Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Build(deps): Bump actions/cache from 2.1.4 to 2.1.5 #390

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github May 12, 2021

Bumps actions/cache from 2.1.4 to 2.1.5.

Release notes

Sourced from actions/cache's releases.

v2.1.5

  • Fix permissions error seen when extracting caches with GNU tar that were previously created using BSD tar (actions/cache#527)
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code labels May 12, 2021
@auto-add-label auto-add-label bot added the Build label May 12, 2021
@guardrails
Copy link

guardrails bot commented May 12, 2021

⚠️ We detected 285 security issues in this pull request:

Mode: paranoid | Total findings: 285 | Considered vulnerability: 0

Insecure File Management (72)
Docs Details
💡 Title: Use of non-literal require
const plugin = require(path.join(prettierPath, file));
💡 Title: Use of non-literal fs filename
fs.writeFileSync(
💡 Title: Use of non-literal fs filename
const content = fs.readFileSync(file, "utf8");
💡 Title: Use of non-literal fs filename
const readFile = util.promisify(fs.readFile);
💡 Title: Use of non-literal fs filename
const writeFile = util.promisify(fs.writeFile);
💡 Title: Use of non-literal require
require(id.replace(/^\0commonjs-proxy:/, "")),
💡 Title: Use of non-literal fs filename
const source = fs.readFileSync(id, "utf-8");
💡 Title: Use of non-literal fs filename
fs.chmodSync(file, 0o755 & ~process.umask());
💡 Title: Use of non-literal fs filename
if (fs.existsSync(shim)) {
💡 Title: Use of non-literal fs filename
const readFile = promisify(fs.readFile);
💡 Title: Use of non-literal fs filename
const writeFile = promisify(fs.writeFile);
💡 Title: Use of non-literal fs filename
fs.writeFileSync(CSPELL_CONFIG_FILE, JSON.stringify(config, undefined, 4));
💡 Title: Use of non-literal fs filename
const config = JSON.parse(fs.readFileSync(CSPELL_CONFIG_FILE, "utf8"));
💡 Title: Use of non-literal fs filename
const dirs = fs
💡 Title: Use of non-literal fs filename
category.entries = fs
💡 Title: Use of non-literal fs filename
const [title, ...rest] = fs
💡 Title: Use of non-literal fs filename
fs.writeFileSync(
💡 Title: Use of non-literal fs filename
fs.readFileSync(introFile, "utf8").trim(),
💡 Title: Use of non-literal fs filename
const files = fs.readdirSync(CHANGELOG_ROOT);
💡 Title: Use of non-literal fs filename
const template = fs.readFileSync(
💡 Title: Use of non-literal fs filename
const files = fs.readdirSync(path.join(CHANGELOG_ROOT, category));
💡 Title: Use of non-literal fs filename
const content = fs.readFileSync(
💡 Title: Use of non-literal fs filename
if (fs.existsSync(blogPost.file)) {
💡 Title: Use of non-literal fs filename
return JSON.parse(fs.readFileSync(filename, "utf-8"));
💡 Title: Use of non-literal fs filename
fs.writeFileSync(filename, JSON.stringify(content, null, 2) + "\n");
💡 Title: Use of non-literal fs filename
const content = fs.readFileSync(filename, "utf-8");
💡 Title: Use of non-literal fs filename
fs.writeFileSync(filename, fn(content));
💡 Title: Use of non-literal fs filename
obj[specFile] = fs.readFileSync(specFile, "utf8");
💡 Title: Use of non-literal fs filename
const content = fs.readFileSync(file, "utf8");
💡 Title: Use of non-literal fs filename
fs.mkdirSync(dirname, { recursive: true });
💡 Title: Use of non-literal fs filename
fs.writeFileSync(newFile, content);
💡 Title: Use of non-literal fs filename
fs.writeFileSync(specFile, specContent);
💡 Title: Use of non-literal fs filename
