search

auth0 / auth0-authorization-extension

Auth0 Extension that adds authorization features to your account
https://auth0.com/docs/extensions/authorization-extension/v2
Other
82 stars 54 forks source link

[do not merge] Combined backend + frontend update - test branch #375

Open sauntimo opened 9 months ago

sauntimo commented 9 months ago

✏️ Changes

DESCRIPTION GOES HERE. Try to describe both what is changing and why this is important

  • Make sure you run when adding / updating a package
  • What did you change from a design standpoint?
  • What did you change in the code itself?
  • If you are updating a dependency, explain why this is needed.

📷 Screenshots

If there were visual changes to the application with this change, please include before and after screenshots here. If it has animation, please use screen capture software like to make a gif.

🔗 References

Include at at least one link to an explanation + requirements for this change, and more if at all possible. Typically this is a Jira/GitHub Issue, but could also be links to Zendesk tickets, RFCs, rollout plan or Slack conversations (for Slack conversations, make sure you provide a summary of the conversation under “Changes”).

🎯 Testing

Describe how this can be tested by reviewers. Please be specific about anything not tested and reasons why.

  • Make sure you add unit and integration tests.
  • If this is on a hot path, add load or performance tests
  • Especially for dependency updates we also need to make sure that there is no impact on performance.

✅🚫 This change has been tested in a Webtask

✅🚫 This change has unit test coverage

✅🚫 This change has integration test coverage

✅🚫 This change has been tested for performance

🚀 Deployment

Can this change be merged at any time? What will the deployment of the change look like? Does this need to be released in lockstep with something else?

✅🚫 This can be deployed any time

or ⚠️ This should not be merged until:

  • Other PR is merged because REASON
  • After date because REASON
  • Other condition: REASON

🎡 Rollout

Explain how the change will be verified once released. Manual testing? Functional testing?

In order to verify that the deployment was successful we will …

🔥 Rollback

Explain when and why we will rollback the change.

We will rollback if …

📄 Procedure

Explain how the rollback for this change will look like, how we can recover fast.

🖥 Appliance

Note to reviewers: ensure that this change is compatible with the Appliance.

semgrep-app[bot] commented 9 months ago

Semgrep found 1 ssc-45c7ee79-f517-41e2-b61a-45743d9df9c6 finding:

Risk: Affected version of handlebars is vulnerable to Improper Neutralization Of Special Elements In Output Used By A Downstream Component ('Injection') / Improperly Controlled Modification Of Object Prototype Attributes ('Prototype Pollution'). The vulnerability allows for Prototype Pollution, potentially leading to Remote Code Execution, as templates can modify an object's__proto__ and __defineGetter__ properties, enabling attackers to execute arbitrary code using specially crafted payloads.

Fix: Upgrade this library to at least version 4.3.0 at auth0-authorization-extension/package-lock.json:24372.

Reference(s): https://github.com/advisories/GHSA-w457-6q6x-cgp9, CVE-2019-19919

Ignore this finding from ssc-45c7ee79-f517-41e2-b61a-45743d9df9c6.