-
Notifications
You must be signed in to change notification settings - Fork 3.8k
gRPC JavaScript library #7527
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
gRPC JavaScript library #7527
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| //go:build integration | ||
| // +build integration | ||
|
|
||
| package integration_test | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "net" | ||
|
|
||
| "google.golang.org/grpc" | ||
| "google.golang.org/grpc/health" | ||
| healthpb "google.golang.org/grpc/health/grpc_health_v1" | ||
| "google.golang.org/grpc/reflection" | ||
| ) | ||
|
|
||
| // startGRPCHealthServer starts an in-process gRPC server exposing the standard | ||
| // health service (status SERVING) and server reflection on a random loopback | ||
| // port. It returns the "host:port" address and a stop func. | ||
| func startGRPCHealthServer() (string, func(), error) { | ||
| lis, err := net.Listen("tcp", "127.0.0.1:0") | ||
| if err != nil { | ||
| return "", nil, fmt.Errorf("grpc health listen: %w", err) | ||
| } | ||
| srv := grpc.NewServer() | ||
| hs := health.NewServer() | ||
| hs.SetServingStatus("", healthpb.HealthCheckResponse_SERVING) | ||
| healthpb.RegisterHealthServer(srv, hs) | ||
| reflection.Register(srv) | ||
| go func() { _ = srv.Serve(lis) }() | ||
| return lis.Addr().String(), srv.Stop, nil | ||
| } | ||
|
|
||
| // javascriptGRPCHealth exercises the nuclei/grpc library end to end against a | ||
| // real gRPC server via server reflection. | ||
| type javascriptGRPCHealth struct{} | ||
|
|
||
| func (j *javascriptGRPCHealth) Execute(filePath string) error { | ||
| address, stop, err := startGRPCHealthServer() | ||
| if err != nil { | ||
| return err | ||
| } | ||
| defer stop() | ||
|
|
||
| results, err := runSignedNucleiTemplateAndGetResults(filePath, address, debug) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| return expectResultsCount(results, 1) | ||
| } | ||
|
|
||
| // javascriptGRPCDenied asserts the nuclei/grpc library refuses to dial a host | ||
| // on the exclude list (network-policy enforcement) before connecting. | ||
| type javascriptGRPCDenied struct{} | ||
|
|
||
| func (j *javascriptGRPCDenied) Execute(filePath string) error { | ||
| results, err := runSignedNucleiTemplateAndGetResults(filePath, "127.0.0.1", debug, "-eh", "203.0.113.10") | ||
| if err != nil { | ||
| return err | ||
| } | ||
| return expectResultsCount(results, 1) | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
37 changes: 37 additions & 0 deletions
37
internal/tests/integration/testdata/protocols/javascript/grpc-denied.yaml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| id: grpc-network-policy-denied | ||
|
|
||
| info: | ||
| name: gRPC Network Policy Denial | ||
| author: pdteam | ||
| severity: info | ||
| description: | | ||
| Hardening check for the nuclei/grpc javascript library: dialing a host on | ||
| the exclude list (RFC 5737 TEST-NET-3) must be rejected by the network | ||
| policy before any connection is made. The error is captured and asserted. | ||
|
|
||
| javascript: | ||
| - code: | | ||
| const grpc = require('nuclei/grpc'); | ||
| let out = ""; | ||
| try { | ||
| const opts = new grpc.Options(); | ||
| opts.Plaintext = true; | ||
| const client = new grpc.Client("203.0.113.10:50051", opts); | ||
| client.Invoke('grpc.health.v1.Health/Check', '{}'); | ||
| } catch (e) { | ||
| out = "" + e; | ||
| } | ||
| out; | ||
| args: | ||
| Host: "{{Host}}" | ||
| matchers-condition: and | ||
| matchers: | ||
| - type: dsl | ||
| dsl: | ||
| - "success == true" | ||
| - type: word | ||
| part: response | ||
| words: | ||
| - "network policy" | ||
| - "203.0.113.10" | ||
| condition: and |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: projectdiscovery/nuclei
Length of output: 1969
🏁 Script executed:
Repository: projectdiscovery/nuclei
Length of output: 1280
🌐 Web query:
GHSA-78h2-9frx-2jm8 go-jose/go-jose v4.0.5 fixed in 4.1.4 JWE key-wrapping alg empty encrypted_key panic💡 Result:
The vulnerability GHSA-78h2-9frx-2jm8 (also tracked as CVE-2026-34986) describes a denial-of-service vulnerability in the go-jose library that causes a panic during JWE (JSON Web Encryption) decryption [1][2]. The issue occurs when an application attempts to decrypt a JWE object where the alg header indicates a key-wrapping algorithm (excluding A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty [1][3]. The panic is triggered in the cipher.KeyUnwrap function within key_wrap.go because it attempts to allocate a slice with an invalid (zero or negative) length based on the length of the empty encrypted_key [1][3]. This vulnerability is fixed in: - go-jose/go-jose v4.1.4 [1][2] - go-jose/go-jose v3.0.5 [1][2] Applications that do not include key-wrapping algorithms in the list of accepted key algorithms passed to ParseEncrypted, ParseEncryptedJSON, or ParseEncryptedCompact functions are not affected [1][3]. For those using key-wrapping, it is recommended to upgrade to the patched versions or implement pre-validation to ensure the encrypted_key field is non-empty [1].
Citations:
🏁 Script executed:
Repository: projectdiscovery/nuclei
Length of output: 1011
Upgrade
github.com/go-jose/go-jose/v4tov4.1.4+This indirect dep comes in through
grpcurl/spiffe/xds, andv4.0.5is affected by GHSA-78h2-9frx-2jm8 when decrypting JWE with key-wrappingalgand an emptyencrypted_key.🧰 Tools
🪛 OSV Scanner (2.4.0)
[HIGH] 237-237: github.com/go-jose/go-jose/v4 4.0.5: Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose
(GO-2026-4945)
[HIGH] 237-237: github.com/go-jose/go-jose/v4 4.0.5: Go JOSE Panics in JWE decryption
(GHSA-78h2-9frx-2jm8)
🤖 Prompt for AI Agents
Source: Linters/SAST tools