSA-46qc-4j94-54hf、@bananacool467/ui-tools 的发布历史以及 repository 的安全文档开始。将 0.1.9-beta、0.2.0-beta 和 0.2.1-beta 中记录的修复与 advisory 中受影响的范围进行比较，并确认 1.0.0 是否属于该范围。只有当 advisory 准确记录受影响和已修复的版本范围时，才算完成。
由索引模型根据 Issue 内容生成。
描述
I am requesting a review of GHSA-46qc-4j94-54hf for @bananacool467/ui-tools.
The advisory currently lists:
- Affected versions:
0.1.0-betathrough0.1.7-beta - Patched versions: None
The historical issue was an unauthenticated WebSocket terminal endpoint. This functionality was intentional, but authentication and security controls were missing from the early implementation.
The package was subsequently updated to address the issue:
- 0.1.9-beta — authentication was added before the WebSocket upgrade / PTY creation.
- 0.2.0-beta — additional security restrictions and hardening were added, including localhost defaults, origin restrictions, session ownership, connection/message/lifetime limits, environment restrictions, and configurable startup behavior.
- 0.2.1-beta — credential verification and additional execution/sandbox controls were added.
I am therefore requesting that the advisory be reviewed to determine whether these releases should be represented as patched/remediated versions rather than showing “Patched versions: None.”
I am not requesting that the historical security issue or affected versions be removed.
I am requesting that the advisory accurately represent the subsequent security fixes and release history.
There is also a separate version-data issue worth reviewing: the advisory itself lists only the eight 0.1.x-beta versions above, while some third-party security aggregators currently display 1.0.0 as affected. 1.0.0 is not listed in this GHSA.
Relevant evidence includes the package's release history and the corresponding security documentation in the repository.
Please review the advisory and determine the appropriate corrected affected/patched version ranges.
- 主要语言
- 没有语言数据
- 星标
- 2.5k
- 派生
- 789
- 平均合并
- 6 天 10 小时
- 30 天内合并 PR
- 61
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/advisory-database 的其他 Issue
-
Update https://github.com/advisories/GHSA-5pf6-cq2v-23ww to include patched version可能已有人在做 @GreyforgeLabs 于 3 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 76/100
github/advisory-database#9879 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
github/advisory-database#9255 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
github/advisory-database#9164 · 1 个 reaction ·
维护者通常 1 天内回复
-
CVE-2026-5598 has incorrect fixed versions for bcprov-jdk packages可能已有人在做 @ECD5A 于 46 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
github/advisory-database#8994 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
github/advisory-database#8898 · 4 条评论 · 1 个 reaction ·
维护者通常 1 天内回复
查看 github/advisory-database 的全部 Issue
相似的 Issue
-
Booking email verification fails for plus aliases with impersonation protection enabled可能已有人在做 @kankadev 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 88/100
calcom/cal.diy#30293 · 1 条评论 ·
维护者通常 5 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
-
install: root SSH tmpfiles.d drop-in is labeled etc_runtime_t instead of etc_t可能已有人在做 @andrewdunndev 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
good first issue help wanted
难度 1/5 1-3 小时 新手友好度 85/100
维护者通常 1 天内回复
-
security trivy
难度 2/5 1-3 小时 新手友好度 68/100
kubefleet-dev/kubefleet#944 ·
维护者通常 2 天内回复