Repository navigation
Remove sprintf-js path and backport Forge/Braces security fixes - #13
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8573304fac
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| + if (Array.isArray(node.nodes)) { | ||
| + for (const child of node.nodes) pending.push([child, depth + 1]); | ||
| + } |
There was a problem hiding this comment.
When a caller uses the public AST overload with a cyclic parent pointer, this validation passes because it traverses only nodes, but the patched package's expand.js still follows block.parent in an unbounded while loop. For example, a root containing a paren node whose parent points to itself makes braces.expand(root) hang indefinitely, so the new cyclic-AST protection and regression test do not cover every AST link that the walker follows; add cycle/depth protection to the parent-chain climbs as well.
Useful? React with 👍 / 👎.
1 participant
Thunkd still resolves a vulnerable
sprintf-jschain and unreleased Forge/Braces advisories. This change removes the old Istanbul YAML chain, backports the nested RSA DigestInfo validation from digitalbazaar/forge#1152 at ceba34402e329f0365134f23fe19898756527d65, and bounds brace parsing/AST walks before recursion.Normal Expo signing, valid RSA AlgorithmIdentifier forms, NYC YAML/JSON configuration with inheritance, globs, ranges and escapes continue to work. Malformed nested DigestInfo fields, 4,000-level patterns, 10,000-level direct ASTs and cyclic ASTs are rejected. The configured brace limit is 128 levels. No new package versions or dependency sources are introduced.
Validation: frozen pnpm install, malicious-input and legitimate-control regression suite, Expo lint, TypeScript and Expo web export pass locally. Existing security controls and action pins remain unchanged. The existing security branch was merged with current main without rewriting history; its older fixes are already superseded by main, and the final source diff contains only this remediation.
Audit evidence:
pnpm auditstill reports the unchanged package versions for two existing patched image-size advisories, GHSA-86w9-cpqp-85rv (Forge) and GHSA-vfj7-8cjw-p6xm (Braces). The repository owner approved publishing and merging these tested source backports despite those version-based findings, subject to all normal CI/security checks passing. No audit threshold, advisory allowlist, branch protection or alert state is changed. Dependabot alerts remain tracked until upstream releases or the published dependency graph establish a fix.