Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

change package name on test to avoid scanning issue #313

Closed
wants to merge 2 commits into from
Closed

change package name on test to avoid scanning issue #313

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4fee4f2
remove package name to avoid scanning issue
cichelero Sep 4, 2023
3c8485e
flip name
cichelero Sep 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion test/resolver/multirepo/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"name": "monorepo-symlink-test",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the "name" field is always required in package.json, so this can't just be removed

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What would be involved to rename the package to something like resolve-monorepo-symlink-test? In saying that, I think the posibility of a malicous person would simply deploy a new package with the new name, so this would be a temporary fix potentially. Unfortunately the scanner I used was AWS Inspector which I would think is widely used, so this is probably affecting many people as indicated with all the previous open issues.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I certainly could - but then people might not realize that their scanner doesn't actually understand how npm packages work, and might make the mistake of thinking it's helping their security.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think people might understand but a simple rename might save them lots of time explaining it's a false positive if they work in a medium/big company where such scans are heavily used.

I adapted the PR with the renaming. Up to you @ljharb :-)

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ljharb i totally get where you are coming from. However it's not the internal discussion that is difficult, but it's to the 30 different customers, many from large enterprises who are using our docker packages.

We dont have the access to the right people, nor the bandwidth to explain they should ignore their security scanner. This means they are not deploying at all. It's quite a difficult situation where we are contemplating forking this package to address the issue. Obviously this is insane!

"name": "test-monorepo-symlink",
"private": true,
"version": "0.0.0",
"description": "",
Expand Down