Webpack Example

node,\n * which is already created when the page was loaded.\n *\n * @param {String} api_endpoint: API endpoint\n * @param {Object} parameters: search parameters\n * @param {String} projectName: name (slug) of the project\n * @return {Function} debounced function with debounce time of 500ms\n */" repo = "readthedocs/readthedocs-sphinx-search" url = "https://github.com/readthedocs/readthedocs-sphinx-search.git" [[case]] advisory = "GHSA-xgfm-fjx6-62mj" advisory_text = "readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects\n\n### Impact\n\nThis vulnerability could have allowed an attacker to include arbitrary HTML content in search results by having a user search a malicious project. This was due to our search client not correctly escaping all user content from search results. You can find more information in the [advisory published in our readthedocs.org repo](https://github.com/readthedocs/readthedocs.org/security/advisories/GHSA-qhqx-5j25-rv48).\n\nUsers of this extension should update to the 0.3.2 version, and trigger a new build.\n\nThis issue was discovered by a member of our team, and we have seen no signs that this vulnerability was exploited in the wild.\n\n### Patches\n\nThis issue has been patched in our 0.3.2 version. \n\n### References\n\n- https://github.com/readthedocs/readthedocs-sphinx-search/commit/8c6f6d01e88e72ef32ed0c220b6c19d1e1121c73\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@readthedocs.org](mailto:security@readthedocs.org) ([PGP](https://docs.readthedocs.io/page/security.html#pgp-key))" commit = "8c6f6d01e88e72ef32ed0c220b6c19d1e1121c73" cwe = "CWE-79" family = "output_encoding" function = "generateSingleResult" function_lines = [[262, 326]] id = "readthedocs-readthedocs-sphinx-search-885af7a7682d69e3" language = "javascript" method = "fix_site" parent = "1608743622df0883b785a2ce07c587f146f2102b" path = "sphinx_search/static/js/rtd_sphinx_search.js" post_fix = "const generateSingleResult = (resultData, projectName, id) => {\n let page_link = resultData.path;\n let page_title = resultData.title;\n let highlights = resultData.highlights;\n\n if (highlights.title.length) {\n page_title = markAsSafe(highlights.title[0]);\n }\n\n let h2_element = createDomNode(\"h2\", {class: \"search__result__title\"});\n setElementContent(h2_element, page_title);\n\n // Results can belong to different projects.\n // If the result isn't from the current project, add a note about it.\n const project_slug = resultData.project.slug\n if (projectName !== project_slug) {\n let subtitle = createDomNode(\"small\", {class: \"rtd_ui_search_subtitle\"});\n subtitle.innerText = ` (from project ${project_slug})`;\n h2_element.appendChild(subtitle);\n // If the result isn't from the current project,\n // then we create an absolute link to the page.\n page_link = `${resultData.domain}${page_link}`;\n }\n h2_element.appendChild(createDomNode(\"br\"))\n\n let a_element = createDomNode(\"a\", {href: page_link});\n a_element.appendChild(h2_element);\n\n let content = createDomNode(\"div\");\n content.appendChild(a_element);\n\n let separator = createDomNode(\"br\", {class: \"br-for-hits\"});\n for (let i = 0; i < resultData.blocks.length; ++i) {\n let block = resultData.blocks[i];\n let section = null;\n id += 1;\n if (block.type === \"section\") {\n section = get_section_html(\n block,\n page_link,\n id,\n );\n }\n\n if (section !== null) {\n content.appendChild(section);\n content.appendChild(separator);\n }\n }\n return content;\n};\n\n/**\n * Generate search suggestions list.\n *\n * @param {Object} data response data from the search backend\n * @param {String} projectName name (slug) of the project\n * @return {Object} a

node with class \"search__result__box\" with results\n */" pre_fix = "const generateSingleResult = (resultData, projectName, id) => {\n let page_link = resultData.path;\n let page_title = resultData.title;\n let highlights = resultData.highlights;\n\n if (highlights.title.length) {\n page_title = highlights.title[0];\n }\n\n let h2_element = createDomNode(\"h2\", {class: \"search__result__title\"});\n h2_element.innerHTML = page_title;\n\n // Results can belong to different projects.\n // If the result isn't from the current project, add a note about it.\n const project_slug = resultData.project.slug\n if (projectName !== project_slug) {\n let subtitle = createDomNode(\"small\", {class: \"rtd_ui_search_subtitle\"});\n subtitle.innerText = ` (from project ${project_slug})`;\n h2_element.appendChild(subtitle);\n // If the result isn't from the current project,\n // then we create an absolute link to the page.\n page_link = `${resultData.domain}${page_link}`;\n }\n h2_element.appendChild(createDomNode(\"br\"))\n\n let a_element = createDomNode(\"a\", {href: page_link});\n a_element.appendChild(h2_element);\n\n let content = createDomNode(\"div\");\n content.appendChild(a_element);\n\n let separator = createDomNode(\"br\", {class: \"br-for-hits\"});\n for (let i = 0; i < resultData.blocks.length; ++i) {\n let block = resultData.blocks[i];\n let section = null;\n id += 1;\n if (block.type === \"section\") {\n section = get_section_html(\n block,\n page_link,\n id,\n );\n } else if (block.type === \"domain\") {\n section = get_domain_html(\n block,\n page_link,\n id,\n );\n }\n\n if (section !== null) {\n content.appendChild(section);\n content.appendChild(separator);\n }\n }\n return content;\n};\n\n/**\n * Generate search suggestions list.\n *\n * @param {Object} data response data from the search backend\n * @param {String} projectName name (slug) of the project\n * @return {Object} a

