Skip to content

Commit 9fbd3ba

Browse files
AdrianoNicolucciAdrianoNicolucci
authored
fix: remove unused uuid dependency from api-graphql, predictions, and interactions (#14788)
* fix: remove unused uuid dependency from api-graphql, predictions, and interactions Remove direct uuid dependency from packages that don't need it to address GHSA-w5hq-g745-h8pq (out-of-bounds write in uuid v3/v5/v6). - api-graphql: removed uuid dep (already uses amplifyUuid from core) - predictions: removed uuid dep (never imported) - interactions: replaced direct uuid import with amplifyUuid from core The uuid dependency is now consolidated in @aws-amplify/core, which is the only package that wraps uuid v4 via amplifyUuid. * test: replace uuid with amplifyUuid in interactions test files
1 parent 68de0b1 commit 9fbd3ba

11 files changed

Lines changed: 38 additions & 32 deletions

File tree

‎.changeset/remove-uuid-dependency.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
'@aws-amplify/api-graphql': patch
3+
'@aws-amplify/interactions': patch
4+
'@aws-amplify/predictions': patch
5+
---
6+
7+
Remove unused uuid dependency from @aws-amplify/api-graphql, @aws-amplify/interactions, and @aws-amplify/predictions packages. All UUID generation is now consolidated through @aws-amplify/core's amplifyUuid wrapper, addressing security advisory GHSA-w5hq-g745-h8pq.

‎packages/api-graphql/package.json‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,7 @@
8585
"@aws-sdk/types": "^3.973.6",
8686
"graphql": "15.8.0",
8787
"rxjs": "^7.8.1",
88-
"tslib": "^2.5.0",
89-
"uuid": "^11.0.0"
88+
"tslib": "^2.5.0"
9089
},
9190
"size-limit": [
9291
{

‎packages/interactions/__tests__/lex-v1/apis/onComplete.test.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
22
// SPDX-License-Identifier: Apache-2.0
33

4-
import { v4 as uuid } from 'uuid';
4+
import { amplifyUuid } from '@aws-amplify/core/internals/utils';
55
import { lexProvider } from '../../../src/lex-v1/AWSLexProvider';
66
import { onComplete } from '../../../src/lex-v1/apis';
77
import { generateRandomLexV1Config } from '../../testUtils/randomConfigGeneration';
@@ -27,7 +27,7 @@ describe('Interactions LexV1 API: onComplete', () => {
2727
});
2828

2929
it('invokes provider onComplete API', () => {
30-
const message = uuid();
30+
const message = amplifyUuid();
3131
const mockCallback = jest.fn();
3232
onComplete({ botName: v1BotConfig.name, callback: mockCallback });
3333
expect(mockLexProvider).toHaveBeenCalledTimes(1);

‎packages/interactions/__tests__/lex-v1/apis/send.test.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
22
// SPDX-License-Identifier: Apache-2.0
33

4-
import { v4 as uuid } from 'uuid';
4+
import { amplifyUuid } from '@aws-amplify/core/internals/utils';
55
import { lexProvider } from '../../../src/lex-v1/AWSLexProvider';
66
import { send } from '../../../src/lex-v1/apis';
77
import { generateRandomLexV1Config } from '../../testUtils/randomConfigGeneration';
@@ -27,7 +27,7 @@ describe('Interactions LexV1 API: send', () => {
2727
});
2828

2929
it('invokes provider sendMessage API', async () => {
30-
const message = uuid();
30+
const message = amplifyUuid();
3131
await send({ botName: v1BotConfig.name, message });
3232
expect(mockLexProvider).toHaveBeenCalledTimes(1);
3333
expect(mockLexProvider).toHaveBeenCalledWith(v1BotConfig, message);
@@ -36,7 +36,7 @@ describe('Interactions LexV1 API: send', () => {
3636
it('rejects when bot config does not exist', async () => {
3737
mockResolveBotConfig.mockReturnValue(undefined);
3838
await expect(
39-
send({ botName: v1BotConfig.name, message: uuid() }),
39+
send({ botName: v1BotConfig.name, message: amplifyUuid() }),
4040
).rejects.toBeInstanceOf(InteractionsError);
4141
});
4242
});

‎packages/interactions/__tests__/lex-v2/AWSLexV2Provider.test.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ import {
1010
} from '@aws-sdk/client-lex-runtime-v2';
1111
import { gzip, strToU8 } from 'fflate';
1212
import { encode } from 'base-64';
13-
import { v4 as uuid } from 'uuid';
1413
import { lexProvider } from '../../src/lex-v2/AWSLexV2Provider';
14+
import { amplifyUuid } from '@aws-amplify/core/internals/utils';
1515

1616
jest.mock('@aws-amplify/core');
1717

@@ -467,7 +467,7 @@ describe('Interactions', () => {
467467
describe('onComplete callback from `Interactions.onComplete`', () => {
468468
test(`In progress, callback shouldn't be called`, async () => {
469469
// callback is only called once conversation is completed
470-
let config = { ...botConfig.BookTrip, name: uuid() };
470+
let config = { ...botConfig.BookTrip, name: amplifyUuid() };
471471
const inProgressCallback = mockCallbackProvider(
472472
ACTION_TYPE.IN_PROGRESS,
473473
);
@@ -484,7 +484,7 @@ describe('Interactions', () => {
484484
});
485485

486486
test(`task complete; callback with success resp`, async () => {
487-
let config = { ...botConfig.BookTrip, name: uuid() };
487+
let config = { ...botConfig.BookTrip, name: amplifyUuid() };
488488
const completeSuccessCallback = mockCallbackProvider(
489489
ACTION_TYPE.COMPLETE,
490490
);
@@ -502,7 +502,7 @@ describe('Interactions', () => {
502502
});
503503

