Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SECURITY: FIX unintended Email protocol resolution #3759

Conversation

Pranav-yadav
Copy link
Contributor

@Pranav-yadav Pranav-yadav commented Jun 13, 2023

Summary

Fixes #3758

Wherever we've specified the package versions explicitly and haven't enclosed them in the inline-code-block (`) or multiline-code-block (```) they are resolved as an email protocol (address), which is unintended and is a primary security concern.

This diff updates such occurrences to enclose them in inline code blocks and of course some code formatting touchups 😇

Changelog:

[SECURITY]: FIX unintended Email protocol resolution

Changes

Before After
image image

P.S.: Came across this when working on #3732

@netlify
Copy link

netlify bot commented Jun 13, 2023

Deploy Preview for react-native ready!

Name Link
🔨 Latest commit 5db19b8
🔍 Latest deploy log https://app.netlify.com/sites/react-native/deploys/6487fe2defa72800084c526a
😎 Deploy Preview https://deploy-preview-3759--react-native.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

@Pranav-yadav
Copy link
Contributor Author

Pranav-yadav commented Jun 13, 2023

@cortinico We must backport this change as it's a security concern 🚨.
Lmk, so I can proceed with backporting this (to almost all versions)? 👍

@Simek
Copy link
Collaborator

Simek commented Jun 13, 2023

It's not a high security risk, but since the changes are quite simple, it would be nice if you can backport them. 🙂

@Pranav-yadav
Copy link
Contributor Author

May not be a high-security issue but, a similar email protocol resolution and domain resolution for .zip files hosted on GitHub[dot]com have been (being) exploited recently.

Since it's only email resolution, and these instances don't make up valid email addresses they are of "low" security concerns. 👍

P.S.: If it was a "high" security concern (vulnerability) I would've reported it privately :)

--

Sure 🙂.

Copy link
Contributor

@cortinico cortinico left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for reporting this @Pranav-yadav
and yes let's backport it

@cortinico cortinico merged commit 90e0d84 into facebook:main Jun 13, 2023
@Pranav-yadav
Copy link
Contributor Author

Welcome!
Sure, will open a PR(s) whenever I get some time. 👍

@Pranav-yadav Pranav-yadav deleted the Pranav-yadav/security-fix-email-protocol-resolution branch June 13, 2023 17:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

SECURITY: Unintended Email protocol resolution for package versions
4 participants