Skip to content

Commit ffd9ead

Browse files
danlishkadanlishka
authored
fix: REXML contains a denial of service vulnerability #1 (#28)
* fix: REXML contains a denial of service vulnerability #1 Signed-off-by: Daniel Liszka <[email protected]>
1 parent afb272b commit ffd9ead

File tree

3 files changed

+28
-176
lines changed

3 files changed

+28
-176
lines changed

‎tools/Gemfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
source "https://rubygems.org"
2-
gem 'bashly', '~> 1.1', '>= 1.1.10'
2+
gem 'bashly', '~> 1.2'

‎tools/Gemfile.lock

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
GEM
22
remote: https://rubygems.org/
33
specs:
4-
bashly (1.1.10)
4+
bashly (1.2.0)
55
colsole (>= 0.8.1, < 2)
66
completely (~> 0.6.1)
77
filewatcher (~> 2.0)
@@ -11,7 +11,7 @@ GEM
1111
psych (>= 3.3.2, < 7)
1212
tty-markdown (~> 0.7)
1313
colsole (1.0.0)
14-
completely (0.6.2)
14+
completely (0.6.3)
1515
colsole (>= 0.8.1, < 2)
1616
mister_bin (~> 0.7)
1717
docopt_ng (0.7.1)
@@ -29,14 +29,16 @@ GEM
2929
tty-color (~> 0.5)
3030
psych (5.1.2)
3131
stringio
32-
rexml (3.2.6)
33-
rouge (4.2.0)
34-
stringio (3.1.0)
32+
rexml (3.3.1)
33+
strscan
34+
rouge (4.3.0)
35+
stringio (3.1.1)
3536
strings (0.2.1)
3637
strings-ansi (~> 0.2)
3738
unicode-display_width (>= 1.5, < 3.0)
3839
unicode_utils (~> 1.4)
3940
strings-ansi (0.2.0)
41+
strscan (3.1.0)
4042
tty-color (0.6.0)
4143
tty-markdown (0.7.2)
4244
kramdown (>= 1.16.2, < 3.0)
@@ -54,7 +56,7 @@ PLATFORMS
5456
ruby
5557

5658
DEPENDENCIES
57-
bashly (~> 1.1, >= 1.1.10)
59+
bashly (~> 1.2)
5860

5961
BUNDLED WITH
6062
2.5.11

‎tools/c8l

Lines changed: 19 additions & 169 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/usr/bin/env bash
2-
# This script was generated by bashly 1.1.10 (https://bashly.dannyb.co)
2+
# This script was generated by bashly 1.2.0 (https://bashly.dannyb.co)
33
# Modifying it manually is not recommended
44

55
if [[ "${BASH_VERSINFO:-0}" -lt 4 ]]; then
@@ -12,15 +12,7 @@ version_command() {
1212
}
1313

1414
c8l_usage() {
15-
if [[ -n $long_usage ]]; then
16-
printf "c8l - [EXPERIMENTAL] (c8l) Chainloop Labs CLI\n"
17-
echo
18-
19-
else
20-
printf "c8l - [EXPERIMENTAL] (c8l) Chainloop Labs CLI\n"
21-
echo
22-
23-
fi
15+
printf "c8l - [EXPERIMENTAL] (c8l) Chainloop Labs CLI\n\n"
2416

2517
printf "%s\n" "Usage:"
2618
printf " c8l COMMAND\n"
@@ -50,16 +42,7 @@ c8l_usage() {
5042
}
5143

5244
c8l_help_usage() {
53-
if [[ -n $long_usage ]]; then
54-
printf "c8l help - Show help about a command\n"
55-
echo
56-
57-
else
58-
printf "c8l help - Show help about a command\n"
59-
echo
60-
61-
fi
62-
45+
printf "c8l help - Show help about a command\n\n"
6346
printf "Alias: h\n"
6447
echo
6548

@@ -79,16 +62,7 @@ c8l_help_usage() {
7962
}
8063

8164
c8l_inspect_usage() {
82-
if [[ -n $long_usage ]]; then
83-
printf "c8l inspect - [i] Inspect.\n"
84-
echo
85-
86-
else
87-
printf "c8l inspect - [i] Inspect.\n"
88-
echo
89-
90-
fi
91-
65+
printf "c8l inspect - [i] Inspect.\n\n"
9266
printf "Alias: i\n"
9367
echo
9468

