Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add brakeman ignores for Ruby 3.1 and Rails 7.0 #23322

Merged
merged 1 commit into from
Feb 3, 2025

Conversation

Fryguy
Copy link
Member

@Fryguy Fryguy commented Feb 3, 2025

@jrafanie Please review.

@jrafanie
Copy link
Member

jrafanie commented Feb 3, 2025

@Fryguy 3.3 security failed with

** Running yarn npm audit for manageiq-ui-classic
**   path:    /home/runner/work/manageiq/manageiq/vendor/bundle/ruby/3.3.0/bundler/gems/manageiq-ui-classic-746b0fd05125
**   command: yarn npm audit --recursive --no-deprecations --environment production
└─ bootstrap-sass
   ├─ ID: 1102094
   ├─ Issue: Bootstrap Cross-Site Scripting (XSS) vulnerability
   ├─ URL: https://github.com/advisories/GHSA-9mvj-f7w8-pvh2
   ├─ Severity: moderate
   ├─ Vulnerable Versions: >=2.0.0 <=3.4.3
   │ 
   ├─ Tree Versions
   │  └─ 3.4.3
   │ 
   └─ Dependents
      └─ patternfly@npm:3.59.5

Do we need to whitelist this or need another fix?

@Fryguy
Copy link
Member Author

Fryguy commented Feb 3, 2025

It's a coincidental issue, so we have a chicken/egg problem. I verified that when we merge this PR, the brakeman issues stop on the ui-classic side, so my thought is merge this side on red. Then I'll make a PR on ui-classic to make that go green, then we'll retest master here.

Copy link
Member

@jrafanie jrafanie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Merging so we can fix the failing test on ui-classic and verify it works here afterwards.

@jrafanie jrafanie merged commit f6aa990 into ManageIQ:master Feb 3, 2025
4 of 8 checks passed
@Fryguy Fryguy deleted the brakeman_ignores branch February 3, 2025 21:10
@Fryguy
Copy link
Member Author

Fryguy commented Feb 3, 2025

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants