From 86c3d7397e821972003edcc29fd033d91fad5c3f Mon Sep 17 00:00:00 2001 From: lmvysakh Date: Thu, 13 Aug 2026 12:45:15 +0530 Subject: [PATCH 1/3] Error message updated --- __tests__/cache-restore.test.ts | 4 +++- dist/cache-save/index.js | 2 +- dist/setup/index.js | 2 +- src/cache-distributions/cache-distributor.ts | 2 +- 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/__tests__/cache-restore.test.ts b/__tests__/cache-restore.test.ts index 914bd5e57..4b549f518 100644 --- a/__tests__/cache-restore.test.ts +++ b/__tests__/cache-restore.test.ts @@ -276,7 +276,9 @@ virtualenvs.path = "{cache-dir}/virtualenvs" # /Users/patrick/Library/Caches/py await expect(cacheDistributor.restoreCache()).rejects.toThrow( `No file in ${process.cwd()} matched to [${cacheDependencyPath .split('\n') - .join(',')}], make sure you have checked out the target repository` + .join( + ',' + )}] for ${packageManager}. Make sure you have checked out the target repository, or consider removing the cache step if there are no dependencies to cache.` ); } ); diff --git a/dist/cache-save/index.js b/dist/cache-save/index.js index 056f9e6ad..8d5ba81a6 100644 --- a/dist/cache-save/index.js +++ b/dist/cache-save/index.js @@ -97948,7 +97948,7 @@ class CacheDistributor { .split('\n') .join(',')} or ${CACHE_DEPENDENCY_BACKUP_PATH}` : this.cacheDependencyPath.split('\n').join(','); - throw new Error(`No file in ${process.cwd()} matched to [${file}], make sure you have checked out the target repository`); + throw new Error(`  No file in ${process.cwd()} matched to [${file}] for ${this.packageManager}. Make sure you have checked out the target repository, or consider removing the cache step if there are no dependencies to cache.`); } const cachePath = await this.getCacheGlobalDirectories(); core.saveState(State.CACHE_PATHS, cachePath); diff --git a/dist/setup/index.js b/dist/setup/index.js index 16fe5c6f2..e2c8ba42e 100644 --- a/dist/setup/index.js +++ b/dist/setup/index.js @@ -103175,7 +103175,7 @@ class CacheDistributor { .split('\n') .join(',')} or ${CACHE_DEPENDENCY_BACKUP_PATH}` : this.cacheDependencyPath.split('\n').join(','); - throw new Error(`No file in ${process.cwd()} matched to [${file}], make sure you have checked out the target repository`); + throw new Error(`  No file in ${process.cwd()} matched to [${file}] for ${this.packageManager}. Make sure you have checked out the target repository, or consider removing the cache step if there are no dependencies to cache.`); } const cachePath = await this.getCacheGlobalDirectories(); saveState(State.CACHE_PATHS, cachePath); diff --git a/src/cache-distributions/cache-distributor.ts b/src/cache-distributions/cache-distributor.ts index 8c4a69321..a151900c7 100644 --- a/src/cache-distributions/cache-distributor.ts +++ b/src/cache-distributions/cache-distributor.ts @@ -60,7 +60,7 @@ abstract class CacheDistributor { .join(',')} or ${CACHE_DEPENDENCY_BACKUP_PATH}` : this.cacheDependencyPath.split('\n').join(','); throw new Error( - `No file in ${process.cwd()} matched to [${file}], make sure you have checked out the target repository` + `  No file in ${process.cwd()} matched to [${file}] for ${this.packageManager}. Make sure you have checked out the target repository, or consider removing the cache step if there are no dependencies to cache.` ); } From 0db3ddac2f5f299392a57f85bea640cfba9c04d5 Mon Sep 17 00:00:00 2001 From: lmvysakh Date: Thu, 13 Aug 2026 16:34:44 +0530 Subject: [PATCH 2/3] Fixed whitespace lint error --- dist/cache-save/index.js | 2 +- dist/setup/index.js | 2 +- src/cache-distributions/cache-distributor.ts | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dist/cache-save/index.js b/dist/cache-save/index.js index 8d5ba81a6..bee6394e6 100644 --- a/dist/cache-save/index.js +++ b/dist/cache-save/index.js @@ -97948,7 +97948,7 @@ class CacheDistributor { .split('\n') .join(',')} or ${CACHE_DEPENDENCY_BACKUP_PATH}` : this.cacheDependencyPath.split('\n').join(','); - throw new Error(`  No file in ${process.cwd()} matched to [${file}] for ${this.packageManager}. Make sure you have checked out the target repository, or consider removing the cache step if there are no dependencies to cache.