Raise token-server's direct multer pin from ^2.2.0 to ^2.4.0 so icon uploads pick up the remaining upload DoS patches, including GHSA-3pph-fpjx-jg34.
Details
Details
- Reviewers
Fabien - Group Reviewers
Restricted Project - Commits
- rABC1eb92800e30a: [token-server] Bump multer to ^2.4.0 for upload DoS fixes
cd apps/token-server && pnpm test
Diff Detail
Diff Detail
- Repository
- rABC Bitcoin ABC
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
Comment Actions
Build Bitcoin ABC Diffs / Diff Testing (token-server-tests) failed.
Failed tests logs:
====== routes.js: We receive a 500 error if image upload exceeds server limit.routes.js We receive a 500 error if image upload exceeds server limit ======
Error: expected 500 "Internal Server Error", got 403 "Forbidden"
at Context.<anonymous> (src/routes.test.ts:170:14)
----
at Test._assertStatus (/work/node_modules/.pnpm/supertest@7.2.2/node_modules/supertest/lib/test.js:309:14)
at /work/node_modules/.pnpm/supertest@7.2.2/node_modules/supertest/lib/test.js:365:13
at Test._assertFunction (/work/node_modules/.pnpm/supertest@7.2.2/node_modules/supertest/lib/test.js:342:13)
at Test.assert (/work/node_modules/.pnpm/supertest@7.2.2/node_modules/supertest/lib/test.js:195:23)
at localAssert (/work/node_modules/.pnpm/supertest@7.2.2/node_modules/supertest/lib/test.js:138:14)
at fn (/work/node_modules/.pnpm/supertest@7.2.2/node_modules/supertest/lib/test.js:156:7)
at Test.callback (/work/node_modules/.pnpm/superagent@10.3.0/node_modules/superagent/src/node/index.js:904:3)
at fn (/work/node_modules/.pnpm/superagent@10.3.0/node_modules/superagent/src/node/index.js:1183:18)
at IncomingMessage.<anonymous> (/work/node_modules/.pnpm/superagent@10.3.0/node_modules/superagent/src/node/parsers/json.js:19:7)
at IncomingMessage.emit (node:events:531:35)
at IncomingMessage.emit (node:domain:489:12)
at endReadableNT (node:internal/streams/readable:1698:12)
at processTicksAndRejections (node:internal/process/task_queues:90:21)Each failure log is accessible here:
routes.js: We receive a 500 error if image upload exceeds server limit.routes.js We receive a 500 error if image upload exceeds server limit
Comment Actions
Build Bitcoin ABC Diffs / Diff Testing (ai-review) passed.
CodeRabbit Review
Diff : committed changes only
Compare : HEAD → master
Directory : work
────────────────────────────────────────
(\(\
(• .•) I've finally learned what 'upward compatible' means. It means we get to keep all our old mistakes. - Dennie van Tassel
────────────────────────────────────────
Review complete
No findings ✔
2 files reviewed:
- apps/token-server/package.json
- pnpm-lock.yaml
────────────────────────────────────────
Comment Actions
Rebase on latest master and bump multer to ^2.4.0 for GHSA-3pph-fpjx-jg34. Fix the oversized-upload test for inclusive fileSize.
Comment Actions
Build Bitcoin ABC Diffs / Diff Testing (ai-review) passed.
CodeRabbit Review
Diff : committed changes only
Compare : HEAD → master
Directory : work
────────────────────────────────────────
(\(\
(• .•) That's not a fallback, that's a trapdoor.
────────────────────────────────────────
Review complete
No findings ✔
3 files reviewed:
- apps/token-server/package.json
- apps/token-server/src/routes.test.ts
- pnpm-lock.yaml
────────────────────────────────────────