Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Nodejs] Add tests for untrusted deserialization #3759

Draft
wants to merge 4 commits into
base: main
Choose a base branch
from
Draft

[Nodejs] Add tests for untrusted deserialization #3759

wants to merge 4 commits into from
+58 −3

Conversation

IlyasShabi
Copy link
Contributor

Motivation

Add system test for Untrusted deserialization vulnerability

Changes

Added test for Untrusted deserialization vulnerability in express4, 5 and typescript

Workflow

  1. ⚠️ Create your PR as draft ⚠️
  2. Work on you PR until the CI passes (if something not related to your task is failing, you can ignore it)
  3. Mark it as ready for review
    • Test logic is modified? -> Get a review from RFC owner. We're working on refining the codeowners file quickly.
    • Framework is modified, or non obvious usage of it -> get a review from R&P team

🚀 Once your PR is reviewed, you can merge it!

🛟 #apm-shared-testing 🛟

Reviewer checklist

  • If PR title starts with [<language>], double-check that only <language> is impacted by the change
  • No system-tests internal is modified. Otherwise, I have the approval from R&P team
  • CI is green, or failing jobs are not related to this change (and you are 100% sure about this statement)
  • A docker base image is modified?
    • the relevant build-XXX-image label is present
  • A scenario is added (or removed)?

@IlyasShabi IlyasShabi marked this pull request as ready for review January 3, 2025 15:53
@IlyasShabi IlyasShabi requested review from a team as code owners January 3, 2025 15:53
cbeauchesne
cbeauchesne requested changes Jan 6, 2025
View reviewed changes
utils/scripts/load-binary.sh Outdated Show resolved Hide resolved
uurien
uurien reviewed Jan 9, 2025
View reviewed changes
manifests/nodejs.yml
@@ -42,6 +42,7 @@ refs:
- &ref_5_27_0 '>=5.27.0 || ^4.51.0'
- &ref_5_29_0 '>=5.29.0 || ^4.53.0' # express 5 support
- &ref_5_30_0 '>=5.30.0 || ^4.54.0'
- &ref_5_31_0 '>=5.31.0 || ^4.55.0'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

5.31.0 already released, It should be at least 5.32.0

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@IlyasShabi IlyasShabi force-pushed the untrusted-deserialization branch from da29706 to e9e5037 Compare January 9, 2025 10:51
@IlyasShabi IlyasShabi marked this pull request as draft January 10, 2025 09:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@uurien uurien uurien left review comments

@cbeauchesne cbeauchesne cbeauchesne requested changes

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@IlyasShabi @uurien @cbeauchesne