Skip to content

Commit f3ae03d

Browse files
webstackdevwebstackdev
committed
Fix CodeQL issues in refactored JS Actions
1 parent a345e76 commit f3ae03d

10 files changed

Lines changed: 202 additions & 43 deletions

File tree

‎.github/actions/deploy-preview-comment/__tests__/index.spec.ts‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
import { writeFileSync } from 'fs'
1+
import { mkdtempSync, rmSync, writeFileSync } from 'fs'
22
import { tmpdir } from 'os'
3-
import { resolve } from 'path'
3+
import { join, resolve } from 'path'
44
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
55

66
type CoreMock = {
@@ -19,8 +19,12 @@ const core: CoreMock = {
1919

2020
vi.mock('@actions/core', () => core)
2121

22+
const tempDirs: string[] = []
23+
2224
const createTempEventFile = (payload: unknown) => {
23-
const filePath = resolve(tmpdir(), `deploy-preview-comment-${Date.now()}-${Math.random().toString(16).slice(2)}.json`)
25+
const tempDir = mkdtempSync(resolve(tmpdir(), 'deploy-preview-comment-'))
26+
tempDirs.push(tempDir)
27+
const filePath = join(tempDir, 'event.json')
2428
writeFileSync(filePath, JSON.stringify(payload), 'utf8')
2529
return filePath
2630
}
@@ -51,6 +55,9 @@ describe('deploy-preview-comment action', () => {
5155

5256
afterEach(() => {
5357
process.env = originalEnv
58+
for (const dir of tempDirs.splice(0)) {
59+
rmSync(dir, { recursive: true, force: true })
60+
}
5461
vi.unstubAllGlobals()
5562
})
5663

‎.github/actions/deploy-preview-comment/src/index.ts‎

Lines changed: 34 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,24 @@ const createGitHubRequestHeaders = (token: string) => ({
113113
'User-Agent': 'webstackbuilders-deploy-preview-comment-action',
114114
})
115115

116+
const githubApiBaseUrl = (() => {
117+
const raw = (process.env['GITHUB_API_URL'] ?? 'https://api.github.com').trim()
118+
const parsed = new URL(raw)
119+
if (parsed.protocol !== 'https:') {
120+
throw new Error(`Unsupported GITHUB_API_URL protocol: ${parsed.protocol}`)
121+
}
122+
return raw.endsWith('/') ? raw : `${raw}/`
123+
})()
124+
125+
const isAllowedFetchUrl = (url: string): boolean => {
126+
const parsed = new URL(url)
127+
if (parsed.protocol !== 'https:') {
128+
return false
129+
}
130+
const allowedHosts = new Set([new URL(githubApiBaseUrl).hostname, 'api.vercel.com'])
131+
return allowedHosts.has(parsed.hostname)
132+
}
133+
116134
const fetchJson = async <T>(
117135
url: string,
118136
init: RequestInit,
@@ -121,6 +139,10 @@ const fetchJson = async <T>(
121139
throw new Error('Fetch API unavailable in this runtime.')
122140
}
123141

142+
if (!isAllowedFetchUrl(url)) {
143+
throw new Error(`Blocked outbound request to untrusted URL: ${url}`)
144+
}
145+
124146
const response = await fetch(url, init)
125147
if (!response.ok) {
126148
return { ok: false, status: response.status, data: null }
@@ -190,7 +212,10 @@ const findExistingComment = async (params: {
190212
const headers = createGitHubRequestHeaders(params.token)
191213

192214
for (let page = 1; page <= 50; page += 1) {
193-
const url = `https://api.github.com/repos/${params.owner}/${params.repo}/issues/${params.issueNumber}/comments?per_page=100&page=${page}`
215+
const url = new URL(
216+
`repos/${params.owner}/${params.repo}/issues/${params.issueNumber}/comments?per_page=100&page=${page}`,
217+
githubApiBaseUrl,
218+
).toString()
194219
const { ok, status, data } = await fetchJson<GitHubComment[]>(url, { headers })
195220
if (!ok) {
196221
warning(`Unable to list PR comments (status ${status}).`)
@@ -223,7 +248,10 @@ const upsertComment = async (params: {
223248
}
224249

