Repository navigation
revocation check for delegation chain - #580
maycon-mello merged 5 commits into
Conversation
maycon-mello
commented
Sep 17, 2026
maycon-mello
commented
- revocation check for delegation chain
00849ad to
4c9e03b
Compare
![semgrep-code-docknetwork[bot]](https://avatars.githubusercontent.com/u/52467402?s=60&v=4){kind=small}
| } | ||
|
|
||
| async function defaultFetchStatusList(url: string): Promise<any> { | ||
| const {data} = await axios.get(url); |
There was a problem hiding this comment.
Risk: Affected versions of axios are vulnerable to Insertion of Sensitive Information Into Sent Data. The Node.js HTTP adapter in axios fails to clear the Proxy-Authorization header when a request that initially used an authenticated HTTP proxy is redirected to a target requiring no proxy (e.g. an HTTP-to-HTTPS redirect with no HTTPS proxy configured), leaking the proxy credentials to the final origin server.
Manual Review Advice: A vulnerability from this advisory is reachable if you make requests with the Node.js HTTP adapter through an authenticated HTTP proxy with redirect following enabled
Fix: Upgrade this library to at least version 0.32.0 at wallet-sdk/package-lock.json:12744.
Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36262, GHSA-p92q-9vqr-4j8v, CVE-2026-44487
🧁 Fixed in commit cb952ee 🧁
| } | ||
|
|
||
| async function defaultFetchStatusList(url: string): Promise<any> { | ||
| const {data} = await axios.get(url); |
There was a problem hiding this comment.
Risk: Affected versions of axios are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The Node.js HTTP adapter in axios leaks authenticated proxy credentials when following redirects. When a request traverses an authenticated proxy and is then redirected to a URL that no longer routes through that proxy, the stale Proxy-Authorization header persists on the redirected request and is exposed to the (potentially attacker-controlled) redirect target, disclosing the proxy username and password. Upgrade to axios >= 1.16.0 or >= 0.32.0.
Manual Review Advice: A vulnerability from this advisory is reachable if you use axios in Node.js with an authenticated proxy configured via the proxy request or instance config option, or via the HTTP_PROXY/HTTPS_PROXY environment variables
Fix: Upgrade this library to at least version 0.32.0 at wallet-sdk/package-lock.json:12744.
Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36263, GHSA-j5f8-grm9-p9fc, CVE-2026-44486
🧼 Fixed in commit cb952ee 🧼
| } | ||
|
|
||
| async function defaultFetchStatusList(url: string): Promise<any> { | ||
| const {data} = await axios.get(url); |
There was a problem hiding this comment.
Risk: Affected versions of axios are vulnerable to Improper Control of Generation of Code ('Code Injection') / Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). axios contains a prototype-pollution gadget in its config merge pipeline. If Object.prototype.transformResponse is polluted by a separate vulnerability in the same process, mergeConfig() reads it through the prototype chain and transformData() executes the inherited function on every HTTP response body, enabling credential theft and response hijacking. Every axios HTTP call traverses this pipeline. Upgrade to 0.31.1, 1.15.2, or later.
Fix: Upgrade this library to at least version 0.31.1 at wallet-sdk/package-lock.json:12744.
Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36258, GHSA-3g43-6gmg-66jw, CVE-2026-44495
🚀 Fixed in commit cb952ee 🚀
| } | ||
|
|
||
| async function defaultFetchStatusList(url: string): Promise<any> { | ||
| const {data} = await axios.get(url); |
There was a problem hiding this comment.
Risk: Affected versions of axios are vulnerable to Authentication Bypass by Alternate Name / Server-Side Request Forgery (SSRF). Axios does not normalize IPv4-mapped IPv6 addresses before applying NO_PROXY, so a request whose host is given in IPv4-mapped IPv6 notation (e.g. ::ffff:7f00:1 or ::ffff:a9fe:a9fe) is not matched against the IPv4 entries in NO_PROXY (e.g. 127.0.0.1 or 169.254.169.254) and is sent through the configured proxy instead of bypassing it. If an attacker can influence request URLs, they may force internal/loopback Axios traffic through a configured proxy, undermining SSRF protections and exposing sensitive responses such as cloud metadata. This is an incomplete fix for CVE-2025-62718.
Manual Review Advice: A vulnerability from this advisory is reachable if you have a proxy configured via HTTP_PROXY/HTTPS_PROXY and an IPv4 address listed in NO_PROXY
Fix: Upgrade this library to at least version 0.32.0 at wallet-sdk/package-lock.json:12744.
Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36255, GHSA-pjwm-pj3p-43mv, CVE-2025-62718, CVE-2026-44492
🧹 Fixed in commit cb952ee 🧹
| } | ||
|
|
||
| async function defaultFetchStatusList(url: string): Promise<any> { | ||
| const {data} = await axios.get(url); |
There was a problem hiding this comment.
