Skip to content

chore(deps): exempt GHSA-xcx6-jx8p-x3h5 (@azure/msal-node via tedious) until 2026-11-26 - #26486

Merged
os-zhuang merged 1 commit into
mainfrom
claude/project-thread-c4jd1i
Oct 27, 2026
Merged

chore(deps): exempt GHSA-xcx6-jx8p-x3h5 (@azure/msal-node via tedious) until 2026-11-26#26486
os-zhuang merged 1 commit into
mainfrom
claude/project-thread-c4jd1i

Conversation

@os-steve

@os-steve os-steve commented Oct 27, 2026

Copy link
Copy Markdown
Collaborator

Requested by Steve · project thread

Fixes #26428

维护者速读

  • 改了什么：在 osv-scanner.toml 加一条豁免，GHSA-xcx6-jx8p-x3h5，ignoreUntil = 2026-11-26（30 天）。只改这一个文件。
  • 为什么改：定时 OSV 扫描从 10-21 起每天红，唯一的发现就是这条：@azure/msal-node 5.4.1，High。修复版是 7.1.0，但目前没有任何已发布的 @azure/identity 接受 msal-node 7（最新的 4.14.0 仍要求 ^6），所以拿不到修复版。
  • 风险：只出现在开发依赖树里，路径是 tedious（driver-sql 的可选 mssql peer）→ @azure/identity → msal-node，不进任何发布包。漏洞在授权码流程（acquireTokenByCode），tedious 不调用它。
  • 回滚：revert 即可。到 11-26 豁免自动失效，扫描会重新报红。

What changes

One [[IgnoredVulns]] entry in osv-scanner.toml. This PR carries no other change, per convention 3 (an exemption lands in its own PR, labelled osv-exemption).

Why

What the scan shows. Scheduled run 40442115529 (2026-10-27 03:05Z), OSV-Scanner v2.5.0 on pnpm-lock.yaml:

| https://osv.dev/GHSA-xcx6-jx8p-x3h5 | 7.5 | npm | @azure/msal-node | 5.4.1 | 7.1.0 | pnpm-lock.yaml |

The advisory (osv.dev): "MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint", CWE-346. Affected from 5.0.0-beta.0 to before 7.1.0. The workaround it names is passing only the auth code to acquireTokenByCode.

Why no fix can be taken today.

  • The path in the lockfile is tedious@18.6.2 → @azure/identity@4.13.1 → @azure/msal-node@5.4.1. tedious is driver-sql's optional peerDependency, so this repo installs it for its own tree and no published package carries it.
  • npm view @azure/identity@4.14.0 dependencies.@azure/msal-node gives ^6.0.0, and every 6.x is inside the affected range. tedious 20.3.8, its latest, needs @azure/identity ^4.13.1.
  • The only way to reach 7.1.0 would be a pnpm override that forces msal-node a major past the range @azure/identity declares. This PR does not do that.

When to remove it. Once a published @azure/identity accepts msal-node >=7.1.0 and tedious resolves to it, bump instead and delete this entry. The 30-day ignoreUntil forces this decision to be looked at again.

Also reported by the same scan, not changed here

The scanner reports the existing GHSA-hp3w-g68c-fv3c entry (sprintf-js, ignoreUntil = 2026-11-05) as an unused ignore. osv.dev shows that advisory withdrawn on 2026-10-22, so the entry no longer matches anything, though sprintf-js 1.0.3 and 1.1.3 are still in the lockfile. It is left alone here: one exemption change per PR. It can be removed in its own PR, or it will drop out on its own date.

Verification

  • node scripts/check-osv-exemptions.mjs --self-test: passes.
  • node scripts/check-osv-exemptions.mjs: ✓ 2 OSV exemption(s) in osv-scanner.toml: all carry an unexpired ignoreUntil within 90 days and a reason with an advisory link.
  • OSV-Scanner itself is not run locally (its container image is not reachable from this session). This PR's Validate Dependencies run (triggered by osv-scanner.toml) is the measurement.

Clause-②: no
Metadata-protocol: none

Human Minimum

  • 1. Schemas start as Zod; packages/spec holds no runtime logic. (not touched)
  • 2. Every name I added uses the casing for its kind. (none)
  • 3. No formatter ran; pnpm lint passes.
  • 4. One issue, one branch off an up-to-date main, one pull request.
  • 5. A change that publishes carries a changeset. This PR publishes nothing, so it is labelled skip-changeset.
  • 6. packages/spec touched: n/a.
  • 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
  • 8. Title, body and comments are in English.
  • The Before Submitting list in CONTRIBUTING.md is done.

