fix: SSRF vulnerability and error handling bugs in wakatime and stats fetchers#4860
Draft
joaopedroplinta wants to merge 1 commit intoanuraghazra:masterfrom
Draft
Conversation
… fetchers - Validate api_domain against an allowlist (wakatime.com, wakapi.dev) in fetchWakatimeStats to prevent SSRF via user-controlled domain injection - Use optional chaining (err.response?.status) to avoid TypeError when err.response is undefined on network errors (timeout, DNS failure) - Rethrow original error in totalCommitsFetcher instead of wrapping with new Error(err), preserving the original stack trace - Add secondary error message for WAKATIME_ERROR in error.js - Fix floating-point precision in calculateRank test (pre-existing failure)
|
@joaopedroplinta is attempting to deploy a commit to the github readme stats Team on Vercel. A member of the Team first needs to authorize it. |
github-actions
Bot
added
stats-card
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
api_domainagainst an allowlist (wakatime.com,wakapi.dev) infetchWakatimeStatsto prevent SSRF via user-controlled domain injection (fix: SSRF vulnerability and error handling bugs in wakatime and stats fetchers #4859)err.response?.status) inwakatime.jsto avoidTypeErrorwhenerr.responseisundefinedon network errors (timeout, DNS failure)totalCommitsFetcher(stats.js) instead of wrapping withnew Error(err), preserving the original stack traceWAKATIME_ERRORinerror.jscalculateRanktest (pre-existing failure on upstream master)Relates to #4859
Test plan
fetchWakatime.test.js— existing tests cover the user-not-found pathfetchStats.test.js— existing tests cover thetotalCommitsFetchererror pathcalculateRank.test.js— precision fix confirmed passing