`); + throw new Error(` No file in ${process.cwd()} matched to [${file}] for ${this.packageManager}. Make sure you have checked out the target repository, or consider removing the cache step if there are no dependencies to cache.`); } const cachePath = await this.getCacheGlobalDirectories(); core.saveState(State.CACHE_PATHS, cachePath); diff --git a/dist/setup/index.js b/dist/setup/index.js index e2c8ba42e..deffa09d1 100644 --- a/dist/setup/index.js +++ b/dist/setup/index.js @@ -103175,7 +103175,7 @@ class CacheDistributor { .split('\n') .join(',')} or ${CACHE_DEPENDENCY_BACKUP_PATH}` : this.cacheDependencyPath.split('\n').join(','); - throw new Error(`  No file in ${process.cwd()} matched to [${file}] for ${this.packageManager}. Make sure you have checked out the target repository, or consider removing the cache step if there are no dependencies to cache.`); + throw new Error(` No file in ${process.cwd()} matched to [${file}] for ${this.packageManager}. Make sure you have checked out the target repository, or consider removing the cache step if there are no dependencies to cache.`); } const cachePath = await this.getCacheGlobalDirectories(); saveState(State.CACHE_PATHS, cachePath); diff --git a/src/cache-distributions/cache-distributor.ts b/src/cache-distributions/cache-distributor.ts index a151900c7..73b79355e 100644 --- a/src/cache-distributions/cache-distributor.ts +++ b/src/cache-distributions/cache-distributor.ts @@ -60,7 +60,7 @@ abstract class CacheDistributor { .join(',')} or ${CACHE_DEPENDENCY_BACKUP_PATH}` : this.cacheDependencyPath.split('\n').join(','); throw new Error( - `  No file in ${process.cwd()} matched to [${file}] for ${this.packageManager}. Make sure you have checked out the target repository, or consider removing the cache step if there are no dependencies to cache.` + ` No file in ${process.cwd()} matched to [${file}] for ${this.packageManager}. Make sure you have checked out the target repository, or consider removing the cache step if there are no dependencies to cache.` ); } From f1f1295e5b4cf1273fd218d1c4f62aa06eeeb1f9 Mon Sep 17 00:00:00 2001 From: lmvysakh Date: Mon, 17 Aug 2026 12:35:40 +0530 Subject: [PATCH 3/3] audit fixed --- .licenses/npm/brace-expansion.dep.yml | 2 +- .licenses/npm/undici.dep.yml | 2 +- dist/cache-save/index.js | 182 ++++++++++++++++++++-- dist/setup/index.js | 216 +++++++++++++++++++++++--- package-lock.json | 18 +-- 5 files changed, 373 insertions(+), 47 deletions(-) diff --git a/.licenses/npm/brace-expansion.dep.yml b/.licenses/npm/brace-expansion.dep.yml index f40e8707d..fd7e18fe1 100644 --- a/.licenses/npm/brace-expansion.dep.yml +++ b/.licenses/npm/brace-expansion.dep.yml @@ -1,6 +1,6 @@ --- name: brace-expansion -version: 5.0.8 +version: 5.0.9 type: npm summary: Brace expansion as known from sh/bash homepage: diff --git a/.licenses/npm/undici.dep.yml b/.licenses/npm/undici.dep.yml index c46a5c7bf..b339a4487 100644 --- a/.licenses/npm/undici.dep.yml +++ b/.licenses/npm/undici.dep.yml @@ -1,6 +1,6 @@ --- name: undici -version: 6.27.0 +version: 6.28.0 type: npm summary: An HTTP/1.1 client, written from scratch for Node.js homepage: https://undici.nodejs.org diff --git a/dist/cache-save/index.js b/dist/cache-save/index.js index bee6394e6..87f5b38f7 100644 --- a/dist/cache-save/index.js +++ b/dist/cache-save/index.js @@ -16069,7 +16069,13 @@ function processHeader (request, key, val) { } else if (typeof val[i] === 'object') { throw new InvalidArgumentError(`invalid ${key} header`) } else { - arr.push(`${val[i]}`) + // Coerce primitives (and reject unsafe coercions such as