fix: False positive report GHSA-2jcg-qqmg-46q6#37269
Conversation
WalkthroughThe pull request introduces modifications to the Dockerfile aimed at enhancing the build process and error handling. Key changes include the adoption of heredoc syntax for improved script readability and the implementation of Changes
Possibly related PRs
Suggested labels
Suggested reviewers
📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🔇 Additional comments (3)Dockerfile (3)
The addition of
The systematic approach to permission management and security hardening is commendable:
The removal of the test folder effectively addresses the false positive security report while maintaining only production dependencies. Let's verify no other test folders exist that might trigger similar issues: Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
| cd ./utils | ||
| npm install --only=prod | ||
| npm install --only=prod -g . | ||
| rm -rf utils/node_modules/resolve/test |
There was a problem hiding this comment.
This is the line that's fixing the problem. Rest of the changes are a refactor to make code more readable.
2 participants
Description
Some scanner tools like Syft and Grype are reporting a scary false positive at GHSA-2jcg-qqmg-46q6, on the following file in the Docker image:
The advisory itself isn't applicable to Appsmith, and this above package is not used in the product at all. This PR deletes this
testfolder so this false positive is immediately taken out.Nevertheless, we shouldn't even have the
node_modulesfolder in the Docker image, and we should be "building"appsmithctlinstead. That's part of a larger effort to improve/fixappsmithctland will be coming up in future PRs.The SBOM entry for the package in Syft’s proprietary format
{ "id": "8686a02f6819d5a1", "name": "monorepo-symlink-test", "version": "0.0.0", "type": "npm", "foundBy": "javascript-package-cataloger", "locations": [ { "path": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "layerID": "sha256:02e68fb671fe8bc43f75862b43445160e17e3ec2f13f09bf346a65c66cd93557", "accessPath": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "annotations": { "evidence": "primary" } } ], "licenses": [ { "value": "MIT", "spdxExpression": "MIT", "type": "declared", "urls": [], "locations": [ { "path": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "layerID": "sha256:02e68fb671fe8bc43f75862b43445160e17e3ec2f13f09bf346a65c66cd93557", "accessPath": "/opt/appsmith/utils/node_modules/resolve/test/resolver/multirepo/package.json", "annotations": { "evidence": "primary" } } ] } ], "language": "javascript", "cpes": [ { "cpe": "cpe:2.3:a:monorepo-symlink-test:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo-symlink-test:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink_test:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink_test:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo-symlink:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo-symlink:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo_symlink:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo:monorepo-symlink-test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" }, { "cpe": "cpe:2.3:a:monorepo:monorepo_symlink_test:0.0.0:*:*:*:*:*:*:*", "source": "syft-generated" } ], "purl": "pkg:npm/monorepo-symlink-test@0.0.0", "metadataType": "javascript-npm-package", "metadata": { "name": "monorepo-symlink-test", "version": "0.0.0", "author": "", "homepage": "", "description": "", "url": "", "private": true } }Reported by a user.
/test sanity
Communication
Should the DevRel and Marketing teams inform users about this change?
Tip
🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/11715737322
Commit: 42aa69c
Cypress dashboard.
Tags:
@tag.SanitySpec:
Thu, 07 Nov 2024 03:26:39 UTC
Summary by CodeRabbit