Fix incorrect vulnerable manifest path check #186
Conversation
|
@SalimBensiali I don't believe that this PR addresses the issue you reported:
|
|
This b31caa4 does expose a bug in how |
| @@ -78,7 +78,7 @@ export async function getAlert (name: string, version: string, directory: string | |||
|
|
|||
| const nodes = alerts?.repository?.vulnerabilityAlerts?.nodes | |||
| const found = nodes.find(a => (version === '' || a.vulnerableRequirements === `= ${version}`) && | |||
| trimSlashes(a.vulnerableManifestPath) === `${trimSlashes(directory)}/${a.vulnerableManifestFilename}` && | |||
There was a problem hiding this comment.
@mwaddell without the propsed change, when package.json is at root, you get the following:
a.vulnerableManifestPathequals/package.jsonwhich makestrimSlashes(a.vulnerableManifestPath)resolve topackage.json`${trimSlashes(directory)}/${a.vulnerableManifestFilename}`is equivalent to`${trimSlashes('/')}/package.json`which yields/package.json
And so basically the slash trimmed paths never match, ending up making getAlert never return a matching security alert
There was a problem hiding this comment.
I understand now - thank you for the clarification
|
@mwaddell I will run the dry-run command to verify on my end |
|
Thanks for this @SalimBensiali - it looks like the |
Head branch was pushed to by a user without write access
|
Done ✅ |
Closes #185