return fs.statSync(filePath);
💡 Title: Use of non-literal fs filename
input = fs.readFileSync(filename, "utf8");
💡 Title: Use of non-literal fs filename
fs.writeFileSync(filename, output, "utf8");
💡 Title: Use of non-literal fs filename
return fs.statSync(dir).isDirectory();
💡 Title: Use of non-literal fs filename
MARKERS.some((mark) => fs.existsSync(path.join(directory, mark)));
💡 Title: Use of non-literal fs filename
const start = options.locStart(parentNode.open) + 1;
💡 Title: Use of non-literal fs filename
fd = fs.openSync(filepath, "r");
💡 Title: Use of non-literal fs filename
fs.readFile(filename, "utf8", (error, data) => {
💡 Title: Use of non-literal fs filename
return fs.readFileSync(filename, "utf8");
💡 Title: Use of non-literal require
require(a); // Error: Param must be string literal
💡 Title: Use of non-literal require
require(`${'./E'}`); // error: but only if they have no expressions
💡 Title: Use of non-literal fs filename
const svgJsFiles = fs
💡 Title: Use of non-literal fs filename
batch.setResults([fs.createReadStream(dataFile)], (err) => {
💡 Title: Use of non-literal require
💡 Title: Use of non-literal require
const prettier = require(prettierRootDir);
💡 Title: Use of non-literal fs filename
.map((file) => fs.readFileSync(file, "utf8"))
💡 Title: Use of non-literal fs filename
const files = fs
💡 Title: Use of non-literal fs filename
const text = fs.readFileSync(filename, "utf8");
💡 Title: Use of non-literal fs filename
fs.writeFileSync(ignorePath, filePath, "utf8");
💡 Title: Use of non-literal fs filename
fs.mkdirSync(path.resolve(base, "test-a\\"));
💡 Title: Use of non-literal fs filename
fs.writeFileSync(path.resolve(base, "test-a\\", "test.js"), "x");
💡 Title: Use of non-literal fs filename
fs.mkdirSync(path.resolve(base, "test-b\\?"));
💡 Title: Use of non-literal fs filename
fs.writeFileSync(path.resolve(base, "test-b\\?", "test.js"), "x");
💡 Title: Use of non-literal fs filename
fs.unlinkSync(path.resolve(base, "test-a\\", "test.js"));
💡 Title: Use of non-literal fs filename
fs.rmdirSync(path.resolve(base, "test-a\\"));
💡 Title: Use of non-literal fs filename
fs.unlinkSync(path.resolve(base, "test-b\\?", "test.js"));
💡 Title: Use of non-literal fs filename
fs.rmdirSync(path.resolve(base, "test-b\\?"));
💡 Title: Use of non-literal require
const { cosmiconfig, cosmiconfigSync } = require(thirdParty);
💡 Title: Use of non-literal require
const { bin } = require(path.join(prettierRootDir, "package.json"));
💡 Title: Use of non-literal require
.spyOn(require(thirdParty), "getStream")
💡 Title: Use of non-literal require
.spyOn(require(thirdParty), "isCI")
💡 Title: Use of non-literal require
.spyOn(require(thirdParty), "cosmiconfig")
💡 Title: Use of non-literal require
.spyOn(require(thirdParty), "cosmiconfigSync")
💡 Title: Use of non-literal require
.spyOn(require(thirdParty), "findParentDir")
💡 Title: Use of non-literal require
require(prettierCli);
💡 Title: Use of non-literal require
const siteConfig = require(process.cwd() + "/siteConfig.js");
💡 Title: Use of non-literal require
const siteConfig = require(process.cwd() + "/siteConfig.js");
💡 Title: Use of non-literal require
const versions = require(`${CWD}/versions.json`);
💡 Title: Use of non-literal require
const rootPackageJson = require(`${CWD}/../package.json`);
💡 Title: Use of non-literal fs filename
return parseYaml(fs.readFileSync(path.join(__dirname, fsPath), "utf8"));

More info on how to fix Insecure File Management in JavaScript.


