feat(upload-s3-artifact): run on the node24 runtime, implemented in TypeScript - #267
Merged
Merged
Conversation
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
Comment on lines
+50
to
+59
|
|
||
| while (pending.length > 0) { | ||
| const path = pending.pop() as string | ||
| const stats = statSync(path) | ||
|
|
||
| if (!stats.isDirectory()) { | ||
| entries.push({ | ||
| name: toEntryName(relative(root, path)), | ||
| mode: stats.mode, | ||
| content: new Uint8Array(readFileSync(path)), |
There was a problem hiding this comment.
Potential file inclusion attack via reading file - high severity
If an attacker can control the input leading into the ReadFile function, they might be able to read sensitive files and launch further attacks with that information.
Show fix
Suggested change
| while (pending.length > 0) { | |
| const path = pending.pop() as string | |
| const stats = statSync(path) | |
| if (!stats.isDirectory()) { | |
| entries.push({ | |
| name: toEntryName(relative(root, path)), | |
| mode: stats.mode, | |
| content: new Uint8Array(readFileSync(path)), | |
| const resolvedRoot = path.resolve(root) | |
| while (pending.length > 0) { | |
| const path = pending.pop() as string | |
| const stats = statSync(path) | |
| if (!stats.isDirectory()) { | |
| const resolvedPath = path.resolve(path) | |
| const relativePath = path.relative(resolvedRoot, resolvedPath) | |
| if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) { | |
| throw new Error('Invalid file path') | |
| } | |
| entries.push({ | |
| name: toEntryName(relative(root, path)), | |
| mode: stats.mode, | |
| content: new Uint8Array(readFileSync(resolvedPath)), |
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
Contributor
Author
There was a problem hiding this comment.
@AikidoSec ignore: workflow author supplies these paths and controls the workflow execution
There was a problem hiding this comment.
✅ Based on your feedback, we ignored this issue because of the following reason:
workflow author supplies these paths and controls the workflow execution
joakimen
force-pushed
the
feat/upload-s3-artifact-typescript
branch
from
September 15, 2026 09:45
9ed80ed to
5efc16c
Compare
joakimen
force-pushed
the
feat/upload-s3-artifact-typescript
branch
from
September 15, 2026 10:12
5efc16c to
ea2b56b
Compare
joakimen
force-pushed
the
feat/upload-s3-artifact-typescript
branch
from
September 15, 2026 10:26
ea2b56b to
115266d
Compare
joakimen
force-pushed
the
feat/upload-s3-artifact-typescript
branch
from
September 15, 2026 10:43
115266d to
142601d
Compare
…ypeScript Archives with fflate and uploads with the AWS SDK, so the action no longer needs zip, sha256sum or the aws CLI on the runner. Archive entries keep their unix mode, which is what carries the executable bit. Refuses an archive that would need Zip64 rather than writing a corrupt one, and fails on an empty target directory as `zip -r` did. Inputs, outputs and the S3 key for given bytes are unchanged.
joakimen
force-pushed
the
feat/upload-s3-artifact-typescript
branch
from
September 15, 2026 10:43
142601d to
178538b
Compare
|
🎉 This PR is included in version 1.15.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the action to the
node24runtime. Archives withfflateand uploads with the AWS SDK, so it no longer needszip,sha256sumor theawsCLI on the runner.Unit tests now cover the key derivation and the archiving, including that an entry keeps its unix mode — a zip writer that drops it silently loses the executable bit.
Behaviour
An archive that would need Zip64, above 65535 entries or 4 GB, is refused rather than written:
fflatedoes not emit those extensions and does not fail either, it corrupts the header.An empty target directory now fails, as
zip -rdid.Uploads go through the SDK's multipart upload, since a single
PutObjectstops at 5 GB.