Patchwork PR: AutoFix

patchwork/common/client/patched.py

@@ -158,8 +158,8 @@ async def _public_telemetry(self, patchflow: str, inputs: dict[str, Any]):
                     is_container=is_container(),
                 ),
             ),
+            timeout=10
         )
-
     def send_public_telemetry(self, patchflow: str, inputs: dict):
         try:
             _thread = Thread(target=asyncio.run, args=(self._public_telemetry(patchflow, inputs),))

patchwork/steps/ExtractDiff/ExtractDiff.py

@@ -184,7 +184,7 @@ def run(self) -> dict:
             name = namespace + ":" + name
         vuln_version = update_info["vuln_version"]
         fixed_version = update_info["fixed_version"]
-        info = requests.get(self.libraries_base_url + platform_type + "/" + name + "?api_key=" + self.libraries_api_key)
+        info = requests.get(self.libraries_base_url + platform_type + "/" + name + "?api_key=" + self.libraries_api_key, timeout=10)
         if info.status_code != 200:
             logger.info(f"Unable to get repo url for library {name}")
             return {}
@@ -204,7 +204,7 @@ def run(self) -> dict:
         temp_file_path = None
 
         for vuln_version, fixed_version in generate_version_combinations(vuln_version, fixed_version):
-            diff_file = requests.get(compare_url + vuln_version + "..." + fixed_version, headers=headers)
+            diff_file = requests.get(compare_url + vuln_version + "..." + fixed_version, headers=headers, timeout=10)
 
             if diff_file.text.startswith("diff"):
                 with defered_temp_file("w") as fp:

patchwork/steps/GetTypescriptTypeInfo/get_type_info.ts

@@ -262,6 +262,14 @@ function main() {
     process.exit(1);
   }
 
+  const basePath = '/app/restricted/';
+  const joinedPath = path.join(basePath, crypto.randomUUID());
+  const fullPath = path.normalize(joinedPath);
+  if (!fullPath.startsWith(basePath)) {
+   console.log("Invalid path specified!");
+   process.exit(1);
+  }
+
   console.log(
     "Getting type info for",
     identifier,
@@ -281,5 +289,4 @@ function main() {
     console.error(`Error writing to file: ${error}`);
   }
 }
-
 main();