@@ -108,15 +82,7 @@ c8l_inspect_usage() {
10882
}
10983

11084
c8l_source_usage() {
111-
if [[ -n $long_usage ]]; then
112-
printf "c8l source - Show the content of c8l script ready for sourcing.\n"
113-
echo
114-
115-
else
116-
printf "c8l source - Show the content of c8l script ready for sourcing.\n"
117-
echo
118-
119-
fi
85+
printf "c8l source - Show the content of c8l script ready for sourcing.\n\n"
12086

12187
printf "%s\n" "Usage:"
12288
printf " c8l source\n"
@@ -134,16 +100,7 @@ c8l_source_usage() {
134100
}
135101

136102
c8l_cmd_usage() {
137-
if [[ -n $long_usage ]]; then
138-
printf "c8l cmd - Run a command in the c8l environment.\n"
139-
echo
140-
141-
else
142-
printf "c8l cmd - Run a command in the c8l environment.\n"
143-
echo
144-
145-
fi
146-
103+
printf "c8l cmd - Run a command in the c8l environment.\n\n"
147104
printf "Alias: r\n"
148105
echo
149106

@@ -169,16 +126,7 @@ c8l_cmd_usage() {
169126
}
170127

171128
c8l_cli_usage() {
172-
if [[ -n $long_usage ]]; then
173-
printf "c8l cli - Chainloop CLI UX improved\n"
174-
echo
175-
176-
else
177-
printf "c8l cli - Chainloop CLI UX improved\n"
178-
echo
179-
180-
fi
181-
129+
printf "c8l cli - Chainloop CLI UX improved\n\n"
182130
printf "Alias: c\n"
183131
echo
184132

@@ -212,16 +160,7 @@ c8l_cli_usage() {
212160
}
213161

214162
c8l_cli_install_tools_usage() {
215-
if [[ -n $long_usage ]]; then
216-
printf "c8l cli install-tools - [it] Install Chainloop CLI and all required tools\n"
217-
echo
218-
219-
else
220-
printf "c8l cli install-tools - [it] Install Chainloop CLI and all required tools\n"
221-
echo
222-
223-
fi
224-
163+
printf "c8l cli install-tools - [it] Install Chainloop CLI and all required tools\n\n"
225164
printf "Alias: it\n"
226165
echo
227166

@@ -241,16 +180,7 @@ c8l_cli_install_tools_usage() {
241180
}
242181

243182
c8l_cli_attestation_add_from_yaml_usage() {
244-
if [[ -n $long_usage ]]; then
245-
printf "c8l cli attestation-add-from-yaml - [aafy] Add to the current atestation based on the yaml file.\n"
246-
echo
247-
248-
else
249-
printf "c8l cli attestation-add-from-yaml - [aafy] Add to the current atestation based on the yaml file.\n"
250-
echo
251-
252-
fi
253-
183+
printf "c8l cli attestation-add-from-yaml - [aafy] Add to the current atestation based on the yaml file.\n\n"
254184
printf "Alias: aafy\n"
255185
echo
256186

@@ -270,16 +200,7 @@ c8l_cli_attestation_add_from_yaml_usage() {
270200
}
271201

272202
c8l_cli_attestation_status_usage() {
273-
if [[ -n $long_usage ]]; then
274-
printf "c8l cli attestation-status - [as] Get the status of the current attestation.\n"
275-
echo
276-
277-
else
278-
printf "c8l cli attestation-status - [as] Get the status of the current attestation.\n"
279-
echo
280-
281-
fi
282-
203+
printf "c8l cli attestation-status - [as] Get the status of the current attestation.\n\n"
283204
printf "Alias: as\n"
284205
echo
285206

@@ -299,16 +220,7 @@ c8l_cli_attestation_status_usage() {
299220
}
300221

301222
c8l_cli_attestation_push_usage() {
302-
if [[ -n $long_usage ]]; then
303-
printf "c8l cli attestation-push - [ap] Push the current attestation to the Chainloop server.\n"
304-
echo
305-
306-
else
307-
printf "c8l cli attestation-push - [ap] Push the current attestation to the Chainloop server.\n"
308-
echo
309-
310-
fi
311-
223+
printf "c8l cli attestation-push - [ap] Push the current attestation to the Chainloop server.\n\n"
312224
printf "Alias: ap\n"
313225
echo
314226

@@ -328,16 +240,7 @@ c8l_cli_attestation_push_usage() {
328240
}
329241

330242
c8l_cli_generate_github_summary_usage() {
331-
if [[ -n $long_usage ]]; then
332-
printf "c8l cli generate-github-summary - [ggs] Generate a summary of the attestation for GitHub Action.\n"
333-
echo
334-
335-
else
336-
printf "c8l cli generate-github-summary - [ggs] Generate a summary of the attestation for GitHub Action.\n"
337-
echo
338-
339-
fi
340-
243+
printf "c8l cli generate-github-summary - [ggs] Generate a summary of the attestation for GitHub Action.\n\n"
341244
printf "Alias: ggs\n"
342245
echo
343246

