ZIO-HTTP Security Audit #14418
Annotations
2 errors
|
Resource not accessible by integration
{
name: 'HttpError',
id: '6729261433',
status: 403,
response: {
url: 'https://api.github.com/repos/zio/zio-http/releases',
status: 403,
headers: {
'access-control-allow-origin': '*',
'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
connection: 'close',
'content-encoding': 'gzip',
'content-security-policy': "default-src 'none'",
'content-type': 'application/json; charset=utf-8',
date: 'Thu, 02 Nov 2023 06:52:12 GMT',
'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
server: 'GitHub.com',
'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
'transfer-encoding': 'chunked',
vary: 'Accept-Encoding, Accept, X-Requested-With',
'x-accepted-github-permissions': 'contents=write',
'x-content-type-options': 'nosniff',
'x-frame-options': 'deny',
'x-github-api-version-selected': '2022-11-28',
'x-github-media-type': 'github.v3; format=json',
'x-github-request-id': '7006:766C:C9FD04:D19510:6543471B',
'x-ratelimit-limit': '1000',
'x-ratelimit-remaining': '990',
'x-ratelimit-reset': '1698911429',
'x-ratelimit-resource': 'core',
'x-ratelimit-used': '10',
'x-xss-protection': '0'
},
data: {
message: 'Resource not accessible by integration',
documentation_url: 'https://docs.github.com/rest/releases/releases#create-a-release'
}
},
request: {
method: 'POST',
url: 'https://api.github.com/repos/zio/zio-http/releases',
headers: {
accept: 'application/vnd.github.v3+json',
'user-agent': 'probot/12.2.5 octokit-core.js/3.5.1 Node.js/16.20.2 (linux; x64)',
authorization: 'token [REDACTED]',
'content-type': 'application/json; charset=utf-8'
},
body: '{"target_commitish":"refs/pull/2483/merge","name":"v3.0.0 🌈","tag_name":"v3.0.0","body":"## Changes\\n\\n- Update zio-schema, zio-schema-json, ... to 0.4.15 @scala-steward (#2501)\\n- CLI uses description annotation from zio-schema @jorge-vasquez-2301 (#2499)\\n\\n## 🐛 Bug Fixes\\n\\n- Trying to fix publishing @vigoo (#2495)\\n\\n## 🧰 Maintenance\\n\\n- Trying to fix publishing @vigoo (#2495)\\n","draft":true,"prerelease":false,"make_latest":"true"}',
request: {}
},
event: {
id: '6729261433',
name: 'pull_request',
payload: {
action: 'edited',
changes: {
body: {
from: 'wip issue #1535\r\n' +
'\r\n' +
'## Coverage\r\n' +
'1. DotDotSlash attack (passed)\r\n' +
'2. Symlink attack (passed)\r\n' +
'3. Encoded url attack (passed)\r\n' +
'\r\n' +
'## Improvements\r\n' +
'1. `java.nio` can be used instead of `java.io` in staticServe middleware. You can find the key differences [here](https://www.baeldung.com/java-io-vs-nio)\r\n' +
'\r\n' +
'## Sources\r\n' +
'1. [owasp](https://owasp.org/www-community/attacks/Path_Traversal)\r\n' +
'2. [Burp Academy](https://portswigger.net/web-security/file-path-traversal)\r\n' +
'3. [DotDotSlash](https://github.com/jcesarstef/dotdotslash/blob/master/match.py)\r\n' +
'\r\n' +
'## Todo\r\n' +
'- [X] Creating a test suite for static file serving. The test suite should verify that it is impossible to escape the sandbox in which local files are being served, even in the presence of OS-specific symlinks (etc.).\r\n' +
'- [ ] Creating various tests for any case in which potential user-data is \r\n' +
'turned into HTTP headers, cookies, content, etc. For example, `HttpError` turns (potentially user-defined) strings into content that i
|
|
HttpError: Resource not accessible by integration
at /home/runner/work/_actions/release-drafter/release-drafter/v5/dist/index.js:8462:21
at processTicksAndRejections (node:internal/process/task_queues:96:5)