node with class \"search__result__box\" with results\n */" repo = "readthedocs/readthedocs-sphinx-search" url = "https://github.com/readthedocs/readthedocs-sphinx-search.git" [[case]] advisory = "GHSA-xgfm-fjx6-62mj" advisory_text = "readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects\n\n### Impact\n\nThis vulnerability could have allowed an attacker to include arbitrary HTML content in search results by having a user search a malicious project. This was due to our search client not correctly escaping all user content from search results. You can find more information in the [advisory published in our readthedocs.org repo](https://github.com/readthedocs/readthedocs.org/security/advisories/GHSA-qhqx-5j25-rv48).\n\nUsers of this extension should update to the 0.3.2 version, and trigger a new build.\n\nThis issue was discovered by a member of our team, and we have seen no signs that this vulnerability was exploited in the wild.\n\n### Patches\n\nThis issue has been patched in our 0.3.2 version. \n\n### References\n\n- https://github.com/readthedocs/readthedocs-sphinx-search/commit/8c6f6d01e88e72ef32ed0c220b6c19d1e1121c73\n\n### For more information\n\nIf you have any questions or comments about this advisory, email us at [security@readthedocs.org](mailto:security@readthedocs.org) ([PGP](https://docs.readthedocs.io/page/security.html#pgp-key))" commit = "8c6f6d01e88e72ef32ed0c220b6c19d1e1121c73" cwe = "CWE-79" family = "output_encoding" function = "get_section_html" function_lines = [[167, 202]] id = "readthedocs-readthedocs-sphinx-search-eb34d0b4ee01b206" language = "javascript" method = "fix_site" parent = "1608743622df0883b785a2ce07c587f146f2102b" path = "sphinx_search/static/js/rtd_sphinx_search.js" post_fix = "const get_section_html = (sectionData, page_link, id) => {\n let section_subheading = sectionData.title;\n let highlights = sectionData.highlights;\n if (highlights.title.length) {\n section_subheading = markAsSafe(highlights.title[0]);\n }\n\n let section_content = [\n sectionData.content.substring(0, MAX_SUBSTRING_LIMIT) + \" ...\"\n ];\n\n if (highlights.content.length) {\n let highlight_content = highlights.content;\n section_content = [];\n for (\n let j = 0;\n j < highlight_content.length && j < MAX_SECTION_RESULTS;\n ++j\n ) {\n section_content.push(markAsSafe(\"... \" + highlight_content[j] + \" ...\"));\n }\n }\n\n let section_link = `${page_link}#${sectionData.id}`;\n let section_id = \"hit__\" + id;\n return buildSection(section_id, section_subheading, section_link, section_content);\n};\n\n\n/**\n * Generate search results for a single page.\n *\n * This has the form:\n *

\n * \n *

\n * {title}\n * {subtitle}\n *
\n *

\n * \n *\n * \n * {section}\n * \n *
\n *\n * \n * {section}\n * \n *
\n *

\n *\n * @param {Object} resultData search results of a page\n * @param {String} projectName\n * @param {Number} id from the last section\n * @return {Object} a

node with the results of a single page\n */" pre_fix = "const get_section_html = (sectionData, page_link, id) => {\n let section_subheading = sectionData.title;\n let highlights = sectionData.highlights;\n if (highlights.title.length) {\n section_subheading = highlights.title[0];\n }\n\n let section_content = [\n sectionData.content.substring(0, MAX_SUBSTRING_LIMIT) + \" ...\"\n ];\n\n if (highlights.content.length) {\n let highlight_content = highlights.content;\n section_content = [];\n for (\n let j = 0;\n j < highlight_content.length && j < MAX_SECTION_RESULTS;\n ++j\n ) {\n section_content.push(\"... \" + highlight_content[j] + \" ...\");\n }\n }\n\n let section_link = `${page_link}#${sectionData.id}`;\n let section_id = \"hit__\" + id;\n return buildSection(section_id, section_subheading, section_link, section_content);\n};\n\n/**\n * Generate and return html structure\n * for a sphinx domain result.\n *\n * @param {Object} domainData object containing the result data\n * @param {String} page_link link of the main page. It is used to construct the section link\n * @param {Number} id to be used in for this section\n */" repo = "readthedocs/readthedocs-sphinx-search" url = "https://github.com/readthedocs/readthedocs-sphinx-search.git" [[case]] advisory = "GHSA-f2jw-pr2c-9x96" advisory_text = "Code injection in @rkesters/gnuplot\n\n@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands." commit = "23671d4d3d28570fb19a936a6328bfac742410de" cwe = "CWE-77" family = "injection" function = "plot" function_lines = [[361, 380]] id = "rkesters-gnuplot-d931b1756db47945" language = "typescript" method = "fix_site" parent = "6383ca819bd5c8afc590348eeacdfbe08a7ace66" path = "src/index.ts" post_fix = "export function plot(options: PlotOptions): Promise | void {\n const f = validFilename.path(options.filename);\n if (f !== options.filename) {\n throw new Error(`invalid filename of '${options.filename}' -- ${f}`);\n }\n if (options.finish) {\n return plotCallack(options);\n }\n\n // Promise\n return new Promise((resolve, reject) => {\n plotCallack({\n ...options,\n finish: (error) => {\n if (error) {\n return reject(error);\n }\n resolve(true);\n },\n });\n });\n}\n\nexport default plot;" pre_fix = "export function plot(options: PlotOptions): Promise | void {\n if (options.finish) {\n return plotCallack(options);\n }\n\n // Promise\n return new Promise((resolve, reject) => {\n plotCallack({\n ...options,\n finish: (error) => {\n if (error) {\n return reject(error);\n }\n resolve(true);\n },\n });\n });\n}\n\nexport default plot;" repo = "rkesters/gnuplot" url = "https://github.com/rkesters/gnuplot.git" [[case]] advisory = "GHSA-jw6x-4h8h-569x" advisory_text = "Roots Soil plugin vulnerable to Cross-site Scripting\n\nA vulnerability, which was classified as problematic, was found in Roots soil Plugin up to 4.1.0. Affected is the function language_attributes of the file src/Modules/CleanUpModule.php. The manipulation of the argument language leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 4.1.1 is able to address this issue. The name of the patch is 0c9151e00ab047da253e5cdbfccb204dd423269d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215904." commit = "0c9151e00ab047da253e5cdbfccb204dd423269d" cwe = "CWE-79" family = "output_encoding" function = "languageAttributes" function_lines = [[244, 268]] id = "roots-soil-8fa3ef8a493b8d64" language = "php" method = "fix_site" parent = "fb58ad9c2597b0f91b4cc3c56383236bc2bf8341" path = "src/Modules/CleanUpModule.php" post_fix = " public function languageAttributes()\n {\n $attributes = [];\n\n if (is_rtl()) {\n $attributes[] = 'dir=\"rtl\"';\n }\n\n $lang = esc_attr(get_bloginfo('language'));\n\n if ($lang) {\n $attributes[] = \"lang=\\\"{$lang}\\\"\";\n }\n\n return implode(' ', $attributes);\n }\n\n /**\n * Clean up output of stylesheet tags\n *\n * @internal Used by `style_loader_tag`\n *\n * @param string $html\n * @return string\n */" pre_fix = " public function languageAttributes()\n {\n $attributes = [];\n\n if (is_rtl()) {\n $attributes[] = 'dir=\"rtl\"';\n }\n\n $lang = get_bloginfo('language');\n\n if ($lang) {\n $attributes[] = \"lang=\\\"{$lang}\\\"\";\n }\n\n return implode(' ', $attributes);\n }\n\n /**\n * Clean up output of stylesheet tags\n *\n * @internal Used by `style_loader_tag`\n *\n * @param string $html\n * @return string\n */" repo = "roots/soil" url = "https://github.com/roots/soil.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "store" function_lines = [[195, 207]] id = "shopperlabs-shopper-02254beed509364c" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Components/Products/Form/Inventory.php" post_fix = " public function store(): void\n {\n $this->authorize('edit_products');\n\n $this->product->update($this->form->getState());\n\n $this->dispatch('product.updated');\n\n Notification::make()\n ->title(__('shopper::pages/products.notifications.stock_update'))\n ->success()\n ->send();\n }\n\n #[On('inventory.updated')]" pre_fix = " public function store(): void\n {\n $this->product->update($this->form->getState());\n\n $this->dispatch('product.updated');\n\n Notification::make()\n ->title(__('shopper::pages/products.notifications.stock_update'))\n ->success()\n ->send();\n }\n\n #[On('inventory.updated')]" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "table" function_lines = [[36, 123]] id = "shopperlabs-shopper-047e62abed0b91fa" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Components/Customers/Orders.php" post_fix = " public function table(Table $table): Table\n {\n return $table\n ->query(\n resolve(Order::class)::query()\n ->with([\n 'items',\n 'items.product',\n 'items.product.media',\n 'zone',\n 'channel',\n ])\n ->whereBelongsTo($this->customer, 'customer')\n ->latest()\n )\n ->columns([\n TextColumn::make('number')\n ->label('#')\n ->searchable()\n ->extraAttributes(['class' => 'uppercase'])\n ->sortable(),\n TextColumn::make('created_at')\n ->label(__('shopper::words.date'))\n ->date()\n ->sortable(),\n ViewColumn::make('status')\n ->label(__('shopper::forms.label.status'))\n ->view('shopper::livewire.tables.cells.orders.status')\n ->extraCellAttributes(['class' => 'whitespace-nowrap']),\n TextColumn::make('total')\n ->label(__('shopper::forms.label.price_amount'))\n ->state(fn (Order $record): string => shopper_money_format(\n amount: $record->total(),\n currency: $record->currency_code\n )),\n TextColumn::make('id')\n ->label(__('shopper::words.purchased'))\n ->formatStateUsing(fn (Order $record): View => view(\n 'shopper::livewire.tables.cells.orders.purchased',\n ['order' => $record]\n )),\n TextColumn::make('zone.name')\n ->label(__('shopper::pages/settings/zones.single'))\n ->searchable()\n ->sortable()\n ->toggleable()\n ->toggledHiddenByDefault(),\n TextColumn::make('channel.name')\n ->label(__('shopper::pages/settings/channels.single'))\n ->searchable()\n ->sortable()\n ->toggleable()\n ->toggledHiddenByDefault(),\n ])\n ->filters([\n SelectFilter::make('status')\n ->label(__('shopper::forms.label.status'))\n ->options(OrderStatus::class)\n ->multiple(),\n SelectFilter::make('payment_status')\n ->label(__('shopper::forms.label.payment_status'))\n ->options(PaymentStatus::class)\n ->multiple(),\n SelectFilter::make('zone_id')\n ->label(__('shopper::pages/settings/zones.single'))\n ->relationship('zone', 'name')\n ->searchable()\n ->preload(),\n SelectFilter::make('channel_id')\n ->label(__('shopper::pages/settings/channels.single'))\n ->relationship('channel', 'name')\n ->searchable()\n ->preload(),\n ])\n ->recordActions([\n Action::make('view')\n ->label(__('shopper::words.details'))\n ->icon(Untitledui::Eye)\n ->iconButton()\n ->action(fn (Order $record) => $this->redirectRoute(\n name: 'shopper.orders.detail',\n parameters: ['order' => $record],\n navigate: true\n )),\n ])\n ->emptyState(view('shopper::livewire.tables.empty-states.orders'));\n }\n" pre_fix = " public function table(Table $table): Table\n {\n return $table\n ->query(\n resolve(Order::class)::query()\n ->with([\n 'items',\n 'items.product',\n 'items.product.media',\n 'zone',\n 'channel',\n ])\n ->whereBelongsTo($this->customer, 'customer')\n ->latest()\n )\n ->columns([\n TextColumn::make('number')\n ->label('#')\n ->searchable()\n ->extraAttributes(['class' => 'uppercase'])\n ->sortable(),\n TextColumn::make('created_at')\n ->label(__('shopper::words.date'))\n ->date()\n ->sortable(),\n ViewColumn::make('status')\n ->label(__('shopper::forms.label.status'))\n ->view('shopper::livewire.tables.cells.orders.status')\n ->extraCellAttributes(['class' => 'whitespace-nowrap']),\n TextColumn::make('total')\n ->label(__('shopper::forms.label.price_amount'))\n ->state(fn (Order $record): string => shopper_money_format(\n amount: $record->total(),\n currency: $record->currency_code\n )),\n TextColumn::make('id')\n ->label(__('shopper::words.purchased'))\n ->formatStateUsing(fn (Order $record): View => view(\n 'shopper::livewire.tables.cells.orders.purchased',\n ['order' => $record]\n )),\n TextColumn::make('zone.name')\n ->label(__('shopper::pages/settings/zones.single'))\n ->searchable()\n ->sortable()\n ->toggleable()\n ->toggledHiddenByDefault(),\n TextColumn::make('channel.name')\n ->label(__('shopper::pages/settings/channels.single'))\n ->searchable()\n ->sortable()\n ->toggleable()\n ->toggledHiddenByDefault(),\n ])\n ->filters([\n SelectFilter::make('status')\n ->label(__('shopper::forms.label.status'))\n ->options(\\Shopper\\Core\\Enum\\OrderStatus::class)\n ->multiple(),\n SelectFilter::make('payment_status')\n ->label(__('shopper::forms.label.payment_status'))\n ->options(\\Shopper\\Core\\Enum\\PaymentStatus::class)\n ->multiple(),\n SelectFilter::make('zone_id')\n ->label(__('shopper::pages/settings/zones.single'))\n ->relationship('zone', 'name')\n ->searchable()\n ->preload(),\n SelectFilter::make('channel_id')\n ->label(__('shopper::pages/settings/channels.single'))\n ->relationship('channel', 'name')\n ->searchable()\n ->preload(),\n ])\n ->recordActions([\n Action::make('view')\n ->label(__('shopper::words.details'))\n ->icon(Untitledui::Eye)\n ->iconButton()\n ->action(fn (Order $record) => $this->redirectRoute(\n name: 'shopper.orders.detail',\n parameters: ['order' => $record],\n navigate: true\n )),\n ])\n ->emptyState(view('shopper::livewire.tables.empty-states.orders'));\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "leaveNotes" function_lines = [[24, 37]] id = "shopperlabs-shopper-052f88a347caf2eb" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Components/Orders/OrderNotes.php" post_fix = " public function leaveNotes(): void\n {\n $this->authorize('edit_orders');\n\n $this->validate();\n\n $this->order->update(['notes' => $this->notes]);\n\n event(new OrderNoteAdded($this->order));\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.note_added'))\n ->success()\n ->send();\n }\n" pre_fix = " public function leaveNotes(): void\n {\n $this->validate();\n\n $this->order->update(['notes' => $this->notes]);\n\n event(new OrderNoteAdded($this->order));\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.note_added'))\n ->success()\n ->send();\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "table" function_lines = [[77, 118]] id = "shopperlabs-shopper-064f0b5f8937aae5" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Settings/Team/Index.php" post_fix = " public function table(Table $table): Table\n {\n $userModel = config('auth.providers.users.model');\n\n return $table\n ->query($userModel::query()->with('roles')->scopes('administrators'))\n ->columns([\n ViewColumn::make('full_name')\n ->label(__('shopper::forms.label.full_name'))\n ->view('shopper::livewire.tables.cells.administrators.name'),\n TextColumn::make('email')\n ->label(__('shopper::forms.label.email'))\n ->icon(function (ShopperUser $record): BackedEnum {\n /** @var Model&ShopperUser $record */\n return $record->email_verified_at ? Untitledui::CheckVerified02 : Untitledui::AlertCircle;\n })\n ->iconColor(function (ShopperUser $record): string {\n /** @var Model&ShopperUser $record */\n return $record->email_verified_at ? 'success' : 'danger';\n }),\n TextColumn::make('roles_label')\n ->label(__('shopper::forms.label.role'))\n ->badge(),\n TextColumn::make('id')\n ->label(__('shopper::forms.label.access'))\n ->color('gray')\n ->formatStateUsing(\n fn (ShopperUser $record): string|array|null => $record->hasRole(config('shopper.admin.roles.admin'))\n ? __('shopper::words.full')\n : __('shopper::words.limited')\n ),\n ])\n ->recordActions([\n DeleteAction::make('delete')\n ->icon(Untitledui::Trash03)\n ->iconButton()\n ->label(__('shopper::forms.actions.delete'))\n ->authorize('access_setting')\n ->visible(fn (ShopperUser $record): bool => shopper()->auth()->user()->isAdmin() && ! $record->isAdmin()) // @phpstan-ignore-line\n ->successNotificationTitle(__('shopper::notifications.users_roles.admin_deleted')),\n ]);\n }\n" pre_fix = " public function table(Table $table): Table\n {\n $userModel = config('auth.providers.users.model');\n\n return $table\n ->query($userModel::query()->with('roles')->scopes('administrators'))\n ->columns([\n ViewColumn::make('full_name')\n ->label(__('shopper::forms.label.full_name'))\n ->view('shopper::livewire.tables.cells.administrators.name'),\n TextColumn::make('email')\n ->label(__('shopper::forms.label.email'))\n ->icon(function (ShopperUser $record): BackedEnum {\n /** @var Model&ShopperUser $record */\n return $record->email_verified_at ? Untitledui::CheckVerified02 : Untitledui::AlertCircle;\n })\n ->iconColor(function (ShopperUser $record): string {\n /** @var Model&ShopperUser $record */\n return $record->email_verified_at ? 'success' : 'danger';\n }),\n TextColumn::make('roles_label')\n ->label(__('shopper::forms.label.role'))\n ->badge(),\n TextColumn::make('id')\n ->label(__('shopper::forms.label.access'))\n ->color('gray')\n ->formatStateUsing(\n fn (ShopperUser $record): string|array|null => $record->hasRole(config('shopper.admin.roles.admin'))\n ? __('shopper::words.full')\n : __('shopper::words.limited')\n ),\n ])\n ->recordActions([\n DeleteAction::make('delete')\n ->icon(Untitledui::Trash03)\n ->iconButton()\n ->label(__('shopper::forms.actions.delete'))\n ->visible(fn (ShopperUser $record): bool => shopper()->auth()->user()->isAdmin() && ! $record->isAdmin()) // @phpstan-ignore-line\n ->successNotificationTitle(__('shopper::notifications.users_roles.admin_deleted')),\n ]);\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "validate" function_lines = [[15, 84]] id = "shopperlabs-shopper-0d7758a9a7d45a31" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/cart/src/Discounts/DiscountValidator.php" post_fix = " public function validate(Discount $discount, CartPipelineContext $context): DiscountValidationResult\n {\n if (! $discount->is_active) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.not_active'));\n }\n\n if ($discount->start_at->isFuture()) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.not_started'));\n }\n\n if ($discount->end_at !== null && $discount->end_at->isPast()) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.expired'));\n }\n\n if ($discount->hasReachedLimit()) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.usage_limit_reached'));\n }\n\n if ($discount->usage_limit_per_user && $context->cart->customer_id) {\n $alreadyRedeemed = resolve(OrderContract::class)::query()\n ->where('discount_id', $discount->id)\n ->where('customer_id', $context->cart->customer_id)\n ->exists();\n\n if ($alreadyRedeemed) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.already_used'));\n }\n }\n\n if ($discount->eligibility === DiscountEligibility::Customers->value) {\n if (! $context->cart->customer_id) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.requires_login'));\n }\n\n $isEligible = $discount->items()\n ->where('condition', DiscountCondition::Eligibility)\n ->where('discountable_type', config('auth.providers.users.model'))\n ->where('discountable_id', $context->cart->customer_id)\n ->exists();\n\n if (! $isEligible) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.customer_not_eligible'));\n }\n }\n\n if ($discount->zone_id && $context->cart->zone_id !