225250
if (params.existingCommentId) {
226-
const url = `https://api.github.com/repos/${params.owner}/${params.repo}/issues/comments/${params.existingCommentId}`
251+
const url = new URL(
252+
`repos/${params.owner}/${params.repo}/issues/comments/${params.existingCommentId}`,
253+
githubApiBaseUrl,
254+
).toString()
227255
const { ok, status } = await fetchJson<unknown>(url, {
228256
method: 'PATCH',
229257
headers,
@@ -235,7 +263,10 @@ const upsertComment = async (params: {
235263
return
236264
}
237265

238-
const url = `https://api.github.com/repos/${params.owner}/${params.repo}/issues/${params.issueNumber}/comments`
266+
const url = new URL(
267+
`repos/${params.owner}/${params.repo}/issues/${params.issueNumber}/comments`,
268+
githubApiBaseUrl,
269+
).toString()
239270
const { ok, status } = await fetchJson<unknown>(url, {
240271
method: 'POST',
241272
headers,

‎.github/actions/deploy-preview-failure-comment/__tests__/index.spec.ts‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
import { writeFileSync } from 'fs'
1+
import { mkdtempSync, rmSync, writeFileSync } from 'fs'
22
import { tmpdir } from 'os'
3-
import { resolve } from 'path'
3+
import { join, resolve } from 'path'
44
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
55

66
type CoreMock = {
@@ -19,8 +19,12 @@ const core: CoreMock = {
1919

2020
vi.mock('@actions/core', () => core)
2121

22+
const tempDirs: string[] = []
23+
2224
const createTempEventFile = (payload: unknown) => {
23-
const filePath = resolve(tmpdir(), `preview-failure-comment-${Date.now()}-${Math.random().toString(16).slice(2)}.json`)
25+
const tempDir = mkdtempSync(resolve(tmpdir(), 'preview-failure-comment-'))
26+
tempDirs.push(tempDir)
27+
const filePath = join(tempDir, 'event.json')
2428
writeFileSync(filePath, JSON.stringify(payload), 'utf8')
2529
return filePath
2630
}
@@ -50,6 +54,9 @@ describe('preview-failure-comment action', () => {
5054

5155
afterEach(() => {
5256
process.env = originalEnv
57+
for (const dir of tempDirs.splice(0)) {
58+
rmSync(dir, { recursive: true, force: true })
59+
}
5360
vi.unstubAllGlobals()
5461
})
5562

‎.github/actions/deploy-preview-failure-comment/src/index.ts‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,24 @@ const getJsonFromFile = <T>(filePath: string): T => {
3535
const isVercelUrl = (value: unknown): value is string =>
3636
typeof value === 'string' && /vercel\.(app|com)/.test(value)
3737

38+
const githubApiBaseUrl = (() => {
39+
const raw = (process.env['GITHUB_API_URL'] ?? 'https://api.github.com').trim()
40+
const parsed = new URL(raw)
41+
if (parsed.protocol !== 'https:') {
42+
throw new Error(`Unsupported GITHUB_API_URL protocol: ${parsed.protocol}`)
43+
}
44+
return raw.endsWith('/') ? raw : `${raw}/`
45+
})()
46+
47+
const isAllowedFetchUrl = (url: string): boolean => {
48+
const parsed = new URL(url)
49+
if (parsed.protocol !== 'https:') {
50+
return false
51+
}
52+
const allowedHosts = new Set([new URL(githubApiBaseUrl).hostname, 'api.vercel.com'])
53+
return allowedHosts.has(parsed.hostname)
54+
}
55+
3856
const fetchJson = async <T>(
3957
url: string,
4058
init: RequestInit,
@@ -43,6 +61,10 @@ const fetchJson = async <T>(
4361
throw new Error('Fetch API unavailable in this runtime.')
4462
}
4563

64+
if (!isAllowedFetchUrl(url)) {
65+
throw new Error(`Blocked outbound request to untrusted URL: ${url}`)
66+
}
67+
4668
const response = await fetch(url, init)
4769
if (!response.ok) {
4870
return { ok: false, status: response.status, data: null }
@@ -118,7 +140,10 @@ const createPrComment = async (params: {
118140
'Content-Type': 'application/json',
119141
}
120142

121-
const url = `https://api.github.com/repos/${params.owner}/${params.repo}/issues/${params.issueNumber}/comments`
143+
const url = new URL(
144+
`repos/${params.owner}/${params.repo}/issues/${params.issueNumber}/comments`,
145+
githubApiBaseUrl,
146+
).toString()
122147
const { ok, status } = await fetchJson<unknown>(url, {
123148
method: 'POST',
124149
headers,