Insecure Use of Dangerous Function (6)
Docs Details
💡 Title: Use of child process and non-literal exec()
const { exec, execSync } = require("child_process");
💡 Title: Use of child process and non-literal exec()
var exec = require('child_process').exec;
💡 Title: Use of child process and non-literal exec()
var execFile = require('child_process').execFile;
💡 Title: Use of child process and non-literal exec()
var execSync = require('child_process').execSync;
💡 Title: Use of child process and non-literal exec()
var child_process = require('child_process');
💡 Title: Use of child process and non-literal exec()
var child_process = require('child_process');

More info on how to fix Insecure Use of Dangerous Function in JavaScript.


Insecure Use of Regular Expressions (37)
Docs Details
💡 Title: Regex DOS (ReDOS)
new RegExp(`(${escapeStringRegexp(target)})+`, "g")
💡 Title: Regex DOS (ReDOS)
new RegExp(`(${escapeStringRegexp(target)})+`, "g")
💡 Title: Regex DOS (ReDOS)
const NUMBER_REGEX = /(?:\d*\.\d+|\d+\.?)(?:[Ee][+-]?\d+)?/g;
💡 Title: Regex DOS (ReDOS)
const ADJUST_NUMBERS_REGEX = new RegExp(
💡 Title: Regex DOS (ReDOS)
const newLines = (string.match(/^([^\S\n\r]*[\n\r])+/g) || [])[0] || "";
💡 Title: Regex DOS (ReDOS)
const newLines = (string.match(/([\n\r][^\S\n\r]*)+$/g) || [])[0] || "";
💡 Title: Regex DOS (ReDOS)
doc = doc.replace(/(?:\r?\n)*$/, "");
💡 Title: Regex DOS (ReDOS)
💡 Title: Regex DOS (ReDOS)
new RegExp(patterns.join("|")).test(node.fullName);
💡 Title: Regex DOS (ReDOS)
const forIteratorRE = /,([^,\]}]*)(?:,([^,\]}]*))?$/;
💡 Title: Regex DOS (ReDOS)
const simplePathRE = /^[$A-Z_a-z][\w$]*(?:\.[$A-Z_a-z][\w$]*|\['[^']*?']|\["[^"]*?"]|\[\d+]|\[[$A-Z_a-z][\w$]*])*$/;
💡 Title: Regex DOS (ReDOS)
const match = value.trim().match(/^prettier-ignore-attribute(?:\s+([^]+))?$/);
💡 Title: Regex DOS (ReDOS)
/^\s*(?:#[^\n\r]*)?$/.test(line)
💡 Title: Regex DOS (ReDOS)
text.replace(new RegExp(`^${indentation}`, "gm"), "")
💡 Title: Regex DOS (ReDOS)
const placeholderRegex = new RegExp(composePlaceholder("(\\d+)"), "g");
💡 Title: Regex DOS (ReDOS)
💡 Title: Regex DOS (ReDOS)
comments: parsedDocblock.comments.replace(/^(\s+?\r?\n)+/, ""), // remove leading newlines
💡 Title: Regex DOS (ReDOS)
final = final.slice(1, -1).replace(new RegExp(quote, "g"), escape);
💡 Title: Regex DOS (ReDOS)
const FLOW_SHORTHAND_ANNOTATION = new RegExp(
💡 Title: Regex DOS (ReDOS)
const FLOW_ANNOTATION = new RegExp(`^${NON_LINE_TERMINATING_WHITE_SPACE}*::`);
💡 Title: Regex DOS (ReDOS)
const matchJsxWhitespaceRegex = new RegExp("([" + jsxWhitespaceChars + "]+)");
💡 Title: Regex DOS (ReDOS)
const containsNonJsxWhitespaceRegex = new RegExp(
💡 Title: Regex DOS (ReDOS)
const regex = new RegExp(
💡 Title: Regex DOS (ReDOS)
💡 Title: Regex DOS (ReDOS)
escapedValue = escapedValue.replace(/^(\\?[*_])+/, (prefix) =>
💡 Title: Regex DOS (ReDOS)
return new RegExp(dangerousChars.map((x) => `\\${x}`).join("|")).test(url)
💡 Title: Regex DOS (ReDOS)
title = title.replace(new RegExp(`(${quote})`, "g"), "\\$1");
💡 Title: Regex DOS (ReDOS)
const kRegex = new RegExp(kPattern);
💡 Title: Regex DOS (ReDOS)
const punctuationRegex = new RegExp(punctuationPattern);
💡 Title: Regex DOS (ReDOS)
: text.replace(new RegExp(`(${cjkPattern})\n(${cjkPattern})`, "g"), "$1$2")
💡 Title: Regex DOS (ReDOS)
.split(new RegExp(`(${cjkPattern})`))
💡 Title: Regex DOS (ReDOS)
const replaceRegex = new RegExp(`^\\s{0,${leadingSpaceCount}}`);
💡 Title: Regex DOS (ReDOS)
.match(new RegExp(`^[${markerStyle}]+`))[0];
💡 Title: Regex DOS (ReDOS)
const hasEndMarker = new RegExp(`^\\s{0,3}${marker}`).test(
💡 Title: Regex DOS (ReDOS)
const m2 = firstLine.match(/^#!\/(?:usr\/(?:local\/)?)?bin\/(\S+)/);
💡 Title: Regex DOS (ReDOS)
💡 Title: Regex DOS (ReDOS)
const regex = new RegExp(