504504
test(`task complete; callback with error resp`, async () => {
505-
let config = { ...botConfig.BookTrip, name: uuid() };
505+
let config = { ...botConfig.BookTrip, name: amplifyUuid() };
506506
const completeFailCallback = mockCallbackProvider(ACTION_TYPE.ERROR);
507507
provider.onComplete(config, completeFailCallback);
508508

‎packages/interactions/__tests__/lex-v2/apis/onComplete.test.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
22
// SPDX-License-Identifier: Apache-2.0
33

4-
import { v4 as uuid } from 'uuid';
4+
import { amplifyUuid } from '@aws-amplify/core/internals/utils';
55
import { lexProvider } from '../../../src/lex-v2/AWSLexV2Provider';
66
import { onComplete } from '../../../src/lex-v2/apis';
77
import { generateRandomLexV2Config } from '../../testUtils/randomConfigGeneration';
@@ -27,7 +27,7 @@ describe('Interactions LexV2 API: onComplete', () => {
2727
});
2828

2929
it('invokes provider onComplete API', () => {
30-
const message = uuid();
30+
const message = amplifyUuid();
3131
const mockCallback = jest.fn();
3232
onComplete({ botName: v2BotConfig.name, callback: mockCallback });
3333
expect(mockLexProvider).toHaveBeenCalledTimes(1);

‎packages/interactions/__tests__/lex-v2/apis/send.test.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
22
// SPDX-License-Identifier: Apache-2.0
33

4-
import { v4 as uuid } from 'uuid';
4+
import { amplifyUuid } from '@aws-amplify/core/internals/utils';
55
import { lexProvider } from '../../../src/lex-v2/AWSLexV2Provider';
66
import { send } from '../../../src/lex-v2/apis';
77
import { generateRandomLexV2Config } from '../../testUtils/randomConfigGeneration';
@@ -27,7 +27,7 @@ describe('Interactions LexV2 API: send', () => {
2727
});
2828

2929
it('invokes provider sendMessage API', async () => {
30-
const message = uuid();
30+
const message = amplifyUuid();
3131
await send({ botName: v2BotConfig.name, message });
3232
expect(mockLexProvider).toHaveBeenCalledTimes(1);
3333
expect(mockLexProvider).toHaveBeenCalledWith(v2BotConfig, message);
@@ -36,7 +36,7 @@ describe('Interactions LexV2 API: send', () => {
3636
it('rejects when bot config does not exist', async () => {
3737
mockResolveBotConfig.mockReturnValue(undefined);
3838
await expect(
39-
send({ botName: v2BotConfig.name, message: uuid() }),
39+
send({ botName: v2BotConfig.name, message: amplifyUuid() }),
4040
).rejects.toBeInstanceOf(InteractionsError);
4141
});
4242
});

‎packages/interactions/__tests__/testUtils/randomConfigGeneration.ts‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
11
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
22
// SPDX-License-Identifier: Apache-2.0
3-
import { v4 as uuid } from 'uuid';
3+
import { amplifyUuid } from '@aws-amplify/core/internals/utils';
44
import { AWSLexProviderOption } from '../../src/lex-v1/types';
55
import { AWSLexV2ProviderOption } from '../../src/lex-v2/types';
66

77
export const generateRandomLexV1Config = (): AWSLexProviderOption => ({
8-
name: uuid(),
9-
alias: uuid(),
10-
region: uuid(),
8+
name: amplifyUuid(),
9+
alias: amplifyUuid(),
10+
region: amplifyUuid(),
1111
});
1212

1313
export const generateRandomLexV2Config = (): AWSLexV2ProviderOption => ({
14-
name: uuid(),
15-
aliasId: uuid(),
16-
botId: uuid(),
17-
region: uuid(),
18-
localeId: uuid(),
14+
name: amplifyUuid(),
15+
aliasId: amplifyUuid(),
16+
botId: amplifyUuid(),
17+
region: amplifyUuid(),
18+
localeId: amplifyUuid(),
1919
});

‎packages/interactions/package.json‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,7 @@
7777
"base-64": "1.0.0",
7878
"fflate": "0.7.3",
7979
"pako": "2.0.4",
80-
"tslib": "^2.5.0",
81-
"uuid": "^11.0.0"
80+
"tslib": "^2.5.0"
8281
},
8382
"devDependencies": {
8483
"@aws-amplify/core": "6.16.2"

‎packages/interactions/src/lex-v2/AWSLexV2Provider.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,11 @@ import {
1010
RecognizeUtteranceCommandInput,
1111
RecognizeUtteranceCommandOutput,
1212
} from '@aws-sdk/client-lex-runtime-v2';
13-
import { getAmplifyUserAgentObject } from '@aws-amplify/core/internals/utils';
13+
import {
14+
amplifyUuid,
15+
getAmplifyUserAgentObject,
16+
} from '@aws-amplify/core/internals/utils';
1417
import { ConsoleLogger, fetchAuthSession } from '@aws-amplify/core';
15-
import { v4 as uuid } from 'uuid';
1618

1719
import { convert, unGzipBase64AsJson } from '../utils';
1820
import {
@@ -58,7 +60,7 @@ class AWSLexV2Provider {
5860
InteractionsOnCompleteCallback
5961
> = {};
6062

61-
private defaultSessionId: string = uuid();
63+
private defaultSessionId: string = amplifyUuid();
6264

6365
/**
6466
* Send a message to a bot

0 commit comments

Comments
 (0)