‎.github/actions/deploy-production-failure/__tests__/index.spec.ts‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
import { writeFileSync } from 'fs'
1+
import { mkdtempSync, rmSync, writeFileSync } from 'fs'
22
import { tmpdir } from 'os'
3-
import { resolve } from 'path'
3+
import { join, resolve } from 'path'
44
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
55

66
type CoreMock = {
@@ -19,8 +19,12 @@ const core: CoreMock = {
1919

2020
vi.mock('@actions/core', () => core)
2121

22+
const tempDirs: string[] = []
23+
2224
const createTempEventFile = (payload: unknown) => {
23-
const filePath = resolve(tmpdir(), `deploy-production-failure-${Date.now()}-${Math.random().toString(16).slice(2)}.json`)
25+
const tempDir = mkdtempSync(resolve(tmpdir(), 'deploy-production-failure-'))
26+
tempDirs.push(tempDir)
27+
const filePath = join(tempDir, 'event.json')
2428
writeFileSync(filePath, JSON.stringify(payload), 'utf8')
2529
return filePath
2630
}
@@ -49,6 +53,9 @@ describe('deploy-production-failure action', () => {
4953

5054
afterEach(() => {
5155
process.env = originalEnv
56+
for (const dir of tempDirs.splice(0)) {
57+
rmSync(dir, { recursive: true, force: true })
58+
}
5259
vi.unstubAllGlobals()
5360
})
5461

‎.github/actions/deploy-production-failure/src/index.ts‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,20 @@ const createGitHubRequestHeaders = (token: string) => ({
3434
'User-Agent': 'webstackbuilders-deploy-production-failure-action',
3535
})
3636

37+
const githubApiBaseUrl = (() => {
38+
const raw = (process.env['GITHUB_API_URL'] ?? 'https://api.github.com').trim()
39+
const parsed = new URL(raw)
40+
if (parsed.protocol !== 'https:') {
41+
throw new Error(`Unsupported GITHUB_API_URL protocol: ${parsed.protocol}`)
42+
}
43+
return raw.endsWith('/') ? raw : `${raw}/`
44+
})()
45+
46+
const isAllowedFetchUrl = (url: string): boolean => {
47+
const parsed = new URL(url)
48+
return parsed.protocol === 'https:' && parsed.hostname === new URL(githubApiBaseUrl).hostname
49+
}
50+
3751
const fetchJson = async <T>(
3852
url: string,
3953
init: RequestInit,
@@ -42,6 +56,10 @@ const fetchJson = async <T>(
4256
throw new Error('Fetch API unavailable in this runtime.')
4357
}
4458

59+
if (!isAllowedFetchUrl(url)) {
60+
throw new Error(`Blocked outbound request to untrusted URL: ${url}`)
61+
}
62+
4563
const response = await fetch(url, init)
4664
if (!response.ok) {
4765
return { ok: false, status: response.status, data: null }
@@ -63,7 +81,10 @@ const createCommitComment = async (params: {
6381
token: string
6482
body: string
6583
}): Promise<void> => {
66-
const url = `https://api.github.com/repos/${params.owner}/${params.repo}/commits/${params.sha}/comments`
84+
const url = new URL(
85+
`repos/${params.owner}/${params.repo}/commits/${params.sha}/comments`,
86+
githubApiBaseUrl,
87+
).toString()
6788
const headers = {
6889
...createGitHubRequestHeaders(params.token),
6990
'Content-Type': 'application/json',

‎.github/actions/lint-and-unit-tests-pass/__tests__/index.spec.ts‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
import { writeFileSync } from 'fs'
1+
import { mkdtempSync, rmSync, writeFileSync } from 'fs'
22
import { tmpdir } from 'os'
3-
import { resolve } from 'path'
3+
import { join, resolve } from 'path'
44
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
55