== $discount->zone_id) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.not_available_in_zone'));\n }\n\n if ($discount->min_required === DiscountRequirement::Price->value) {\n $minAmount = (int) $discount->min_required_value;\n\n if ($context->subtotal < $minAmount) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.min_amount_not_reached'));\n }\n }\n\n if ($discount->min_required === DiscountRequirement::Quantity->value) {\n $totalQuantity = $context->cart->lines->sum('quantity');\n $minQuantity = (int) $discount->min_required_value;\n\n if ($totalQuantity < $minQuantity) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.min_quantity_not_reached'));\n }\n }\n\n return new DiscountValidationResult(true);\n }\n}" pre_fix = " public function validate(Discount $discount, CartPipelineContext $context): DiscountValidationResult\n {\n if (! $discount->is_active) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.not_active'));\n }\n\n if ($discount->start_at->isFuture()) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.not_started'));\n }\n\n if ($discount->end_at !== null && $discount->end_at->isPast()) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.expired'));\n }\n\n if ($discount->hasReachedLimit()) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.usage_limit_reached'));\n }\n\n if ($discount->usage_limit_per_user && $context->cart->customer_id) {\n $userUses = $discount->items()\n ->where('condition', DiscountCondition::Eligibility)\n ->where('discountable_type', config('auth.providers.users.model'))\n ->where('discountable_id', $context->cart->customer_id)\n ->value('total_use') ?? 0;\n\n if ($userUses > 0) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.already_used'));\n }\n }\n\n if ($discount->eligibility === DiscountEligibility::Customers->value) {\n if (! $context->cart->customer_id) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.requires_login'));\n }\n\n $isEligible = $discount->items()\n ->where('condition', DiscountCondition::Eligibility)\n ->where('discountable_type', config('auth.providers.users.model'))\n ->where('discountable_id', $context->cart->customer_id)\n ->exists();\n\n if (! $isEligible) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.customer_not_eligible'));\n }\n }\n\n if ($discount->zone_id && $context->cart->zone_id !== $discount->zone_id) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.not_available_in_zone'));\n }\n\n if ($discount->min_required === DiscountRequirement::Price->value) {\n $minAmount = (int) $discount->min_required_value;\n\n if ($context->subtotal < $minAmount) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.min_amount_not_reached'));\n }\n }\n\n if ($discount->min_required === DiscountRequirement::Quantity->value) {\n $totalQuantity = $context->cart->lines->sum('quantity');\n $minQuantity = (int) $discount->min_required_value;\n\n if ($totalQuantity < $minQuantity) {\n return new DiscountValidationResult(false, __('shopper-cart::messages.discount.min_quantity_not_reached'));\n }\n }\n\n return new DiscountValidationResult(true);\n }\n}" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "markCompleteAction" function_lines = [[114, 133]] id = "shopperlabs-shopper-0fd6e8d87dd0ed82" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Order/Detail.php" post_fix = " public function markCompleteAction(): Action\n {\n return Action::make('markComplete')\n ->label(__('shopper::forms.actions.mark_complete'))\n ->authorize('edit_orders')\n ->visible($this->order->isProcessing() && $this->order->isPaid())\n ->action(function (): void {\n $this->order->update(['status' => OrderStatus::Completed]);\n\n $this->order->refresh();\n $this->dispatch('order.updated');\n\n event(new OrderCompleted($this->order));\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.completed'))\n ->success()\n ->send();\n });\n }\n" pre_fix = " public function markCompleteAction(): Action\n {\n return Action::make('markComplete')\n ->label(__('shopper::forms.actions.mark_complete'))\n ->visible($this->order->isProcessing() && $this->order->isPaid())\n ->action(function (): void {\n $this->order->update(['status' => OrderStatus::Completed]);\n\n $this->order->refresh();\n $this->dispatch('order.updated');\n\n event(new OrderCompleted($this->order));\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.completed'))\n ->success()\n ->send();\n });\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "save" function_lines = [[199, 210]] id = "shopperlabs-shopper-1112cc61420816ff" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php" post_fix = " public function save(): void\n {\n $this->authorize('access_setting');\n\n $this->role->update($this->form->getState());\n\n Notification::make()\n ->body(__('shopper::notifications.update', ['item' => __('shopper::pages/settings/staff.role')]))\n ->success()\n ->send();\n }\n" pre_fix = " public function save(): void\n {\n $this->authorize('view_users');\n\n $this->role->update($this->form->getState());\n\n Notification::make()\n ->body(__('shopper::notifications.update', ['item' => __('shopper::pages/settings/staff.role')]))\n ->success()\n ->send();\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "execute" function_lines = [[28, 95]] id = "shopperlabs-shopper-137aa7e49095c9df" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/cart/src/Actions/CreateOrderFromCartAction.php" post_fix = " public function execute(Cart $cart): Order\n {\n return DB::transaction(function () use ($cart): Order {\n /** @var Cart $cart */\n $cart = Cart::query()->lockForUpdate()->findOrFail($cart->id);\n\n if ($cart->isCompleted()) {\n throw new CartCompletedException;\n }\n\n $discount = $this->reserveDiscount($cart);\n\n $context = $this->cartManager->calculate($cart);\n\n $shippingAddress = $this->createOrderAddress($cart->shippingAddress(), $cart->customer_id);\n $billingAddress = $this->createOrderAddress($cart->billingAddress(), $cart->customer_id);\n\n $order = resolve(OrderContract::class)::query()->create([\n 'number' => generate_number(),\n 'price_amount' => $context->total,\n 'tax_amount' => $context->taxTotal,\n 'currency_code' => $cart->currency_code,\n 'customer_id' => $cart->customer_id,\n 'channel_id' => $cart->channel_id,\n 'zone_id' => $cart->zone_id,\n 'shipping_address_id' => $shippingAddress?->id,\n 'billing_address_id' => $billingAddress?->id,\n 'discount_id' => $discount?->id,\n 'discount_code' => $discount?->code,\n 'discount_type' => $discount?->type->value,\n 'discount_value_at_apply' => $discount?->value,\n 'discount_currency_code' => $discount !== null ? $cart->currency_code : null,\n ]);\n\n $cart->lines->loadMorph('purchasable', [\n ProductVariantModel::class => ['product'],\n ]);\n\n foreach ($cart->lines as $line) {\n $discountAmount = $line->adjustments->sum('amount');\n $purchasable = $line->purchasable;\n\n $order->items()->create([\n 'name' => $this->resolveItemName($purchasable),\n 'sku' => $purchasable->sku ?? '',\n 'quantity' => $line->quantity,\n 'unit_price_amount' => $line->unit_price_amount,\n 'discount_amount' => $discountAmount,\n 'product_type' => $line->purchasable_type,\n 'product_id' => $line->purchasable_id,\n ]);\n }\n\n $this->createOrderTaxLines->execute($order);\n\n $order->refresh();\n\n $cart->update(['completed_at' => now()]);\n\n CartCompleted::dispatch($cart, $order);\n\n return $order;\n });\n }\n" pre_fix = " public function execute(Cart $cart): Order\n {\n return DB::transaction(function () use ($cart): Order {\n /** @var Cart $cart */\n $cart = Cart::query()->lockForUpdate()->findOrFail($cart->id);\n\n if ($cart->isCompleted()) {\n throw new CartCompletedException;\n }\n\n $context = $this->cartManager->calculate($cart);\n\n $shippingAddress = $this->createOrderAddress($cart->shippingAddress(), $cart->customer_id);\n $billingAddress = $this->createOrderAddress($cart->billingAddress(), $cart->customer_id);\n\n $order = Order::query()->create([\n 'number' => generate_number(),\n 'price_amount' => $context->total,\n 'tax_amount' => $context->taxTotal,\n 'currency_code' => $cart->currency_code,\n 'customer_id' => $cart->customer_id,\n 'channel_id' => $cart->channel_id,\n 'zone_id' => $cart->zone_id,\n 'shipping_address_id' => $shippingAddress?->id,\n 'billing_address_id' => $billingAddress?->id,\n ]);\n\n $cart->lines->loadMorph('purchasable', [\n ProductVariantModel::class => ['product'],\n ]);\n\n foreach ($cart->lines as $line) {\n $discountAmount = $line->adjustments->sum('amount');\n $purchasable = $line->purchasable;\n\n $order->items()->create([\n 'name' => $this->resolveItemName($purchasable),\n 'sku' => $purchasable->sku ?? '',\n 'quantity' => $line->quantity,\n 'unit_price_amount' => $line->unit_price_amount,\n 'discount_amount' => $discountAmount,\n 'product_type' => $line->purchasable_type,\n 'product_id' => $line->purchasable_id,\n ]);\n }\n\n $this->createOrderTaxLines->execute($order);\n\n $order->refresh();\n\n if ($cart->coupon_code) {\n Discount::query()\n ->where('code', $cart->coupon_code)\n ->where(function ($query): void {\n $query->whereNull('usage_limit')\n ->orWhereColumn('total_use', '<', 'usage_limit');\n })\n ->increment('total_use');\n }\n\n $cart->update(['completed_at' => now()]);\n\n CartCompleted::dispatch($cart, $order);\n\n return $order;\n });\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "store" function_lines = [[213, 231]] id = "shopperlabs-shopper-13fdb238d0d8e573" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Components/Products/Form/Edit.php" post_fix = " public function store(): void\n {\n $this->authorize('edit_products');\n\n $this->validate();\n\n $this->product = app()->call(UpdateProductAction::class, [\n 'values' => $this->form->getState(),\n 