From 63e71836f00be9b38627153dab8e17c0de196d41 Mon Sep 17 00:00:00 2001 From: dkoss Date: Tue, 3 Jun 2025 21:00:01 -0400 Subject: [PATCH] fix(remove-axios): Removes axios dependency with security issue --- .github/workflows/ci.yml | 5 ++-- package-lock.json | 6 ++--- packages/synthetics-sdk-api/package.json | 3 +-- .../src/cloud_region_resolver.ts | 27 ++++++++++--------- .../test/unit/cloud_region_resolver.spec.ts | 20 ++++++++------ packages/synthetics-sdk-api/tsconfig.json | 3 ++- tsconfig.base.json | 2 +- 7 files changed, 34 insertions(+), 32 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8b86de4b..d5bd31a1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,6 +1,5 @@ on: push: - branches: [main] pull_request: name: ci jobs: @@ -11,7 +10,7 @@ jobs: node: [18, 20] include: # use latest npm by default - - npm-version: latest + - npm-version: 10.9.2 steps: - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0 @@ -21,4 +20,4 @@ jobs: - name: Upgrade to latest npm to support lockfile v2 run: npm install -g npm@${{ matrix.npm-version }} - run: npm install && npm install - - run: npm run test + - run: npm run test \ No newline at end of file diff --git a/package-lock.json b/package-lock.json index 108a717e..ff8471bd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10511,7 +10511,7 @@ }, "packages/synthetics-sdk-api": { "name": "@google-cloud/synthetics-sdk-api", - "version": "0.5.1", + "version": "0.6.0", "license": "Apache-2.0", "dependencies": { "@google-cloud/opentelemetry-cloud-trace-exporter": "2.1.0", @@ -10521,7 +10521,6 @@ "@opentelemetry/sdk-node": "0.43.0", "@opentelemetry/sdk-trace-base": "1.17.0", "@opentelemetry/sdk-trace-node": "1.17.0", - "axios": "1.6.7", "error-stack-parser": "2.1.4", "google-auth-library": "9.0.0", "ts-proto": "1.148.1", @@ -10929,7 +10928,7 @@ }, "packages/synthetics-sdk-broken-links": { "name": "@google-cloud/synthetics-sdk-broken-links", - "version": "0.2.0", + "version": "0.3.0", "license": "Apache-2.0", "dependencies": { "@google-cloud/storage": "^7.7.0", @@ -11983,7 +11982,6 @@ "@types/node": "^18.15.10", "@types/sinon": "^10.0.16", "@types/supertest": "^2.0.12", - "axios": "1.6.7", "chai": "^4.3.7", "error-stack-parser": "2.1.4", "express": "^4.18.2", diff --git a/packages/synthetics-sdk-api/package.json b/packages/synthetics-sdk-api/package.json index 6bfcda45..faf6ce94 100644 --- a/packages/synthetics-sdk-api/package.json +++ b/packages/synthetics-sdk-api/package.json @@ -43,8 +43,7 @@ "error-stack-parser": "2.1.4", "google-auth-library": "9.0.0", "ts-proto": "1.148.1", - "winston": "3.10.0", - "axios": "1.6.7" + "winston": "3.10.0" }, "author": "Google Inc.", "license": "Apache-2.0" diff --git a/packages/synthetics-sdk-api/src/cloud_region_resolver.ts b/packages/synthetics-sdk-api/src/cloud_region_resolver.ts index 1bdd3dee..45d551a5 100644 --- a/packages/synthetics-sdk-api/src/cloud_region_resolver.ts +++ b/packages/synthetics-sdk-api/src/cloud_region_resolver.ts @@ -12,10 +12,7 @@ // See the License for the specific language governing permissions and // limitations under the License. -import axios, { AxiosResponse } from 'axios'; - /** - * * @public * * Retrieves the region in which the current Google Cloud Function (v2) is @@ -24,24 +21,28 @@ import axios, { AxiosResponse } from 'axios'; export async function getExecutionRegion(): Promise { const metadataServerUrl = 'http://metadata.google.internal/computeMetadata/v1/instance/region'; - const headers = { 'Metadata-Flavor': 'Google' }; + const options = { + headers: { + 'Metadata-Flavor': 'Google', + }, + }; try { - const response: AxiosResponse = await axios.get(metadataServerUrl, { - headers, - }); + const response = await fetch(metadataServerUrl, options); + + if (!response.ok) { + throw new Error(`Request failed with status ${response.status}`); + } + + const body = await response.text(); // Extract region from the response (e.g., 'us-east1') - const regions = response.data.split('/'); + const regions = body.split('/'); const region = regions[regions.length - 1]; return region; } catch (error) { - if (axios.isAxiosError(error)) { - console.error('Error fetching region from metadata server:', error); - } else { - console.error('Unexpected error:', error); - } + console.error('Error fetching region from metadata server:', error); } return null; diff --git a/packages/synthetics-sdk-api/test/unit/cloud_region_resolver.spec.ts b/packages/synthetics-sdk-api/test/unit/cloud_region_resolver.spec.ts index 739160f2..ae4337aa 100644 --- a/packages/synthetics-sdk-api/test/unit/cloud_region_resolver.spec.ts +++ b/packages/synthetics-sdk-api/test/unit/cloud_region_resolver.spec.ts @@ -12,34 +12,38 @@ // See the License for the specific language governing permissions and // limitations under the License. -import axios from 'axios'; import * as sinon from 'sinon'; import { expect } from 'chai'; import { getExecutionRegion } from '../../src/cloud_region_resolver'; -describe('getExecutionRegion', () => { - let axiosGetStub: sinon.SinonStub; +describe('getExecutionRegion (with fetch)', () => { + let fetchStub: sinon.SinonStub; beforeEach(() => { - axiosGetStub = sinon.stub(axios, 'get'); + fetchStub = sinon.stub(global, 'fetch'); }); afterEach(() => { - axiosGetStub.restore(); + fetchStub.restore(); }); it('should retrieve the region from the metadata server', async () => { - axiosGetStub.resolves({ data: 'projects/123456789/regions/us-east1' }); + const mockResponse = { + ok: true, + text: () => Promise.resolve('projects/123456789/regions/us-east1'), + }; + fetchStub.resolves(mockResponse as any); const region = await getExecutionRegion(); expect(region).to.equal('us-east1'); - expect(axiosGetStub.calledOnce).to.be.true; + expect(fetchStub.calledOnce).to.be.true; }); it('should handle errors from the metadata server', async () => { - axiosGetStub.rejects(new Error('Metadata server error')); + fetchStub.rejects(new Error('Network error')); const region = await getExecutionRegion(); + expect(region).to.be.null; }); }); diff --git a/packages/synthetics-sdk-api/tsconfig.json b/packages/synthetics-sdk-api/tsconfig.json index 0de7cac0..33b5bf0e 100644 --- a/packages/synthetics-sdk-api/tsconfig.json +++ b/packages/synthetics-sdk-api/tsconfig.json @@ -7,7 +7,8 @@ "composite": true, "resolveJsonModule": true, "esModuleInterop": true, - "module": "commonjs" + "module": "commonjs", + "lib": ["es2020", "dom"] }, "include": [ "src/**/*", diff --git a/tsconfig.base.json b/tsconfig.base.json index ae4fefad..a2a266dc 100644 --- a/tsconfig.base.json +++ b/tsconfig.base.json @@ -1,3 +1,3 @@ { "extends": "./node_modules/gts/tsconfig-google.json" -} \ No newline at end of file +}