at async Job.doExecute (/home/runner/work/_actions/release-drafter/release-drafter/v5/dist/index.js:30793:18)
{
name: 'AggregateError',
event: {
id: '6729261433',
name: 'pull_request',
payload: {
action: 'edited',
changes: {
body: {
from: 'wip issue #1535\r\n' +
'\r\n' +
'## Coverage\r\n' +
'1. DotDotSlash attack (passed)\r\n' +
'2. Symlink attack (passed)\r\n' +
'3. Encoded url attack (passed)\r\n' +
'\r\n' +
'## Improvements\r\n' +
'1. `java.nio` can be used instead of `java.io` in staticServe middleware. You can find the key differences [here](https://www.baeldung.com/java-io-vs-nio)\r\n' +
'\r\n' +
'## Sources\r\n' +
'1. [owasp](https://owasp.org/www-community/attacks/Path_Traversal)\r\n' +
'2. [Burp Academy](https://portswigger.net/web-security/file-path-traversal)\r\n' +
'3. [DotDotSlash](https://github.com/jcesarstef/dotdotslash/blob/master/match.py)\r\n' +
'\r\n' +
'## Todo\r\n' +
'- [X] Creating a test suite for static file serving. The test suite should verify that it is impossible to escape the sandbox in which local files are being served, even in the presence of OS-specific symlinks (etc.).\r\n' +
'- [ ] Creating various tests for any case in which potential user-data is \r\n' +
'turned into HTTP headers, cookies, content, etc. For example, `HttpError` turns (potentially user-defined) strings into content that is ultimately embedded into the response. This allows various security exploits such as XSS, which must be prevented through appropriate escaping. The tests should attempt to embed malicious data into the construction of errors, headers, responses, etc., and should demonstrate appropriate escape mechanisms are utilized to prevent these exploits.\r\n' +
'- [ ] Creating a test suite that verifies any authentication code that ships with ZIO HTTP is not vulnerable to [[timing attacks](https://en.wikipedia.org/wiki/Timing_attack)](https://en.wikipedia.org/wiki/Timing_attack). ZIO 2 has a data type called `zio.Config.Secret` that can be used to hold passwords, keys, etc., which can prevent timing attacks.\r\n' +
'- [ ] Creating a test suite that attempts to crash the server (OOME) by generating extremely large: infinite URLs, infinite individual headers (e.g. `Content-type: application/sjkldjfklsjdflkjsdkfljsdfljsdfk....`), infinite total headers (each of which is small), infinite request bodies; infinite multi-part forms, etc.; and demonstrating that user-configurable limits on all of these are exposed and available and have reasonable defaults such that an out-of-the-box server is reasonably secure.\r\n' +
'- [ ] Creating a test suite that demonstrates any built-in ZIO HTTP exception types do not leak stack trace or other sensitive information in HTTP responses.\r\n' +
'- [ ] Creating a test suite designed to exercise any metrics that are built into ZIO HTTP, and verifying that it is not possible to run out of memory by, e.g., generating infinite URLs, infinite content types, etc.'
},
title: { from: 'feat: test suite for static file server' }
},
number: 2483,
organization: {
avatar_url: 'https://avatars.githubusercontent.com/u/49655448?v=4',
description: 'ZIO — Real World Functional Programming',
events_url: 'https://api.github.com/orgs/zio/events',
hooks_url: 'https://api.github.com/orgs/zio/hooks',
id: 49655448,
issues_url: 'https://api.github.com/orgs/zio/issues',
login: 'zio',
members_url: 'https://api.github.com/orgs/zio/members{/member}',
node_id: 'MDEyOk9yZ
|
The logs for this run have expired and are no longer available.
Loading