Generated by Claude Code

@claude
chore(deps): exempt GHSA-xcx6-jx8p-x3h5 (@azure/msal-node via tedious…
809daee 
…) until 2026-11-26

The scheduled OSV scan has been red on main every day since 2026-10-21. The
one finding is GHSA-xcx6-jx8p-x3h5 (High): @azure/msal-node 5.4.1, patched
only in 7.1.0. It arrives through tedious 18.6.2, driver-sql's optional
mssql peer (dev tree only), then @azure/identity 4.13.1. No published
@azure/identity accepts msal-node 7 yet; 4.14.0, the latest, requires ^6.
The flaw is in the authorization-code flow (acquireTokenByCode), which
tedious never calls.

A 30-day exemption, per the ledger's conventions.

Fixes #26428

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ADHkmPhbmyqwyDkSjg13F7
@os-steve os-steve added skip-changeset PR has no user-facing published change; bypasses the changeset gate osv-exemption labels Oct 27, 2026 — with Claude
@os-steve os-steve self-assigned this Oct 27, 2026
@objectstack-fleet

objectstack-fleet Bot commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

席位核对 · ACCEPT · devx seat 2 · 2026-10-27T04:56Z

Seat domain:devx#2 (#20163) · session_01Q4MDXRbEJCNdPAP4SiXwp9 · reviewed head 809daee5 · card #26428 (claim 6433698387, branch claude/project-thread-c4jd1i). Not governed (check-governed-merges: tier null); +5/−0, osv-scanner.toml only, labelled osv-exemption. This comment is the review of the security decision that the ledger header's convention 3 asks for, and nothing else is in the PR.

  • The finding: the newest red (run 40442115529, job 121984654047, 10-27) names exactly one advisory, GHSA-xcx6-jx8p-x3h5 (High, CVSS 7.5): @azure/msal-node 5.4.1, fixed only in 7.1.0. On osv.dev it is published 2026-10-23, affects 5.0.0-beta.0 up to 7.1.0, and is an origin-validation error in the auth_code flow. The advisory's workaround names acquireTokenByCode.
  • Why exempt rather than bump: the patch is only in a major (7.x) that no published @azure/identity accepts (^6). An override would force an untested two-major jump under @azure/identity. That is the header's "the patch is only in a major we cannot take yet / transitive through X" case.
  • Reach: path tedious 18.6.2 → @azure/identity 4.13.1 → @azure/msal-node. In driver-sql, tedious is an optional peerDependency (peerDependenciesMeta.tedious.optional). This lockfile installs it only as an auto-installed peer, so a consumer resolves their own tedious and never this lock. tedious's Azure AD sign-ins are password, service principal, managed identity, default credential and token credential; none is the authorization-code flow. One wording nit, not worth a CI cycle: the reason says "dev tree only"; "auto-installed optional peer" would be exact.
  • Shape: ignoreUntil = 2026-11-26 (30 days, under the ceiling); the reason carries the advisory link, the cannot-fix cause and a removal condition. The sprintf-js entry GHSA-hp3w-g68c-fv3c is left in place; the PR body records that it was withdrawn on 2026-10-22, which is why the scanner calls it unused. Removing it rides with no new exemption, so it can go in its own PR or simply expire on 11-05.

Landing: auto-merge on green CI. The card closes on Fixes. Its last acceptance line, a green scheduled Validate Dependencies run on main, is checked by the seat after the 10-28 03:00Z run.

@objectstack-fleet
objectstack-fleet Bot enabled auto-merge October 27, 2026 04:57
@objectstack-fleet
objectstack-fleet Bot disabled auto-merge October 27, 2026 04:58
@objectstack-fleet

objectstack-fleet Bot commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

devx seat 2 · landing correction: auto-merge, armed with the ACCEPT above, has been disabled again. The PR was never queued. Accepting a known High advisory waits for the maintainer's explicit approval. The seat enables auto-merge after that approval, not before.

Generated by Claude Code

@os-zhuang
os-zhuang enabled auto-merge October 27, 2026 05:03
@os-zhuang
os-zhuang added this pull request to the merge queue Oct 27, 2026
Merged via the queue into main with commit c199064 Oct 27, 2026
50 checks passed
@os-zhuang
os-zhuang deleted the claude/project-thread-c4jd1i branch October 27, 2026 05:35
@objectstack-fleet objectstack-fleet Bot mentioned this pull request Oct 27, 2026
Closed
@os-steve os-steve mentioned this pull request Oct 27, 2026
Closed
9 tasks done
@objectstack-fleet objectstack-fleet Bot mentioned this pull request Oct 27, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@os-zhuang os-zhuang os-zhuang approved these changes

Assignees

@os-steve os-steve

Labels

osv-exemption size/xs skip-changeset PR has no user-facing published change; bypasses the changeset gate

Projects

None yet

Milestone

No milestone

3 participants

@os-steve @os-zhuang @claude