Repository navigation
Conversation
… and Next.js Bump rustls-webpki to 0.103.16, follow-redirects to 1.16.1 (via an Azurite runner override), DOMPurify to 3.4.17 and Next.js to 16.4.2. Add a follow-redirects cross-origin credential test and a version guard for Next.js and DOMPurify. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> (cherry picked from commit cc873c1)
Send an explicit Host header so vulnerable array-form requests reach the redirect, assert credentials at the origin, and check array and regex-metacharacter leaks independently. Exercise Mermaid's DOMPurify dependency against XHTML SVG, shadow-root template, and detached-subtree regressions using a development-only jsdom harness.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Patch the four dependency versions still present on this fork's
main, covering the nine advisories reviewed in TraceMachina/nativelink#3022. The first commit cherry-picks Marcus Eagan's original security patch with attribution; the second adds behavioral regression coverage from the review.The redirect test now supplies
Hostfor raw array headers. Without it, Node returns HTTP 400 before the vulnerable request reaches the redirect, so the old test fails for the wrong reason. Separate cases verify array credentials and each sensitive-header metacharacter (^and|), confirm credentials reach the origin, and require a successful response with harmless headers preserved at the target.Four DOM tests exercise the sanitizer resolved by Mermaid: XHTML SVG href animation, template fragments joined inside a shadow root, and event handlers on subtrees detached by parent/sibling hooks. Each also checks that harmless content survives. jsdom and its types are development dependencies.
How was this verified?
On Linux with Bun 1.4.2 and Node 22.23.2/24.21.0:
web/and the Azurite runner.bun run testinweb/: 12 passed. Azurite's suite: 7 passed on both Node versions.bun run buildinweb/: both apps build on Next.js 16.4.2.bazel mod deps --lockfile_mode=errorandbazel build //nativelink-util:nativelink-util --lockfile_mode=error --jobs=8pass with the fork's Bazel 9.1.1.Limits: DOM tests inspect sanitized content rather than executing browser payloads. Crafted Next.js exploit requests and an emSign certificate-chain reproduction were not exercised. The full Cargo/Bazel test suites were not run.
Risk
Next.js moves from 16.3 to 16.4 and is the largest runtime change; both sites build successfully. rustls-webpki changes certificate acceptance in the TLS stack. follow-redirects is used by the Azurite test harness. The new DOM runtime is confined to tests.
AI assistance
Codex reviewed the upstream patch, implemented the additional regression tests, ran the checks, and drafted this PR at b7r6's request. The cherry-picked dependency patch was authored by Marcus Eagan with Claude Code assistance; its attribution is preserved.