Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[PM-13923] [CLI] fix: resolve CLI file upload issue in Node.js 18+ #11652

Merged
merged 4 commits into from
Nov 27, 2024

Conversation

xinghejd
Copy link
Contributor

@xinghejd xinghejd commented Oct 22, 2024

🎟️ Tracking

Fixes #3984

📔 Objective

The file upload judgment logic of the self-hosted version is not rigorous enough, and the upload code in the CLI environment is put into a try-catch block for execution.

Although this could work before Node.js 18, after Node.js 18 introduced built-in Blob objects, it led to delayed error throwing and polluted the fd instance.

Now, it has been replaced with a more explicit judgment statement to distinguish between the browser environment and the CLI environment.

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

@xinghejd xinghejd requested a review from a team as a code owner October 22, 2024 07:23
@xinghejd xinghejd requested a review from addisonbeck October 22, 2024 07:23
@CLAassistant
Copy link

CLAassistant commented Oct 22, 2024

CLA assistant check
All committers have signed the CLA.

@bitwarden-bot
Copy link

bitwarden-bot commented Oct 22, 2024

Thank you for your contribution! We've added this to our internal Community PR board for review.
ID: PM-13923

https://bitwarden.atlassian.net/browse/PM-13923

@bitwarden-bot bitwarden-bot changed the title [CLI] fix: resolve CLI file upload issue in Node.js 18+ [PM-13923] [CLI] fix: resolve CLI file upload issue in Node.js 18+ Oct 22, 2024
@xinghejd
Copy link
Contributor Author

xinghejd commented Nov 15, 2024

Hi,Is there any progress? @addisonbeck

@addisonbeck
Copy link
Contributor

@xinghejd Thanks for the contribution! @coroiu has this on his agenda for this sprint. Stay tuned! Sorry for the wait time on this.

@addisonbeck addisonbeck requested review from coroiu and removed request for addisonbeck November 19, 2024 18:55
Signed-off-by: xinghejd <31512683+xinghejd@users.noreply.github.com>
@coroiu coroiu added the needs-qa Marks a PR as requiring QA approval label Nov 21, 2024
@coroiu coroiu removed the needs-qa Marks a PR as requiring QA approval label Nov 26, 2024
Copy link
Contributor

Logo
Checkmarx One – Scan Summary & Details96b3fdd6-65a6-4a1e-a68e-e32d0ad6c48c

New Issues

Severity Issue Source File / Package Checkmarx Insight
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 554 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 809 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 553 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 107 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 880 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 862 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 843 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 833 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 781 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 927 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 839 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 820 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 780 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 915 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 904 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 815 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 810 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 805 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 498 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 605 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 423 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 423 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 478 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 478 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 605 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 417 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 435 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 435 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 423 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 435 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 605 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 478 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 921 Attack Vector
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/overlay/inline-menu/pages/list/autofill-inline-menu-list.ts: 924 Attack Vector
LOW Unpinned Actions Full Length Commit SHA /build-web.yml: 341 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 200 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 358 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 522 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 246 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 81 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 179 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-auto-bump.yml: 20 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /build-web.yml: 190 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /build-desktop.yml: 1338 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 506 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /build-desktop.yml: 1292 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /build-web.yml: 266 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 193 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 186 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /build-web.yml: 296 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /build-browser.yml: 366 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 161 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /build-cli.yml: 404 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /crowdin-pull.yml: 40 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /build-browser.yml: 407 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 514 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 498 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /build-desktop.yml: 890 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 296 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW Unpinned Actions Full Length Commit SHA /version-bump.yml: 47 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...

Fixed Issues

Severity Issue Source File / Package
HIGH Client_DOM_XSS /apps/web/src/connectors/redirect.ts: 15
HIGH Client_DOM_XSS /apps/web/src/connectors/redirect.ts: 6
MEDIUM Absolute_Path_Traversal /apps/cli/src/oss-serve-configurator.ts: 319
MEDIUM Absolute_Path_Traversal /apps/cli/src/oss-serve-configurator.ts: 319
MEDIUM Absolute_Path_Traversal /apps/cli/src/oss-serve-configurator.ts: 287
MEDIUM Absolute_Path_Traversal /apps/cli/src/oss-serve-configurator.ts: 287
MEDIUM Angular_Improper_Type_Pipe_Usage /apps/browser/src/autofill/popup/fido2/fido2-use-browser-link-v1.component.html: 1
MEDIUM Angular_Improper_Type_Pipe_Usage /apps/web/src/app/layouts/product-switcher/product-switcher.component.html: 1
MEDIUM Angular_Improper_Type_Pipe_Usage /libs/components/src/navigation/nav-divider.component.html: 1
MEDIUM Angular_Improper_Type_Pipe_Usage /apps/browser/src/autofill/popup/fido2/fido2-use-browser-link.component.html: 1
MEDIUM Client_Privacy_Violation /bitwarden_license/bit-web/src/app/tools/access-intelligence/password-health-members.component.html: 50
MEDIUM Client_Privacy_Violation /bitwarden_license/bit-web/src/app/tools/access-intelligence/password-health-members.component.html: 50
MEDIUM Client_Privacy_Violation /bitwarden_license/bit-web/src/app/tools/access-intelligence/password-health-members.component.html: 55
MEDIUM Client_Privacy_Violation /bitwarden_license/bit-web/src/app/tools/access-intelligence/password-health-members.component.html: 45
MEDIUM Client_Privacy_Violation /libs/tools/generator/components/src/credential-generator-history.component.html: 3
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 684
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 557
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 502
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 496
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 580
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 670
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 564
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 657
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 514
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 209
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 656
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 710
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 409
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 653
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 647
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 646
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 645
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 644
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 643
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 2873
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 136
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 1644
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 2768
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 588
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 1719
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 1719
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 436
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 368
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 222
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 413
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 1718
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 548
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 453
MEDIUM Client_Privacy_Violation /apps/browser/src/autofill/background/overlay.background.ts: 368
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM Client_Privacy_Violation /apps/desktop/src/vault/app/vault/view.component.html: 484
MEDIUM

More results are available on AST platform

@coroiu coroiu enabled auto-merge (squash) November 27, 2024 09:43
@coroiu coroiu merged commit 35764b5 into bitwarden:main Nov 27, 2024
55 of 56 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Error adding attachment using BW CLI (both CLI and REST API): An unhandled server error has occurred.
5 participants