search

MystenLabs / sui

Sui, a next-generation smart contract platform with high throughput, low latency, and an asset-oriented programming model powered by the Move programming language
https://sui.io
Apache License 2.0
5.84k stars 11.06k forks source link

Update Trustless Swap guide #18406

Open wriches opened 3 days ago

wriches commented 3 days ago

Description

Updated the trustless swap guide to a new reference format

Test plan

Local + Vercel preview

vercel[bot] commented 3 days ago

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
sui-docs ❌ Failed (Inspect) Jun 26, 2024 3:38pm
3 Ignored Deployments | Name | Status | Preview | Comments | Updated (UTC) | | :--- | :----- | :------ | :------- | :------ | | **multisig-toolkit** | ⬜️ Ignored ([Inspect](https://vercel.com/mysten-labs/multisig-toolkit/6eHgcHXABzBL32E7FqRakLKfqPjx)) | [Visit Preview](https://multisig-toolkit-git-wriches-trustless-swap-v2-mysten-labs.vercel.app) | | Jun 26, 2024 3:38pm | | **sui-kiosk** | ⬜️ Ignored ([Inspect](https://vercel.com/mysten-labs/sui-kiosk/FAbxe5nird8EEpCRXDLYLfkiTT3z)) | [Visit Preview](https://sui-kiosk-git-wriches-trustless-swap-v2-mysten-labs.vercel.app) | | Jun 26, 2024 3:38pm | | **sui-typescript-docs** | ⬜️ Ignored ([Inspect](https://vercel.com/mysten-labs/sui-typescript-docs/2Bfmymw2ym46ai3v8GR6fBALRT4a)) | [Visit Preview](https://sui-typescript-docs-git-wriches-trustless-swap-v2-mysten-labs.vercel.app) | | Jun 26, 2024 3:38pm |
semgrep-code-mystenlabs[bot] commented 3 days ago

Semgrep found 1 ssc-efa14576-9601-4ae6-939c-3da58aa25013 finding:

Risk: Affected versions of vite are vulnerable to Improper Handling Of Case Sensitivity / Exposure Of Sensitive Information To An Unauthorized Actor / Improper Access Control. The vulnerability arises when the Vite development server's option, server.fs.deny, can be circumvented on case-insensitive file systems through the utilization of case-augmented versions of filenames, as the matcher derived from config.server.fs.deny fails to prevent access to sensitive files when raw filesystem paths are requested with augmented casing.

Manual Review Advice: A vulnerability from this advisory is reachable if you host vite's development server on Windows, and you rely on server.fs.deny to deny access to certain files

Fix: Upgrade this library to at least version 4.5.2 at sui/examples/trading/frontend/pnpm-lock.yaml:4700.

Reference(s): https://github.com/advisories/GHSA-c24v-8rfc-w8vw, CVE-2023-34092, CVE-2024-23331

Ignore this finding from ssc-efa14576-9601-4ae6-939c-3da58aa25013.