Fix Coveo atomic lib CORS issue. Loads atomic module from EDS [ do NOT MREGE] - #2799
Fix Coveo atomic lib CORS issue. Loads atomic module from EDS [ do NOT MREGE]#2799Sivaramvt wants to merge 1 commit into
Conversation
|
Hello, I'm the AEM Code Sync Bot and I will run some actions to deploy your branch and validate page speed.
Commits
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| const externalTexts = await mapLimited([...externals], 10, async (path) => { | ||
| const text = await fetchText(CDN_HOST + path); | ||
| if (!text) return null; | ||
| const dest = join(dir, path); // path starts with /headless or /bueno | ||
| ensureDir(dirname(dest)); | ||
| await fs.writeFile(dest, text); | ||
| // headless variants pull in bueno via the same absolute scheme — capture those too. | ||
| [...text.matchAll(externalRe)].forEach((m) => externals.add(m[1])); | ||
| return path; | ||
| }); |
There was a problem hiding this comment.
Path traversal in headless/bueno mirroring (low severity, build-time only).
externalRe captures the URL path with [^"]*, which permits ../ sequences, and dest = join(dir, path) (line 128) has no containment check. If a fetched chunk ever referenced (or an attacker-controlled/MITM'd response injected) something like "/headless/v3.13.0/../../../../etc/foo.esm.js", path.join would happily resolve outside dir and write there.
Today this only matters if Coveo's CDN itself is compromised, which is a fairly high bar and would already let an attacker ship arbitrary JS into the vendored bundle — so this isn't exploitable by an untrusted third party in the site's normal request path. Still, since this writes files based on unvalidated remote content, it'd be worth a cheap defense-in-depth check, e.g.:
const dest = join(dir, path);
if (!dest.startsWith(`${dir}${sep}`)) throw new Error(`Refusing to write outside vendor dir: ${path}`);Not blocking given the build-time/trusted-CDN context, but flagging since it's easy to harden.
1 participant
Please provide the Jira Issue your PR is for.
Jira ID:
Test URLs:
Before: https://main--exlm--adobe-experience-league.aem.live
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live/en/browse?martech=off
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live/en/browse/analytics?martech=off
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live/en/docs?martech=off
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live/en/docs/analytics?martech=off
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live/en/docs/analytics/analyze/admin-overview/analytics-overview?martech=off
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live/en/events?martech=off
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live/en/playlists?martech=off
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live/en/playlists/acrobat-sign-perform-advanced-tasks-administrators?martech=off
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live/en/perspectives?martech=off
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live/en/perspectives/drive-success-with-executive-summary-dashboards?martech=off
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live/en/certification-home?martech=off
After: https://atomic-cors-issue--exlm--adobe-experience-league.aem.live/en/search?martech=off
AI Review Notes