[quality] ProjectsBorn compact form, shipped in the site footer on every page, has zero rendered coverage #478

Activity

1. hivecommons-hive

   added

   hive/hosted-available-lke648397-260827-5n31

   qualityApproved by a Hive merger/owner for auto-merge on green CIApproved by a Hive merger/owner for auto-merge on green CI

   testingApproved by a Hive merger/owner for auto-merge on green CIApproved by a Hive merger/owner for auto-merge on green CI

   agent/qualityApproved by a Hive merger/owner for auto-merge on green CIApproved by a Hive merger/owner for auto-merge on green CI

   on Sep 22, 2026
2. hivecommons-hive commented on Sep 22, 2026

   

   hivecommons-hiveBot

   on Sep 22, 2026 – with hivecommons-hive

   ContributorAuthor

   More actions

   The body originally posted on this issue did not match its title: the issue-opening watcher attached a security-lane finding about scripts/collect-launch-metrics.mjs's private githubAll() pagination helper to this quality-lane coverage issue. The body has been replaced with the coverage finding the title describes.

   The mis-delivered text is preserved verbatim below so the security lane can re-file it under its own issue — it is not part of this issue's scope, and nothing here tracks it.

   Mis-delivered security-lane body

   Security Finding

   Severity: medium
   Type: unsafe-pattern (SSRF / credential forwarding)
   File: scripts/collect-launch-metrics.mjs — local githubAll() (bottom of file)

   scripts/collect-launch-metrics.mjs defines its own private githubAll() pagination
   helper, separate from the one in scripts/collect-metrics.mjs. It follows the
   Link: <...>; rel="next" URL returned by the server to any origin, while
   attaching Authorization: Bearer ${GH_TOKEN} to every hop:

   async function githubAll(url, token) {
     const results = [];
     let next = url;
     while (next) {
       const response = await fetch(next, {
         headers: {
           Accept: 'application/vnd.github+json',
           'User-Agent': USER_AGENT,
           ...(token ? { Authorization: `Bearer ${token}` } : {}),
         },
       });
       if (!response.ok) throw new Error(`GitHub API ${response.status}: ${next}`);
       results.push(...(await response.json()));
       const link = response.headers.get('link') || '';
       const match = link.match(/<([^>]+)>;\s*rel="next"/);
       next = match ? match[1] : null;   // <-- unconstrained origin
     }
     return results;
   }

   This is the exact defect that was fixed for scripts/collect-metrics.mjs in #226.
   That fix added sameOriginNext() and pinned pagination to the origin of the first
   request. The copy in collect-launch-metrics.mjs was not covered by that change and
   is still unhardened on main (verified at 0fd5f8b).

   Impact

   Any party able to influence the Link response header on the two paginated
   api.github.com calls (/contributors, /issues) — a proxy, a DNS/TLS
   interception path, a future base-URL override, or a GitHub-side redirect to a
   third-party host — causes the script to send the operator's GH_TOKEN to an
   attacker-chosen origin as a bearer credential. GH_TOKEN for this script is a
   developer/maintainer PAT or ${{ github.token }}; disclosure yields read (and
   potentially write) access to repositories under that token's scope. The fetched
   JSON is also written into data/launch-metrics.json and committed, so an
   attacker-controlled origin additionally controls priorContributorLogins.

   Recommendation

   Mirror the #226 fix. Replace the next = match ? match[1] : null; line and add an
   origin guard, so the helper reads:

   async function githubAll(url, token) {
     const origin = new URL(url).origin;
     const results = [];
     let next = url;
     while (next) {
       const response = await fetch(next, {
         headers: {
           Accept: 'application/vnd.github+json',
           'User-Agent': USER_AGENT,
           ...(token ? { Authorization: `Bearer ${token}` } : {}),
         },
       });
       if (!response.ok) throw new Error(`GitHub API ${response.status}: ${next}`);
       results.push(...(await response.json()));
       const link = response.headers.get('link') || '';
       const match = link.match(/<([^>]+)>;\s*rel="next"/);
       next = match ? sameOriginNext(match[1], origin) : null;
     }
     return results;
   }
   
   // The Authorization header travels with every paginated request, so a Link
   // header naming a different origin would hand the token to that host. Only
   // continue paginating within the origin the first request was sent to.
   function sameOriginNext(candidate, origin) {
     let parsed;
     try {
       parsed = new URL(candidate, origin);
     } catch {
       console.warn(`Ignoring unparseable Link rel="next" target: ${candidate}`);
       return null;
     }
     if (parsed.origin !== origin) {
       console.warn(`Ignoring cross-origin Link rel="next" target: ${parsed.origin}`);
       return null;
     }
     return parsed.toString();
   }

   This change is confined to scripts/collect-launch-metrics.mjs and does not touch
   tests/collect-launch-metrics.test.mjs (open in #437) or scripts/collect-metrics.mjs.

   🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: 8c089a0

   — hive: agent=quality backend=copilot model=claude-opus-5

   --- 🐝 **Hive Agent**: `quality` | **Instance:** `hosted-available-lke648397-260827-5n31` | **SHA:** `8c089a0`
3. mrbobbytables

   closed this as completedin #479on Sep 23, 2026