Skip to content

Commit e59939f

Browse files
olexii4olexii4
committed
fix: address security vulnerabilities and code quality issues in Devfile Creator
- Fix command injection in kubeconfig injection via base64 encoding - Add Fastify JSON Schema validation for agent creation endpoint - Add authentication checks to terminal proxy endpoints - Fix operator precedence bug in isWebSocketChannel - Disable automountServiceAccountToken on agent pods - Remove hardcoded --dangerously-skip-permissions fallback - Add terminal port range validation (1024-65535) - Restrict postMessage to same origin instead of wildcard - Key terminal URL cache on namespace/agentId to prevent collisions - Replace fragile regex with js-yaml for devfile YAML parsing - Add in-memory caching with TTL for AI agent registry ConfigMap reads - Remove dead code in terminal helpers - Resolve MIT license entries for CodeMirror and Lezer dependencies - Update tests for configMap watcher and agent pod listener Signed-off-by: Oleksii Orel <oorel@redhat.com> Assisted-by: Claude Sonnet 4.5 Signed-off-by: Oleksii Orel <oorel@redhat.com>
1 parent 415c9cd commit e59939f

13 files changed

Lines changed: 280 additions & 435 deletions

File tree

‎.deps/EXCLUDED/dev.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,5 @@ This file contains a manual contribution to .deps/dev.md and it's needed because
44
| --- | --- |
55
| `@eclipse-che/api@7.86.0` | ecd.che |
66
| `@eclipse-che/license-tool@2.0.0` | ecd.che |
7-
| `@webassemblyjs/helper-buffer@1.14.1` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@webassemblyjs/helper-buffer/1.14.1) |
7+
88

‎.deps/EXCLUDED/prod.md‎

Lines changed: 11 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,35 +2,30 @@ This file lists dependencies that do not need CQs or auto-detection does not wor
22

33
| Packages | Resolved CQs |
44
| --- | --- |
5+
| `@codemirror/autocomplete@6.20.1` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@codemirror/autocomplete/6.20.1) |
6+
| `@codemirror/commands@6.10.3` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@codemirror/commands/6.10.3) |
7+
| `@codemirror/lang-yaml@6.1.3` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@codemirror/lang-yaml/6.1.3) |
8+
| `@codemirror/language@6.12.3` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@codemirror/language/6.12.3) |
9+
| `@codemirror/lint@6.9.5` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@codemirror/lint/6.9.5) |
10+
| `@codemirror/state@6.6.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@codemirror/state/6.6.0) |
11+
| `@codemirror/view@6.41.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@codemirror/view/6.41.0) |
512
| `@eclipse-che/che-devworkspace-generator@7.113.0-next-7b6a101` | ecd.che |
613
| `@fastify/busboy@3.0.1` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@fastify/busboy/3.0.1) |
714
| `@fastify/cors@11.2.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@fastify/cors/11.2.0) |
815
| `@fastify/http-proxy@11.4.4` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@fastify/http-proxy/11.4.4) |
9-
| `@fastify/oauth2@8.2.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@fastify/oauth2/8.2.0) |
1016
| `@fastify/reply-from@12.6.2` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@fastify/reply-from/12.6.2) |
1117
| `@fastify/static@9.0.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@fastify/static/9.0.0) |
12-
| `@fastify/swagger-ui@5.2.5` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@fastify/swagger-ui/5.2.5) |
13-
| `@fastify/swagger@9.7.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@fastify/swagger/9.7.0) |
14-
| `@hapi/hoek@10.0.1` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@hapi/hoek/10.0.1) |
1518
| `@isaacs/brace-expansion@5.0.1` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@isaacs/brace-expansion/5.0.1) |
16-
| `@patternfly/react-icons@6.4.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@patternfly/react-icons/6.4.0) |
19+
| `@lezer/common@1.5.2` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@lezer/common/1.5.2) |
20+
| `@lezer/lr@1.4.8` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@lezer/lr/1.4.8) |
21+
| `@lezer/yaml@1.0.4` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@lezer/yaml/1.0.4) |
1722
| `@uiw/codemirror-theme-github@4.25.8` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@uiw/codemirror-theme-github/4.25.8) |
1823
| `@uiw/codemirror-themes@4.25.8` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@uiw/codemirror-themes/4.25.8) |
1924
| `any-signal@4.2.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/any-signal/4.2.0) |
20-
| `blueimp-md5@2.19.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/blueimp-md5/2.19.0) |
21-
| `create-hash@1.1.3` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/create-hash/1.1.3) |
2225
| `cronstrue@3.13.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/cronstrue/3.13.0) |
23-
| `fast-json-stringify@6.3.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/fast-json-stringify/6.3.0) |
2426
| `fast-uri@2.4.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/fast-uri/2.4.0) |
2527
| `fastify-plugin@5.2.1` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/fastify-plugin/5.2.1) |
2628
| `fastify@5.8.4` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/fastify/5.8.4) |
27-
| `file-selector@2.1.2` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/file-selector/2.1.2) |
2829
| `jsep@1.3.9` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/jsep/1.3.9) |
29-
| `light-my-request@6.6.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/light-my-request/6.6.0) |
30-
| `lodash@4.18.1` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/lodash/4.18.1) |
31-
| `pino@10.3.1` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/pino/10.3.1) |
32-
| `qs@6.5.5` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/qs/6.5.5) |
33-
| `real-require@0.2.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/real-require/0.2.0) |
34-
| `undici@7.24.6` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/undici/7.24.6) |
35-
| `yaml@2.8.3` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/yaml/2.8.3) |
30+
3631

‎.deps/dev.md‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,6 @@
148148
| `@types/babel__template@7.4.3` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/babel__template/7.4.3) |
149149
| `@types/babel__traverse@7.20.3` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/babel__traverse/7.20.3) |
150150
| `@types/caseless@0.12.4` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/caseless/0.12.4) |
151-
| `@types/codemirror@5.60.15` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/codemirror/5.60.15) |
152151
| `@types/eslint-scope@3.7.7` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/eslint-scope/3.7.7) |
153152
| `@types/eslint@8.44.6` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/eslint/8.44.6) |
154153
| `@types/eslint@9.6.1` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/eslint/9.6.1) |
@@ -191,7 +190,6 @@
191190
| `@types/stack-utils@2.0.2` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/stack-utils/2.0.2) |
192191
| `@types/stack-utils@2.0.3` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/stack-utils/2.0.3) |
193192
| `@types/stream-buffers@3.0.8` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/stream-buffers/3.0.8) |
194-
| `@types/tern@0.23.9` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/tern/0.23.9) |
195193
| `@types/tough-cookie@4.0.4` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/tough-cookie/4.0.4) |
196194
| `@types/webpack@5.28.5` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/webpack/5.28.5) |
197195
| `@types/ws@8.18.1` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@types/ws/8.18.1) |

0 commit comments

Comments
 (0)