Tools used by Dart's continuous integration (CI) testing that aren't needed by Dart SDK contributors. Mirrored from dart.googlesource.com/dart_ci. Do not land pull requests on Github.
BSD 3-Clause "New" or "Revised" License
18
stars
5
forks
source link
Bump node-forge, google-p12-pem, firebase-admin and firebase-functions in /github-label-notifier/functions #137
RFC 3447 and RFC 8017 allow for optional DigestAlgorithmNULL parameters
for sha* algorithms and require NULL paramters for md2 and md5
algorithms.
1.3.0 - 2022-03-17
Security
Three RSA PKCS#1 v1.5 signature verification issues were reported by Moosa
Yahyazadeh (moosa-yahyazadeh@uiowa.edu).
HIGH: Leniency in checking digestAlgorithm structure can lead to
signature forgery.
The code is lenient in checking the digest algorithm structure. This can
allow a crafted structure that steals padding bytes and uses unchecked
portion of the PKCS#1 encoded message to forge a signature when a low
public exponent is being used. For more information, please see
"Bleichenbacher's RSA signature forgery based on implementation
error"
by Hal Finney.
HIGH: Failing to check tailing garbage bytes can lead to signature
forgery.
The code does not check for tailing garbage bytes after decoding a
DigestInfo ASN.1 structure. This can allow padding bytes to be removed
and garbage data added to forge a signature when a low public exponent is
being used. For more information, please see "Bleichenbacher's RSA
signature forgery based on implementation
error"
by Hal Finney.
DigestInfo is not properly checked for proper ASN.1 structure. This can
lead to successful verification with signatures that contain invalid
structures but a valid digest.
[asn1] Add fallback to pretty print invalid UTF8 data.
[asn1] fromDer is now more strict and will default to ensuring all input
bytes are parsed or throw an error. A new option parseAllBytes can disable
this behavior.
NOTE: The previous behavior is being changed since it can lead to
security issues with crafted inputs. It is possible that code doing custom
DER parsing may need to adapt to this new behavior and optional flag.
[rsa] Add and use a validator to check for proper structure of parsed ASN.1
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dart-lang/dart_ci/network/alerts).
Bumps node-forge to 1.3.1 and updates ancestor dependencies node-forge, google-p12-pem, firebase-admin and firebase-functions. These dependencies need to be updated together.
Updates
node-forge
from 0.10.0 to 1.3.1Changelog
Sourced from node-forge's changelog.
... (truncated)
Commits
a0a4a42
Release 1.3.1.a33830f
Update changelog.740954d
Allow optional DigestAlgorithm parameters.56f4316
Allow DigestInfo.DigestAlgorith.parameters to be optionalcbf0bd5
Start 1.3.1-0.6c5b901
Release 1.3.0.0f3972a
Update changelog.dc77b39
Fix error checking.bb822c0
Add advisory links.d4395fe
Update changelog.Updates
google-p12-pem
from 3.1.2 to 3.1.4Release notes
Sourced from google-p12-pem's releases.
Changelog
Sourced from google-p12-pem's changelog.
Commits
aff0086
chore(main): release 3.1.4 (#404)f375cca
fix(deps): force fixed version of node-forge (#403)e602210
chore(deps): update actions/checkout action to v3 (#1392) (#401)f7df70d
chore(deps): update actions/setup-node action to v3 (#1393) (#400)4095df8
chore: Enable Size-Label bot in all googleapis NodeJs repositories (#1382) (#...850355c
chore(deps): update actions/checkout action to v3 (#395)40b7cd7
chore(deps): update actions/setup-node action to v3 (#394)65b5c88
docs(nodejs): version support policy edits (#1346) (#393)ce2ed68
chore(deps): update actions/setup-node action to v2 (#391)7ddc2d0
build(node): switch back to keystore for publication (#1328) (#390)Updates
firebase-admin
from 9.11.1 to 11.0.1Release notes
Sourced from firebase-admin's releases.
... (truncated)
Commits
8f9d730
[chore] Release 11.0.1 (#1842)635a550
chore: Update api-documenter config to include project headers (#1840)392c7fe
PR fixes from #1812 (#1828)b5de227
build(deps-dev): bump@types/sinon
from 10.0.12 to 10.0.13 (#1836)08751d2
build(deps-dev): bump@typescript-eslint/parser
from 5.30.6 to 5.31.0 (#1834)d509e83
build(deps): bump@types/node
from 18.0.4 to 18.6.1 (#1835)7be4685
build(deps-dev): bump eslint from 8.19.0 to 8.20.0 (#1822)e3a4106
build(deps-dev): bump@microsoft/api-extractor
from 7.28.4 to 7.28.6 (#1833)45c3584
build(deps-dev): bump@typescript-eslint/eslint-plugin
(#1832)42d5d1f
build(deps-dev): bump ts-node from 10.8.2 to 10.9.1 (#1819)Updates
firebase-functions
from 3.15.4 to 3.23.0Release notes
Sourced from firebase-functions's releases.
... (truncated)
Commits
941704d
3.23.0d592847
Insert Expression and Field types into GlobalOptions and inheriting types (#1...7057c4d
fix comment (#1211)eed7d59
Add v2 Schedule Triggers (#1177)c0e0361
Change payload based on API council feedback: (#1209)f9ecee4
Fixes a bug that disallowed setting customClaims and/or sessionClaims in bloc...f751f5c
UpdateInAppFeedbackPayload
(#1187)0e4ffb6
MakescreenshotUris
non-optional. (#1188)d22ff20
Export Auth types to have them show up in the reference docs. (#1186)6edbb95
Automatically run integration test on PR merge (#1182)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dart-lang/dart_ci/network/alerts).