peter-murray / github-security-report-action

MIT License
78 stars 27 forks source link

Infinite Loop when there are multiple pages of vulnerabilities or dependencies #13

Open jorge-abarca opened 1 year ago

jorge-abarca commented 1 year ago

The function getPaginatedQuery in GitHubDependencies.ts enters into an infinite loop when there is another page since the cursor is updated in the variable queryParameters while graphqlParameters - used for the query - uses the variable parameters.

This issue affects repositories that have more than one page of vulnerabilities or dependencies, since both getAllVulnerabilities and getAllDependencies rely on getPaginatedQuery.

I have a PR open that addresses this, but if you don't feel comfortable with it or you are in the middle of some refactoring, please fix getPaginatedQuery. This will cause workflows to keep running until the access token expires, returning a Bad credentials error that masks the actual issue.

Here is an example of code that would address this issue:

      const graphqlParameters = buildGraphQLParameters(query, queryParameters, headers)
        , queryResult = await octokit.graphql(graphqlParameters)
      ;