Risk: Affected versions of axios are vulnerable to Permissive List of Allowed Inputs / Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios contains an incomplete fix for CVE-2025-62718. The internal isLoopback() helper in lib/helpers/shouldBypassProxy.js recognizes only 127.0.0.1, localhost, and ::1 as loopback addresses, instead of the entire 127.0.0.0/8 subnet defined by RFC 1122 §3.2.1.3. Any Node-side Axios request whose target host falls in 127.0.0.0/8 but is not literally 127.0.0.1 (e.g., 127.0.0.2, 127.1.2.3) is silently routed through the configured HTTP_PROXY/HTTPS_PROXY even when NO_PROXY is set to exempt loopback. This enables SSRF, exposes internal/loopback-bound services (e.g., sidecars, metrics agents, vault helpers listening on 127.0.0.X), and may leak request headers, credentials, and bodies to a proxy intermediary.
Manual Review Advice: A vulnerability from this advisory is reachable if you use Axios in Node.js with a proxy configured via the HTTP_PROXY/HTTPS_PROXY environment variables or the proxy request/instance config option, and NO_PROXY is set to exempt loopback addresses
Fix: Upgrade this library to at least version 0.31.1 at wallet-sdk/package-lock.json:12744.
Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25608, GHSA-pmwg-cvhr-8vh7, CVE-2026-42043
🥳 Fixed in commit cb952ee 🥳
| } | ||
|
|
||
| async function defaultFetchStatusList(url: string): Promise<any> { | ||
| const {data} = await axios.get(url); |
There was a problem hiding this comment.
Risk: Affected versions of axios are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). Axios do not guard reads of config properties (e.g. parseReviver, transport, transformRequest, transformResponse) with hasOwnProperty checks. If Object.prototype is polluted by any co-dependency in the same Node.js process, an attacker can install gadgets that silently tamper with and exfiltrate JSON response bodies, or fully hijack the underlying HTTP transport to capture request URLs, headers, and basic-auth credentials.
Fix: Upgrade this library to at least version 0.31.1 at wallet-sdk/package-lock.json:12744.
Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25588, GHSA-pf86-5x62-jrwf, CVE-2026-42033
🧼 Fixed in commit cb952ee 🧼
| } | ||
|
|
||
| async function defaultFetchStatusList(url: string): Promise<any> { | ||
| const {data} = await axios.get(url); |
There was a problem hiding this comment.
Risk: Affected versions of axios are vulnerable to Improper Check for Unusual or Exceptional Conditions / Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). Axios crashes in its mergeConfig routine when a configuration object has an own enumerable __proto__ key. Such a key appears when the config is built from untrusted JSON (e.g. JSON.parse) and passed to an axios request method: the merge resolves __proto__ to Object.prototype and tries to invoke it as a function, throwing a TypeError that crashes the application (denial of service).
Manual Review Advice: A vulnerability from this advisory is reachable if you pass a configuration object built from untrusted input — e.g. the result of JSON.parse that may contain an own enumerable __proto__ key — into an axios request, create, or getUri call
Fix: Upgrade this library to at least version 0.30.3 at wallet-sdk/package-lock.json:12744.
Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-6850, GHSA-43fc-jf86-j433, CVE-2026-25639
✨ Fixed in commit cb952ee ✨
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #580 +/- ##
==========================================
+ Coverage 60.97% 61.41% +0.43%
==========================================
Files 177 177
Lines 4915 4932 +17
Branches 575 578 +3
==========================================
+ Hits 2997 3029 +32
+ Misses 1845 1830 -15
Partials 73 73 🚀 New features to boost your workflow:
|
…es-not-work-for-delegated-credentials-part3
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Moderate unresolved test-coverage issues remain in the routing and public-export changes.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 2
Open (2)
What changed in this PR
Adds delegation-chain revocation checks, StatusList2021 routing, and a web SDK export.
Changes:
- Adds cached chain-wide status-list checks.
- Prevents StatusList2021 credentials from accumulator checks.
- Adds tests and exposes the new web API.
| File | Summary and findings |
|---|---|
packages/web/src/index.js |
Exports the chain revocation helper. Moderate (3 votes): add the export to the existing delegation re-export test fixtures. |
packages/wasm/src/services/credential/service.ts |
Routes StatusList2021 credentials correctly. Moderate (1 vote): add a service-level test covering both status-list and accumulator paths. |
packages/wasm/src/services/credential/revocation-routing.test.js |
Tests revocation routing. Moderate (2 votes): exercise CredentialService.verifyCredential with mocked dependencies. Moderate (1 vote): test the actual provider/service error mapping instead of duplicating the regex. |
packages/core/src/delegation/delegation-revocation.ts |
Implements chain-wide revocation checks and status-list caching. |
packages/core/src/delegation/delegation-revocation.test.ts |
Tests chain revocation behavior and fetch caching. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| /** Mirrors the routing condition in service.ts verifyCredential. */ | ||
| function routesToAccumulator(credential, verified = true) { | ||
| const isStatusList2021 = | ||
| credential.credentialStatus?.type === 'StatusList2021Entry'; | ||
| return Boolean( | ||
| verified && credential.credentialStatus?.id && !isStatusList2021, | ||
| ); |
| revokeDelegatableCredential, | ||
| unrevokeDelegatableCredential, | ||
| isDelegatableCredentialRevoked, | ||
| isDelegationChainRevoked, |
…rt, bump axios to 0.32.0
…or-delegated-credentials-part3' of github.com:docknetwork/wallet-sdk into DCKA-5615-revocation-from-the-workspace-does-not-work-for-delegated-credentials-part3
…es-not-work-for-delegated-credentials-part3