@@ -357,16 +260,7 @@ c8l_cli_generate_github_summary_usage() {
357260
}
358261

359262
c8l_cli_get_attestations_usage() {
360-
if [[ -n $long_usage ]]; then
361-
printf "c8l cli get-attestations - [ga] Get all attestations for artifact\n"
362-
echo
363-
364-
else
365-
printf "c8l cli get-attestations - [ga] Get all attestations for artifact\n"
366-
echo
367-
368-
fi
369-
263+
printf "c8l cli get-attestations - [ga] Get all attestations for artifact\n\n"
370264
printf "Alias: ga\n"
371265
echo
372266

@@ -392,16 +286,7 @@ c8l_cli_get_attestations_usage() {
392286
}
393287

394288
c8l_cli_get_usage() {
395-
if [[ -n $long_usage ]]; then
396-
printf "c8l cli get - [g] Get artifact from Chainloop\n"
397-
echo
398-
399-
else
400-
printf "c8l cli get - [g] Get artifact from Chainloop\n"
401-
echo
402-
403-
fi
404-
289+
printf "c8l cli get - [g] Get artifact from Chainloop\n\n"
405290
printf "Alias: g\n"
406291
echo
407292

@@ -431,16 +316,7 @@ c8l_cli_get_usage() {
431316
}
432317

433318
c8l_cli_workflow_get_usage() {
434-
if [[ -n $long_usage ]]; then
435-
printf "c8l cli workflow-get - [wg] Get workflow from Chainloop.\n"
436-
echo
437-
438-
else
439-
printf "c8l cli workflow-get - [wg] Get workflow from Chainloop.\n"
440-
echo
441-
442-
fi
443-
319+
printf "c8l cli workflow-get - [wg] Get workflow from Chainloop.\n\n"
444320
printf "Alias: wg\n"
445321
echo
446322

@@ -470,16 +346,7 @@ c8l_cli_workflow_get_usage() {
470346
}
471347

472348
c8l_cli_workflow_list_usage() {
473-
if [[ -n $long_usage ]]; then
474-
printf "c8l cli workflow-list - [wl] List workflows from Chainloop.\n"
475-
echo
476-
477-
else
478-
printf "c8l cli workflow-list - [wl] List workflows from Chainloop.\n"
479-
echo
480-
481-
fi
482-
349+
printf "c8l cli workflow-list - [wl] List workflows from Chainloop.\n\n"
483350
printf "Alias: wl\n"
484351
echo
485352

@@ -499,16 +366,7 @@ c8l_cli_workflow_list_usage() {
499366
}
500367

501368
c8l_cli_workflow_run_get_usage() {
502-
if [[ -n $long_usage ]]; then
503-
printf "c8l cli workflow-run-get - [wrg] Get workflow run from Chainloop.\n"
504-
echo
505-
506-
else
507-
printf "c8l cli workflow-run-get - [wrg] Get workflow run from Chainloop.\n"
508-
echo
509-
510-
fi
511-
369+
printf "c8l cli workflow-run-get - [wrg] Get workflow run from Chainloop.\n\n"
512370
printf "Alias: wrg\n"
513371
echo
514372

@@ -538,16 +396,7 @@ c8l_cli_workflow_run_get_usage() {
538396
}
539397

540398
c8l_cli_workflow_run_list_usage() {
541-
if [[ -n $long_usage ]]; then
542-
printf "c8l cli workflow-run-list - [wrl] List workflow runs from Chainloop.\n"
543-
echo
544-
545-
else
546-
printf "c8l cli workflow-run-list - [wrl] List workflow runs from Chainloop.\n"
547-
echo
548-
549-
fi
550-
399+
printf "c8l cli workflow-run-list - [wrl] List workflow runs from Chainloop.\n\n"
551400
printf "Alias: wrl\n"
552401
echo
553402

@@ -1538,6 +1387,7 @@ c8l_cmd_parse_requirements() {
15381387

15391388
if [[ -z ${args['command']+x} ]]; then
15401389
printf "missing required argument: COMMAND\nusage: c8l cmd COMMAND\n" >&2
1390+
15411391
exit 1
15421392
fi
15431393

0 commit comments

Comments
 (0)