More info on how to fix Insecure Use of Regular Expressions in JavaScript.


Information Disclosure (163)
Docs Details
💡 Title: Dynamic Placeholder Rule
function f<A,B>(a: A, b: B): A {return a + b; } // error
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
type A = number; // error: name already bound
💡 Title: Dynamic Placeholder Rule
let a = ""; // error: a already bound in switch
💡 Title: Dynamic Placeholder Rule
class Foo {} // error, shadows type Foo
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
function obj_rest_pattern<X>({ _, ...o } : ObjRest<X>) { // o: { x: X }
💡 Title: Dynamic Placeholder Rule
import x from './req';
💡 Title: Dynamic Placeholder Rule
function empty_rest_t<T: empty>(...xs: T): void {} // Error - rest param can't be empty
💡 Title: Dynamic Placeholder Rule
var fn : function<string> = function() { return 'foo'; } // error, arity 0
💡 Title: Dynamic Placeholder Rule
function f(x: Foo | null | void): void {
💡 Title: Dynamic Placeholder Rule
function if_partial_post_init(b) {
💡 Title: Dynamic Placeholder Rule
function switch_post_init2(i): number {
💡 Title: Dynamic Placeholder Rule
function makeIterator(coin_flip: () => boolean ): Iterator<string> {
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
function noRest(x: 'hi', y: 123): true { return true; }
💡 Title: Dynamic Placeholder Rule
<HelloMessage name={007} />; // number ~/~> string error
💡 Title: Dynamic Placeholder Rule
function is_string_and_number(x, y): %checks {
💡 Title: Dynamic Placeholder Rule
function foo(x: string | Array<string>): string {
💡 Title: Dynamic Placeholder Rule
function obj2(x: mixed) {
💡 Title: Dynamic Placeholder Rule
function f() {
💡 Title: Dynamic Placeholder Rule
function foo(x: Array<number>): [number, ?number] {
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
class A implements B, C {}
💡 Title: Dynamic Placeholder Rule
import type {a, somethingSuperLongsomethingSuperLong} from 'somethingSuperLongsomethingSuperLongsomethingSuperLong'
💡 Title: Dynamic Placeholder Rule
File: tests/flow/internal-slot/internal_slot.js
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
function test(x: {foo: number, bar: number, baz: number, qux: nunber, a: number, b: number, c: {a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, ...}, ...}) { return x; }
💡 Title: Dynamic Placeholder Rule
type X = ?((number, number) => number) => void;
💡 Title: Dynamic Placeholder Rule
function render() {
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
let a = x > 10 ? 'big' : 'small';
💡 Title: Dynamic Placeholder Rule
https://github.com/turkdevops/prettier/blob/703e4aea76245de999c34d00e0aa4f1f222d98eb/tests/js/babel-plugins/module-attributes-dynamic.js#L2
💡 Title: Dynamic Placeholder Rule
import foo from "foo.json" with type: "json";
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
const addOne = add(1, ?); // apply from the left
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
get #x() { return this.#xValue; }
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
const tuple1 = #[1, 2, 3];
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
const user = renderedUser || shouldRenderUser && <div><User name={this.state.user.name} age={this.state.user.age} /></div>;
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
const x = longVariable + longVariable + longVariable + longVariable - longVariable + longVariable;
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
