Skip to content

Commit 3d61d6a

Browse files
broofabroofa
committed
fix: backport fix for GHSA-w5hq-g745-h8pq 
1 parent 7844bc2 commit 3d61d6a

5 files changed

Lines changed: 45 additions & 8 deletions

File tree

‎.github/workflows/release-please.yml‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,12 @@ on:
88
push:
99
branches:
1010
- main
11+
- 12.x
12+
- 13.x
1113

1214
permissions:
1315
contents: write
16+
id-token: write
1417
pull-requests: write
1518

1619
name: release-please
@@ -19,11 +22,13 @@ jobs:
1922
release-please:
2023
runs-on: ubuntu-latest
2124
steps:
22-
- uses: googleapis/release-please-action@v4
25+
- uses: googleapis/release-please-action@v5
2326
id: release
2427
with:
25-
token: ${{ secrets.UUID_RELEASE_PLEASE_TOKEN }}
28+
token: ${{ secrets.GITHUB_TOKEN }}
2629
release-type: node
30+
target-branch: ${{ github.ref_name }}
31+
versioning-strategy: ${{ (github.ref_name == '12.x' || github.ref_name == '13.x') && 'always-bump-patch' || 'default' }}
2732

2833
- run: echo "Release created?... ${{ steps.release.outputs.release_created }}"
2934

@@ -32,7 +37,7 @@ jobs:
3237
if: ${{ steps.release.outputs.release_created }}
3338
- uses: actions/setup-node@v4
3439
with:
35-
node-version: 20
40+
node-version: 24
3641
registry-url: 'https://registry.npmjs.org'
3742
if: ${{ steps.release.outputs.release_created }}
3843

@@ -42,7 +47,13 @@ jobs:
4247
- run: npm test
4348
if: ${{ steps.release.outputs.release_created }}
4449

45-
- run: npm publish
46-
env:
47-
NODE_AUTH_TOKEN: ${{secrets.UUID_NPM_RELEASE_TOKEN}}
50+
- name: Publish to npm
4851
if: ${{ steps.release.outputs.release_created }}
52+
run: |
53+
if [[ "$GITHUB_REF_NAME" == "main" ]]; then
54+
npm publish --provenance
55+
else
56+
npm publish --provenance --tag "legacy-v${GITHUB_REF_NAME%%.x}"
57+
fi
58+
env:
59+
NODE_AUTH_TOKEN: ${{ secrets.UUID_NPM_RELEASE_TOKEN }}

‎src/test/v35.test.ts‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,15 @@ describe('v35', () => {
158158
assert.throws(() => v3('hello.example.com', null, new Uint8Array(16)));
159159
});
160160

161+
test('v3 throws RangeError for out-of-range indexes', () => {
162+
const buf15 = new Uint8Array(15);
163+
const buf30 = new Uint8Array(30);
164+
165+
assert.throws(() => v3('hello.example.com', v3.DNS, buf15), RangeError);
166+
assert.throws(() => v3('hello.example.com', v3.DNS, buf30, -1), RangeError);
167+
assert.throws(() => v3('hello.example.com', v3.DNS, buf30, 15), RangeError);
168+
});
169+
161170
test('v5', () => {
162171
// Expect to get the same results as http://tools.adjet.org/uuid-v5
163172
assert.strictEqual(v5('hello.example.com', v5.DNS), 'fdda765f-fc57-5604-a269-52a7df8164ec');

‎src/test/v6.test.ts‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,4 +87,13 @@ describe('v6', () => {
8787
const id = v6ToV1(V6_ID);
8888
assert.equal(id, V1_ID);
8989
});
90+
91+
test('throws RangeError for out-of-range indexes', () => {
92+
const buf15 = new Uint8Array(15);
93+
const buf30 = new Uint8Array(30);
94+
95+
assert.throws(() => v6({}, buf15), RangeError);
96+
assert.throws(() => v6({}, buf30, -1), RangeError);
97+
assert.throws(() => v6({}, buf30, 15), RangeError);
98+
});
9099
});

‎src/v35.ts‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
import { UUIDTypes } from './types.js';
21
import parse from './parse.js';
32
import { unsafeStringify } from './stringify.js';
3+
import { UUIDTypes } from './types.js';
44

55
export function stringToBytes(str: string) {
66
// TODO: Use TextEncoder (see https://stackoverflow.com/a/48762658/109538)
@@ -53,6 +53,10 @@ export default function v35<TBuf extends Uint8Array = Uint8Array>(
5353
if (buf) {
5454
offset = offset || 0;
5555

56+
if (offset < 0 || offset + 16 > buf.length) {
57+
throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);
58+
}
59+
5660
for (let i = 0; i < 16; ++i) {
5761
buf[offset + i] = bytes[i];
5862
}

‎src/v6.ts‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
import { UUIDTypes, Version6Options } from './types.js';
21
import { unsafeStringify } from './stringify.js';
2+
import { UUIDTypes, Version6Options } from './types.js';
33
import v1 from './v1.js';
44
import v1ToV6 from './v1ToV6.js';
55

@@ -27,6 +27,10 @@ function v6<TBuf extends Uint8Array = Uint8Array>(
2727

2828
// Return as a byte array if requested
2929
if (buf) {
30+
if (offset < 0 || offset + 16 > buf.length) {
31+
throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);
32+
}
33+
3034
for (let i = 0; i < 16; i++) {
3135
buf[offset + i] = bytes[i];
3236
}

0 commit comments

Comments
 (0)