functions + // with a crafted toString/Symbol.toPrimitive). + const str = `${val[i]}` + if (!isValidHeaderValue(str)) { + throw new InvalidArgumentError(`invalid ${key} header`) + } + arr.push(str) } } val = arr @@ -16080,7 +16086,12 @@ function processHeader (request, key, val) { } else if (val === null) { val = '' } else { + // Coerce primitives (and reject unsafe coercions such as functions + // with a crafted toString/Symbol.toPrimitive). val = `${val}` + if (!isValidHeaderValue(val)) { + throw new InvalidArgumentError(`invalid ${key} header`) + } } if (headerName === 'host') { @@ -17452,6 +17463,7 @@ const { RequestContentLengthMismatchError, ResponseContentLengthMismatchError, RequestAbortedError, + InvalidArgumentError, HeadersTimeoutError, HeadersOverflowError, SocketError, @@ -18435,8 +18447,16 @@ function writeH1 (client, request) { } body = bodyStream.stream contentLength = bodyStream.length - } else if (util.isBlobLike(body) && request.contentType == null && body.type) { - headers.push('content-type', body.type) + } else if (util.isBlobLike(body) && request.contentType == null) { + const contentType = body.type + if (contentType) { + const contentTypeValue = `${contentType}` + if (!util.isValidHeaderValue(contentTypeValue)) { + util.errorRequest(client, request, new InvalidArgumentError('invalid content-type header')) + return false + } + headers.push('content-type', contentTypeValue) + } } if (body && typeof body.read === 'function') { @@ -21909,6 +21929,28 @@ function calculateRetryAfterHeader (retryAfter) { return new Date(retryAfter).getTime() - current } +function validatePartialResponseContentLength (headers, range, statusCode, retryCount) { + const contentLength = headers['content-length'] + if (contentLength == null) { + return null + } + + if (!Number.isFinite(range.start) || !Number.isFinite(range.end)) { + return null + } + + const length = Number(contentLength) + const expectedLength = range.end - range.start + 1 + if (!Number.isFinite(length) || length !== expectedLength) { + return new RequestRetryError('Content-Length mismatch', statusCode, { + headers, + data: { count: retryCount } + }) + } + + return null +} + class RetryHandler { constructor (opts, handlers) { const { retryOptions, ...dispatchOpts } = opts @@ -22123,6 +22165,12 @@ class RetryHandler { return false } + const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount) + if (contentLengthError != null) { + this.abort(contentLengthError) + return false + } + const { start, size, end = size - 1 } = contentRange assert(this.start === start, 'content-range mismatch') @@ -22146,6 +22194,12 @@ class RetryHandler { ) } + const contentLengthError = validatePartialResponseContentLength(headers, range, statusCode, this.retryCount) + if (contentLengthError != null) { + this.abort(contentLengthError) + return false + } + const { start, size, end = size - 1 } = range assert( start != null && Number.isFinite(start), @@ -26390,7 +26444,7 @@ function validateCookiePath (path) { if ( code < 0x20 || // exclude CTLs (0-31) - code === 0x7F || // DEL + code > 0x7E || // exclude DEL and non-ascii code === 0x3B // ; ) { throw new Error('Invalid cookie path') @@ -26399,16 +26453,80 @@ function validateCookiePath (path) { } /** - * I have no idea why these values aren't allowed to be honest, - * but Deno tests these. - Khafra + * ::= | + * + * ::= any one of the 52 alphabetic characters A through Z in + * upper case and a through z in lower case + * + * ::= any one of the ten digits 0 through 9r + * + * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5 + * @param {number} code + */ +function isLetterOrDigit (code) { + return ( + (code >= 0x30 && code <= 0x39) || // 0-9 + (code >= 0x41 && code <= 0x5A) || // A-Z + (code >= 0x61 && code <= 0x7A) // a-z + ) +} + +/** + * Validates a cookie domain against the "preferred name syntax". + * + * ::= | " " + * ::=