66
type CoreMock = {
@@ -19,8 +19,12 @@ const core: CoreMock = {
1919

2020
vi.mock('@actions/core', () => core)
2121

22+
const tempDirs: string[] = []
23+
2224
const createTempEventFile = (payload: unknown) => {
23-
const filePath = resolve(tmpdir(), `lint-and-unit-tests-pass-${Date.now()}-${Math.random().toString(16).slice(2)}.json`)
25+
const tempDir = mkdtempSync(resolve(tmpdir(), 'lint-and-unit-tests-pass-'))
26+
tempDirs.push(tempDir)
27+
const filePath = join(tempDir, 'event.json')
2428
writeFileSync(filePath, JSON.stringify(payload), 'utf8')
2529
return filePath
2630
}
@@ -49,6 +53,9 @@ describe('lint-and-unit-tests-pass action', () => {
4953

5054
afterEach(() => {
5155
process.env = originalEnv
56+
for (const dir of tempDirs.splice(0)) {
57+
rmSync(dir, { recursive: true, force: true })
58+
}
5259
vi.unstubAllGlobals()
5360
})
5461

‎.github/actions/lint-and-unit-tests-pass/src/index.ts‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,20 @@ const createGitHubRequestHeaders = (token: string) => ({
4545
'User-Agent': 'webstackbuilders-lint-and-unit-tests-pass-action',
4646
})
4747

48+
const githubApiBaseUrl = (() => {
49+
const raw = (process.env['GITHUB_API_URL'] ?? 'https://api.github.com').trim()
50+
const parsed = new URL(raw)
51+
if (parsed.protocol !== 'https:') {
52+
throw new Error(`Unsupported GITHUB_API_URL protocol: ${parsed.protocol}`)
53+
}
54+
return raw.endsWith('/') ? raw : `${raw}/`
55+
})()
56+
57+
const isAllowedFetchUrl = (url: string): boolean => {
58+
const parsed = new URL(url)
59+
return parsed.protocol === 'https:' && parsed.hostname === new URL(githubApiBaseUrl).hostname
60+
}
61+
4862
const fetchJson = async <T>(
4963
url: string,
5064
init: RequestInit,
@@ -53,6 +67,10 @@ const fetchJson = async <T>(
5367
throw new Error('Fetch API unavailable in this runtime.')
5468
}
5569

70+
if (!isAllowedFetchUrl(url)) {
71+
throw new Error(`Blocked outbound request to untrusted URL: ${url}`)
72+
}
73+
5674
const response = await fetch(url, init)
5775
if (!response.ok) {
5876
return { ok: false, status: response.status, data: null }
@@ -70,7 +88,10 @@ const listAllJobsForRun = async (params: {
7088

7189
const allJobs: WorkflowJob[] = []
7290
for (let page = 1; page <= 10; page += 1) {
73-
const url = `https://api.github.com/repos/${params.owner}/${params.repo}/actions/runs/${params.runId}/jobs?per_page=100&page=${page}`
91+
const url = new URL(
92+
`repos/${params.owner}/${params.repo}/actions/runs/${params.runId}/jobs?per_page=100&page=${page}`,
93+
githubApiBaseUrl,
94+
).toString()
7495
const { ok, status, data } = await fetchJson<ListJobsResponse>(url, { headers })
7596

7697
if (!ok) {

‎.github/actions/publish-preview-status/__tests__/index.spec.ts‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
import { writeFileSync } from 'fs'
1+
import { mkdtempSync, rmSync, writeFileSync } from 'fs'
22
import { tmpdir } from 'os'
3-
import { resolve } from 'path'
3+
import { join, resolve } from 'path'
44
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
55

66
type CoreMock = {
@@ -19,8 +19,12 @@ const core: CoreMock = {
1919

2020
vi.mock('@actions/core', () => core)
2121

22+
const tempDirs: string[] = []
23+
2224
const createTempEventFile = (payload: unknown) => {
23-
const filePath = resolve(tmpdir(), `publish-preview-status-${Date.now()}-${Math.random().toString(16).slice(2)}.json`)
25+
const tempDir = mkdtempSync(resolve(tmpdir(), 'publish-preview-status-'))
26+
tempDirs.push(tempDir)
27+
const filePath = join(tempDir, 'event.json')
2428
writeFileSync(filePath, JSON.stringify(payload), 'utf8')
2529
return filePath
2630
}
@@ -53,6 +57,9 @@ describe('publish-preview-status action', () => {
5357

5458
afterEach(() => {
5559
process.env = originalEnv
60+
for (const dir of tempDirs.splice(0)) {
61+
rmSync(dir, { recursive: true, force: true })
62+
}
5663
vi.unstubAllGlobals()
5764
})
5865

0 commit comments

Comments
 (0)