Skip to content

Commit 3ec6f33

Browse files
Merge pull request #34 from step-security/npm-audit-fix-.github-actions-sign-attestations
fix: Security updates
2 parents c759943 + d8c4c72 commit 3ec6f33

3 files changed

Lines changed: 36 additions & 13 deletions

File tree

‎.github/actions/sign-attestations/dist/index.js‎

Lines changed: 32 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22856,12 +22856,13 @@ module.exports = class CachePolicy {
2285622856

2285722857
/**
2285822858
* @param {{headers: Record<string, string>, synchronous: boolean}|undefined} revalidation - Revalidation information, if any.
22859-
* @returns {{response: {headers: Record<string, string>}, revalidation: {headers: Record<string, string>, synchronous: boolean}|undefined}} An object with a cached response headers and revalidation info.
22859+
* @returns {{response: HttpResponse, revalidation: {headers: Record<string, string>, synchronous: boolean}|undefined}} An object with a cached response headers and revalidation info.
2286022860
*/
2286122861
_evaluateRequestHitResult(revalidation) {
2286222862
return {
2286322863
response: {
2286422864
headers: this.responseHeaders(),
22865+
status: this._status,
2286522866
},
2286622867
revalidation,
2286722868
};
@@ -22909,9 +22910,9 @@ module.exports = class CachePolicy {
2290922910
* }
2291022911
* ```
2291122912
* @param {HttpRequest} req - new incoming HTTP request
22912-
* @returns {{response: {headers: Record<string, string>}|undefined, revalidation: {headers: Record<string, string>, synchronous: boolean}|undefined}} An object containing keys:
22913+
* @returns {{response: HttpResponse|undefined, revalidation: {headers: Record<string, string>, synchronous: boolean}|undefined}} An object containing keys:
2291322914
* - revalidation: { headers: Record<string, string>, synchronous: boolean } Set if you should send this to the origin server
22914-
* - response: { headers: Record<string, string> } Set if you can respond to the client with these cached headers
22915+
* - response: HttpResponse Set if you can respond to the client with these cached headers
2291522916
*/
2291622917
evaluateRequest(req) {
2291722918
this._assertRequestHasHeaders(req);
@@ -23006,18 +23007,32 @@ module.exports = class CachePolicy {
2300623007
return true;
2300723008
}
2300823009

23009-
// A Vary header field-value of "*" always fails to match
23010-
if (this._resHeaders.vary === '*') {
23011-
return false;
23012-
}
23013-
2301423010
const fields = this._resHeaders.vary
2301523011
.trim()
2301623012
.toLowerCase()
2301723013
.split(/\s*,\s*/);
23014+
2301823015
for (const name of fields) {
23019-
if (req.headers[name] !== this._reqHeaders[name]) return false;
23016+
// A Vary header field-value of "*" always fails to match
23017+
if (name === '*') {
23018+
return false;
23019+
}
23020+
23021+
const newReq = Object.prototype.hasOwnProperty.call(
23022+
req.headers,
23023+
name
23024+
) && req.headers[name];
23025+
23026+
const cachedReq = Object.prototype.hasOwnProperty.call(
23027+
this._reqHeaders,
23028+
name
23029+
) && this._reqHeaders[name];
23030+
23031+
if (newReq !== cachedReq) {
23032+
return false;
23033+
}
2302023034
}
23035+
2302123036
return true;
2302223037
}
2302323038

@@ -23078,6 +23093,14 @@ module.exports = class CachePolicy {
2307823093
return headers;
2307923094
}
2308023095

23096+
/**
23097+
* Returns the status code of the cached response.
23098+
* @returns {number} The response status code.
23099+
*/
23100+
status() {
23101+
return this._status;
23102+
}
23103+
2308123104
/**
2308223105
* Returns the Date header value from the response or the current time if invalid.
2308323106
* @returns {number} Timestamp (in milliseconds) representing the Date header or response time.

‎.github/actions/sign-attestations/dist/index.js.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.github/actions/sign-attestations/package-lock.json‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)