Skip to content

update labstack to avoid the vulnerability in jwt #524

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Apr 1, 2025
Merged

update labstack to avoid the vulnerability in jwt #524

merged 3 commits into from
Apr 1, 2025

Conversation

metlos
Copy link
Contributor

@metlos metlos commented Mar 31, 2025

This fixes the following issue reported by govulncheck:

Vulnerability #1: GO-2025-3553
    Excessive memory allocation during header parsing in
    github.com/golang-jwt/jwt
  More info: https://pkg.go.dev/vuln/GO-2025-3553
  Module: github.com/golang-jwt/jwt
    Found in: github.com/golang-jwt/jwt@v3.2.2+incompatible
    Fixed in: N/A
    Example traces found:
      #1: pkg/proxy/proxy.go:35:2: proxy.init calls middleware.init, which calls jwt.init

MatousJobanek
MatousJobanek approved these changes Apr 1, 2025
View reviewed changes
Copy link
Contributor

@MatousJobanek MatousJobanek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cool, thanks
/lgtm

@openshift-ci openshift-ci bot added the lgtm label Apr 1, 2025
MatousJobanek
MatousJobanek reviewed Apr 1, 2025
View reviewed changes
pkg/proxy/metrics_server_test.go Outdated
@@ -54,14 +54,13 @@ func TestProxyMetricsServer(t *testing.T) {
require.NoError(t, err)
require.NotNil(t, resp)
require.Equal(t, http.StatusOK, resp.StatusCode)
require.Equal(t, "text/plain; version=0.0.4; charset=utf-8", resp.Header.Get("Content-Type"))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

was this change intentional? it apparently causes unit test failures

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, it was intentional because I was getting the test errors without it locally.. 😕

@openshift-ci OpenShift CI
Copy link

openshift-ci bot commented Apr 1, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alexeykazakov, MatousJobanek, metlos, rajivnathan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [MatousJobanek,alexeykazakov,metlos,rajivnathan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot removed the lgtm label Apr 1, 2025
@openshift-ci OpenShift CI
Copy link

openshift-ci bot commented Apr 1, 2025

New changes are detected. LGTM label has been removed.

@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented Apr 1, 2025

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@codecov Codecov
Copy link

codecov bot commented Apr 1, 2025 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.09%. Comparing base (ce4d325) to head (994cc11).
Report is 1 commits behind head on master.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master     #524   +/-   ##
=======================================
  Coverage   81.09%   81.09%           
=======================================
  Files          43       43           
  Lines        3518     3518           
=======================================
  Hits         2853     2853           
  Misses        578      578           
  Partials       87       87
Flag Coverage Δ
unittests 81.09% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@metlos metlos merged commit dc5ccac into codeready-toolchain:master Apr 1, 2025
13 of 14 checks passed
@metlos metlos deleted the bump-labstack branch April 1, 2025 19:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@MatousJobanek MatousJobanek MatousJobanek approved these changes

@alexeykazakov alexeykazakov alexeykazakov approved these changes

@rajivnathan rajivnathan rajivnathan approved these changes

@xcoulon xcoulon Awaiting requested review from xcoulon

@mfrancisc mfrancisc Awaiting requested review from mfrancisc

@rsoaresd rsoaresd Awaiting requested review from rsoaresd

@fbm3307 fbm3307 Awaiting requested review from fbm3307

@jrosental jrosental Awaiting requested review from jrosental

Assignees

@MatousJobanek MatousJobanek

Labels
approved
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@metlos @alexeykazakov @MatousJobanek @rajivnathan @openshift-merge-robot