const test = /** @type (function (*): ?|undefined) */ (goog.partial(NewThing.onTemplateChange, rationaleField, typeField));
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
(function() {return <|> 15})()
💡 Title: Dynamic Placeholder Rule
(function(){return <|>15})()
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
<<<PRETTIER_RANGE_START>>> thisWillBeFormatted <|> (2 ,3, )
💡 Title: Dynamic Placeholder Rule
<<<PRETTIER_RANGE_START>>> thisWillBeFormatted (2 ,3<|>, )
💡 Title: Dynamic Placeholder Rule
<<<PRETTIER_RANGE_START>>> thisWillBeFormatted (2 ,3, <|> )
💡 Title: Dynamic Placeholder Rule
thisWontBeFormatted <|> ( 1 ,3<<<PRETTIER_RANGE_START>>>)
💡 Title: Dynamic Placeholder Rule
<<<PRETTIER_RANGE_END>>>thisWontBeFormatted (2, 9<|>0 ,)
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
@deco export class Bar {}
💡 Title: Dynamic Placeholder Rule
export class AppModule {}
💡 Title: Dynamic Placeholder Rule
export default class MyComponent {
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
export class MyApp extends React.Component {}
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
runTaskForChanged,
💡 Title: Dynamic Placeholder Rule
export { undefinedExport };
💡 Title: Dynamic Placeholder Rule
function excludeFirstFiveResults([first, second, third, fourth, fifth, ...rest] = DEFAULT_FIVE_RESULTS) {
💡 Title: Dynamic Placeholder Rule
function StatelessFunctionalComponent({
💡 Title: Dynamic Placeholder Rule
function f() {
💡 Title: Dynamic Placeholder Rule
interface ExtendsOne extends ASingleInterface {
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
c.foo.bar().baz ??= result.foo.bar().baz(a.baz) &&= result.baz;
💡 Title: Dynamic Placeholder Rule
const { course, conflicts = [], index, scheduleId, studentId, something } = this.props;
💡 Title: Dynamic Placeholder Rule
const sha256 = (data) =>
💡 Title: Dynamic Placeholder Rule
const writer = new BufferStackItem(
💡 Title: Dynamic Placeholder Rule
https://github.com/turkdevops/prettier/blob/703e4aea76245de999c34d00e0aa4f1f222d98eb/tests/js/module-attributes/module-attributes-dynamic.js#L2
💡 Title: Dynamic Placeholder Rule
import foo from "foo.json" with type: "json";
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
const Dropdown = styled.div`
💡 Title: Dynamic Placeholder Rule
var package = require('../package');
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
https://github.com/turkdevops/prettier/blob/703e4aea76245de999c34d00e0aa4f1f222d98eb/tests/js/objects/escape sequence-key.js#L6
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
const addOne = add(1, ?); // apply from the left
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
💡 Title: Dynamic Placeholder Rule
if (#prop in obj) {
💡 Title: Dynamic Placeholder Rule
"octal escapes \0 \1 \2 \3 \4 \5 \6 \7"
💡 Title: Dynamic Placeholder Rule
class <<<PRETTIER_RANGE_START>>> a {

This comment has been truncated due to comment length limitations, please go to the dashboard for further details.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github May 28, 2021

Superseded by #400.

@dependabot dependabot bot closed this May 28, 2021
@dependabot dependabot bot deleted the dependabot/github_actions/actions/cache-2.1.5 branch May 28, 2021 06:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Build dependencies Pull requests that update a dependency file github_actions Pull requests that update Github_actions code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants