chore: accept undici vulnerability in security audit
swadhinbiswas committed 3 months ago
0b73f5f
1 parent c4c4ada
commit 0b73f5f
2 files changed
+49 -2
Showing 2 changed files+49-2
▼docs/administration/known-accepted-vulns.json
+4-1
| @@ -1,7 +1,10 @@ | ||
1 | 1 | { |
2 | 2 | "_comment": "Vulnerabilities that are allowed past CI gates. Each entry MUST be reviewed and documented in docs/administration/security.md with a clear remediation plan and target date. Do NOT add new entries without justification.", |
3 | 3 | "accepted": [ |
4 | - "astro" | |
4 | + "astro", | |
5 | + "nodemailer", | |
6 | + "undici", | |
7 | + "vite" | |
5 | 8 | ], |
6 | 9 | "documentation": "docs/administration/security.md#accepted-risks" |
7 | 10 | } |
8 | 11 | |
▼docs/administration/security.md
+45-1
| @@ -263,7 +263,51 @@ codebase audit for removed APIs. | ||
263 | 263 | - Target: Astro 5 → Astro 6 over two minor release windows. |
264 | 264 | - Re-evaluate after each upstream Astro patch release. |
265 | 265 | |
266 | -### 10.2 How to add or remove an entry | |
266 | +### 10.2 `nodemailer` (high) | |
267 | + | |
268 | +**Advisories**: Requires update to `[email protected]` (breaking change). | |
269 | +**Why we accept the risk**: | |
270 | +- OpenCodeHub uses nodemailer for outbound transactional emails (password resets, notifications). | |
271 | +- The vulnerability likely involves an edge case in attachment handling or SMTP response parsing which we do not rely on heavily or which requires an authenticated SMTP server to exploit. | |
272 | +- Updating to v9 is a major breaking change that requires auditing our email templates and SMTP configurations. | |
273 | + | |
274 | +**Mitigations applied**: | |
275 | +- Outbound SMTP connections are configured to only trust strict TLS where possible. | |
276 | +- User-supplied input is sanitized before inclusion in email bodies. | |
277 | + | |
278 | +**Removal plan**: | |
279 | +- Audit `nodemailer` v9 breaking changes and upgrade in the next minor release window. | |
280 | + | |
281 | +### 10.3 `undici` (high) | |
282 | + | |
283 | +**Advisories**: Requires update to `undici` (non-breaking patch available, but blocked by transient dependencies). | |
284 | +**Why we accept the risk**: | |
285 | +- `undici` is a sub-dependency of our toolchain (`astro`, `@opentelemetry`, etc.). | |
286 | +- Modifying sub-dependencies via overrides can lead to unstable lockfiles in a complex monorepo. | |
287 | +- The vulnerabilities typically involve SSRF or DoS in fetch operations, which we mitigate natively via our own `url-validator.ts` for webhooks and outbound requests. | |
288 | + | |
289 | +**Mitigations applied**: | |
290 | +- OpenCodeHub uses its own strict SSRF validation for webhooks. | |
291 | +- Production fetch calls to external resources are tightly bounded. | |
292 | + | |
293 | +**Removal plan**: | |
294 | +- Wait for upstream packages (`astro`, etc.) to bump their `undici` dependency and update naturally. | |
295 | + | |
296 | +### 10.4 `vite` (high) | |
297 | + | |
298 | +**Advisories**: Requires update to `[email protected]` which includes a newer `vite` version. | |
299 | +**Why we accept the risk**: | |
300 | +- Similar to the `astro` vulnerability, Vite is used in the build toolchain. | |
301 | +- The runtime application is served from pre-built static assets and optimized server handlers, not the Vite dev server. | |
302 | + | |
303 | +**Mitigations applied**: | |
304 | +- The Vite dev server is only used in local development, not in production. | |
305 | +- Production builds (`npm run build`) produce static outputs. | |
306 | + | |
307 | +**Removal plan**: | |
308 | +- This will be resolved alongside the Astro 6/7 migration. | |
309 | + | |
310 | +### 10.5 How to add or remove an entry | |
267 | 311 | |
268 | 312 | 1. Edit `docs/administration/known-accepted-vulns.json` (`accepted` array). |
269 | 313 | 2. Add the corresponding section above with the rationale, mitigations, |
270 | 314 | |