936bddf198
## Summary - Upgrades Node.js from 20.19.0 to 20.20.0 (and 22.12.0 to 22.22.0 for supervisor) to address the async_hooks stack overflow DoS vulnerability - Adds `maxDepth` parameter (default 128) to `flattenAttributes` and `unflattenAttributes` to prevent stack overflow on maliciously deep nested structures ## Details The vulnerability (patched in Node.js 20.20.0, 22.22.0, 24.13.0, 25.3.0) causes unrecoverable crashes (exit code 7) when stack overflow occurs during async_hooks callbacks. Since the webapp uses `AsyncLocalStorage`, it was theoretically vulnerable. ### Changes **Node.js version updates:** - `docker/Dockerfile`: 20.11.1 → 20.20.0 - `apps/supervisor/Containerfile`: 22-alpine → 22.22.0-alpine - `.nvmrc`: 20.19.0 → 20.20.0 - `apps/supervisor/.nvmrc`: 22.12.0 → 22.22.0 - `references/prisma-7/.nvmrc`: 20.19.0 → 20.20.0 - All GitHub workflows: 20.19.0 → 20.20.0 **Defense in depth:** - Added `maxDepth` parameter to `flattenAttributes()` and `unflattenAttributes()` in `packages/core` to prevent stack overflow on deeply nested user input ## Test plan - [x] All existing `flattenAttributes` tests pass (50 tests) - [x] New tests for depth limiting added - [x] Verify Docker builds work with new base images
142 lines
4.2 KiB
YAML
142 lines
4.2 KiB
YAML
name: "🧪 Unit Tests: Internal"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
workflow_call:
|
|
|
|
jobs:
|
|
unitTests:
|
|
name: "🧪 Unit Tests: Internal"
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
shardIndex: [1, 2, 3, 4, 5, 6, 7, 8]
|
|
shardTotal: [8]
|
|
env:
|
|
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
SHARD_INDEX: ${{ matrix.shardIndex }}
|
|
SHARD_TOTAL: ${{ matrix.shardTotal }}
|
|
steps:
|
|
- name: 🔧 Disable IPv6
|
|
run: |
|
|
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
|
|
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1
|
|
sudo sysctl -w net.ipv6.conf.lo.disable_ipv6=1
|
|
|
|
- name: 🔧 Configure docker address pool
|
|
run: |
|
|
CONFIG='{
|
|
"default-address-pools" : [
|
|
{
|
|
"base" : "172.17.0.0/12",
|
|
"size" : 20
|
|
},
|
|
{
|
|
"base" : "192.168.0.0/16",
|
|
"size" : 24
|
|
}
|
|
]
|
|
}'
|
|
mkdir -p /etc/docker
|
|
echo "$CONFIG" | sudo tee /etc/docker/daemon.json
|
|
|
|
- name: 🔧 Restart docker daemon
|
|
run: sudo systemctl restart docker
|
|
|
|
- name: ⬇️ Checkout repo
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: ⎔ Setup pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 10.23.0
|
|
|
|
- name: ⎔ Setup node
|
|
uses: buildjet/setup-node@v4
|
|
with:
|
|
node-version: 20.20.0
|
|
cache: "pnpm"
|
|
|
|
# ..to avoid rate limits when pulling images
|
|
- name: 🐳 Login to DockerHub
|
|
if: ${{ env.DOCKERHUB_USERNAME }}
|
|
uses: docker/login-action@v3
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
- name: 🐳 Skipping DockerHub login (no secrets available)
|
|
if: ${{ !env.DOCKERHUB_USERNAME }}
|
|
run: echo "DockerHub login skipped because secrets are not available."
|
|
|
|
- name: 🐳 Pre-pull testcontainer images
|
|
if: ${{ env.DOCKERHUB_USERNAME }}
|
|
run: |
|
|
echo "Pre-pulling Docker images with authenticated session..."
|
|
docker pull postgres:14
|
|
docker pull clickhouse/clickhouse-server:25.4-alpine
|
|
docker pull redis:7-alpine
|
|
docker pull testcontainers/ryuk:0.11.0
|
|
docker pull electricsql/electric:1.2.4
|
|
echo "Image pre-pull complete"
|
|
|
|
- name: 📥 Download deps
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: 📀 Generate Prisma Client
|
|
run: pnpm run generate
|
|
|
|
- name: 🧪 Run Internal Unit Tests
|
|
run: pnpm run test:internal --reporter=default --reporter=blob --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
|
|
|
|
- name: Gather all reports
|
|
if: ${{ !cancelled() }}
|
|
run: |
|
|
mkdir -p .vitest-reports
|
|
find . -type f -path '*/.vitest-reports/blob-*.json' \
|
|
-exec bash -c 'src="$1"; basename=$(basename "$src"); pkg=$(dirname "$src" | sed "s|^\./||;s|/\.vitest-reports$||;s|/|_|g"); cp "$src" ".vitest-reports/${pkg}-${basename}"' _ {} \;
|
|
|
|
- name: Upload blob reports to GitHub Actions Artifacts
|
|
if: ${{ !cancelled() }}
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: internal-blob-report-${{ matrix.shardIndex }}
|
|
path: .vitest-reports/*
|
|
include-hidden-files: true
|
|
retention-days: 1
|
|
|
|
merge-reports:
|
|
name: "📊 Merge Reports"
|
|
if: ${{ !cancelled() }}
|
|
needs: [unitTests]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: ⬇️ Checkout repo
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: ⎔ Setup pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 10.23.0
|
|
|
|
- name: ⎔ Setup node
|
|
uses: buildjet/setup-node@v4
|
|
with:
|
|
node-version: 20.20.0
|
|
# no cache enabled, we're not installing deps
|
|
|
|
- name: Download blob reports from GitHub Actions Artifacts
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
path: .vitest-reports
|
|
pattern: internal-blob-report-*
|
|
merge-multiple: true
|
|
|
|
- name: Merge reports
|
|
run: pnpm dlx vitest@3.1.4 run --merge-reports --pass-with-no-tests
|