3 ms·

cdnjs will mirror any npm package They didn't update any part of cdnjs itself. Instead, they triggered cdnjs on their package.

jtsiskin 5y ago
Do they? Their website https://cdnjs.com/libraries https://cdnjs.com/libraries says "Couldn't find the library you're looking for? You can make a request to have it added on our GitHub repository." Amusingly you can see the "hey-sven" library they added to test the fix: https://github.com/cdnjs/packages/pull/695 https://github.com/cdnjs/packages/pull/695 If you download the tarball directly, https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz, then tar -ztvf hey-sven-1.0.2.tgz, you can see -rw-r--r-- 0 ryotak staff 204 Jun 2 16:21 package/package.json -rw-r--r-- 0 ryotak wheel 10 Jun 2 16:21 ../../../../../../../../../../tmp/ryotak -rw-r--r-- 0 ryotak wheel 10 Jun 2 16:22 ../../../../../../../../../../tmp/ryotak.sh both which just have the contents "Retesting"
- aylux2121 5y ago
  I'm just trying to find the root cause. I see that is PR is merged by a contributor "xtuc". Root question is that why was this PR merged? Apart from reading/writing to other files in the build pipeline instance (which is a really good catch), primary problem I see here is that anyone is able to deploy any arbitrary code/javascript to serve it from cdnjs. Just send a PR, then some contributor will merge it without checking the release package content. Don't you think that is open to a lot of issues?
alfiedotwtf 5y ago
Ah. Nice.
MattIPv4 5y ago
Just to clarify, we won't just mirror any npm package. We have a set list of git repos and npm packages that we pull from, and adding a new one requires a PR to our packages repo which a human must review.
- NotEvil 5y ago
  Okay, then how was OP able to push that symlink library. Dis he use an already approved library or submitted a new one. Because if he did that symlink should at least raised some eyebrows at least

jtsiskin 5y ago

Do they? Their website https://cdnjs.com/libraries https://cdnjs.com/libraries says "Couldn't find the library you're looking for? You can make a request to have it added on our GitHub repository." Amusingly you can see the "hey-sven" library they added to test the fix: https://github.com/cdnjs/packages/pull/695 https://github.com/cdnjs/packages/pull/695 If you download the tarball directly, https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz, then tar -ztvf hey-sven-1.0.2.tgz, you can see -rw-r--r-- 0 ryotak staff 204 Jun 2 16:21 package/package.json -rw-r--r-- 0 ryotak wheel 10 Jun 2 16:21 ../../../../../../../../../../tmp/ryotak -rw-r--r-- 0 ryotak wheel 10 Jun 2 16:22 ../../../../../../../../../../tmp/ryotak.sh both which just have the contents "Retesting"

aylux2121 5y ago
I'm just trying to find the root cause. I see that is PR is merged by a contributor "xtuc". Root question is that why was this PR merged? Apart from reading/writing to other files in the build pipeline instance (which is a really good catch), primary problem I see here is that anyone is able to deploy any arbitrary code/javascript to serve it from cdnjs. Just send a PR, then some contributor will merge it without checking the release package content. Don't you think that is open to a lot of issues?

alfiedotwtf 5y ago

Ah. Nice.

MattIPv4 5y ago

Just to clarify, we won't just mirror any npm package. We have a set list of git repos and npm packages that we pull from, and adding a new one requires a PR to our packages repo which a human must review.

NotEvil 5y ago
Okay, then how was OP able to push that symlink library. Dis he use an already approved library or submitted a new one. Because if he did that symlink should at least raised some eyebrows at least