Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Срок действия сессии в памяти #114

Merged
merged 2 commits into from
Dec 5, 2023
Merged

feat: Срок действия сессии в памяти #114

merged 2 commits into from
Dec 5, 2023

Conversation

sasha-tlt
Copy link
Collaborator

@sasha-tlt sasha-tlt commented Dec 1, 2023 •
edited by Salute-Eva
Loading

📦 Published PR as canary version: Canary Versions

✨ Test out this PR locally via:

npm install @salutejs/[email protected]
npm install @salutejs/[email protected]
npm install @salutejs/[email protected]
npm install @salutejs/[email protected]
npm install @salutejs/[email protected]
# or 
yarn add @salutejs/[email protected]
yarn add @salutejs/[email protected]
yarn add @salutejs/[email protected]
yarn add @salutejs/[email protected]
yarn add @salutejs/[email protected]

github-advanced-security[bot]
github-advanced-security bot found potential problems Dec 1, 2023
View reviewed changes
packages/storage-adapter-memory/src/index.ts
this.sessions[id] = session;
if (lifetime) {
this.sessions[id].expires = Date.now() + lifetime;

Check warning

Code scanning / Semgrep

Semgrep Finding: gitlab.eslint.detect-object-injection Warning

Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype, leading to possible code execution.
packages/storage-adapter-memory/src/index.ts Fixed Show fixed Hide fixed
packages/storage-adapter-memory/src/index.ts Fixed Show fixed Hide fixed
packages/storage-adapter-memory/src/index.ts
async validate() {
Object.keys(this.sessions).forEach((sessionId) => {
if (this.sessions[sessionId].expires && this.sessions[sessionId].expires < Date.now()) {
delete this.sessions[sessionId];

Check warning

Code scanning / Semgrep

Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype, leading to possible code execution. Warning

Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype, leading to possible code execution.
github-advanced-security[bot]
github-advanced-security bot found potential problems Dec 1, 2023
View reviewed changes
packages/storage-adapter-memory/src/index.ts

async validate() {
Object.keys(this.sessions).forEach((sessionId) => {
const { expires } = this.sessions[sessionId];

Check warning

Code scanning / Semgrep

Semgrep Finding: gitlab.eslint.detect-object-injection Warning

Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype, leading to possible code execution.
github-advanced-security[bot]
github-advanced-security bot found potential problems Dec 1, 2023
View reviewed changes
packages/storage-adapter-memory/src/index.ts
this.sessions[id] = session;
if (lifetime) {
this.sessions[id].expires = Date.now() + lifetime;

Check warning

Code scanning / CodeQL

Prototype-polluting assignment

This assignment may alter Object.prototype if a malicious '__proto__' string is injected from [user controlled input](1). This assignment may alter Object.prototype if a malicious '__proto__' string is injected from [user controlled input](2). This assignment may alter Object.prototype if a malicious '__proto__' string is injected from [user controlled input](3).
evgeniysemin
evgeniysemin reviewed Dec 5, 2023
View reviewed changes
packages/storage-adapter-memory/src/index.ts Outdated
this.sessions[id] = session;
if (lifetime) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Возможно, правильней lifetime > 0

@sasha-tlt sasha-tlt merged commit f7f616f into master Dec 5, 2023
4 of 6 checks passed
@sasha-tlt sasha-tlt deleted the session-lifetime branch February 26, 2024 07:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Yeti-or Yeti-or Yeti-or left review comments

@evgeniysemin evgeniysemin evgeniysemin approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@sasha-tlt @Yeti-or @evgeniysemin