'product' => $this->product,\n ]);\n\n $this->form->model($this->product)->saveRelationships();\n\n $this->dispatch('product.updated');\n\n Notification::make()\n ->title(__('shopper::notifications.update', ['item' => __('shopper::pages/products.single')]))\n ->success()\n ->send();\n }\n" pre_fix = " public function store(): void\n {\n $this->validate();\n\n $this->product = app()->call(UpdateProductAction::class, [\n 'values' => $this->form->getState(),\n 'product' => $this->product,\n ]);\n\n $this->form->model($this->product)->saveRelationships();\n\n $this->dispatch('product.updated');\n\n Notification::make()\n ->title(__('shopper::notifications.update', ['item' => __('shopper::pages/products.single')]))\n ->success()\n ->send();\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "capturePaymentAction" function_lines = [[134, 178]] id = "shopperlabs-shopper-22487ec06a8cf50a" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Order/Detail.php" post_fix = " public function capturePaymentAction(): Action\n {\n return Action::make('capturePayment')\n ->label(__('shopper::forms.actions.capture_payment'))\n ->icon(Untitledui::CreditCardDown)\n ->authorize('edit_orders')\n ->visible($this->order->isPaymentAuthorized())\n ->requiresConfirmation()\n ->modalIcon(Untitledui::CreditCardDown)\n ->modalHeading(__('shopper::pages/orders.modals.capture_heading', ['number' => $this->order->number]))\n ->modalDescription(__('shopper::pages/orders.modals.capture_notice'))\n ->modalSubmitActionLabel(__('shopper::forms.actions.confirm'))\n ->action(function (): void {\n $service = resolve(PaymentProcessingService::class);\n $reference = $service->getLatestReference($this->order);\n\n if (! $reference) {\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.capture_no_reference'))\n ->danger()\n ->send();\n\n return;\n }\n\n $result = $service->capture($this->order, $reference);\n\n if (! $result->success) {\n Notification::make()\n ->title($result->message ?? __('shopper::pages/orders.notifications.capture_failed'))\n ->danger()\n ->send();\n\n return;\n }\n\n $this->order->refresh();\n $this->dispatch('order.updated');\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.captured'))\n ->success()\n ->send();\n });\n }\n" pre_fix = " public function capturePaymentAction(): Action\n {\n return Action::make('capturePayment')\n ->label(__('shopper::forms.actions.capture_payment'))\n ->icon(Untitledui::CreditCardDown)\n ->visible($this->order->isPaymentAuthorized())\n ->requiresConfirmation()\n ->modalIcon(Untitledui::CreditCardDown)\n ->modalHeading(__('shopper::pages/orders.modals.capture_heading', ['number' => $this->order->number]))\n ->modalDescription(__('shopper::pages/orders.modals.capture_notice'))\n ->modalSubmitActionLabel(__('shopper::forms.actions.confirm'))\n ->action(function (): void {\n $service = resolve(PaymentProcessingService::class);\n $reference = $service->getLatestReference($this->order);\n\n if (! $reference) {\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.capture_no_reference'))\n ->danger()\n ->send();\n\n return;\n }\n\n $result = $service->capture($this->order, $reference);\n\n if (! $result->success) {\n Notification::make()\n ->title($result->message ?? __('shopper::pages/orders.notifications.capture_failed'))\n ->danger()\n ->send();\n\n return;\n }\n\n $this->order->refresh();\n $this->dispatch('order.updated');\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.captured'))\n ->success()\n ->send();\n });\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "table" function_lines = [[98, 213]] id = "shopperlabs-shopper-2405022067cc6870" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Order/Shipments.php" post_fix = " public function table(Table $table): Table\n {\n return $table\n ->query(\n OrderShipping::query()\n ->with(['order', 'carrier', 'items', 'events'])\n ->latest()\n )\n ->modifyQueryUsing($this->modifyQueryWithActiveTab(...))\n ->columns([\n TextColumn::make('id')\n ->label(__('shopper::pages/orders.shipment_id'))\n ->formatStateUsing(fn (OrderShipping $record): string => 'SHP-'.$record->id)\n ->searchable()\n ->sortable(),\n ViewColumn::make('shipment_event')\n ->label(__('shopper::pages/orders.shipment_event'))\n ->view('shopper::livewire.tables.cells.orders.shipment-stepper'),\n TextColumn::make('status')\n ->label(__('shopper::forms.label.status'))\n ->badge()\n ->color(fn (OrderShipping $record): ?string => $record->status?->getColor())\n ->icon(fn (OrderShipping $record): ?string => $record->status?->getIcon())\n ->formatStateUsing(fn (OrderShipping $record): string => $record->status?->getLabel() ?? '—'),\n TextColumn::make('shipped_at')\n ->label(__('shopper::forms.label.shipped_at'))\n ->date()\n ->sortable(),\n TextColumn::make('order.number')\n ->label(__('shopper::pages/orders.order_number'))\n ->searchable()\n ->sortable()\n ->url(fn (OrderShipping $record): string => route('shopper.orders.detail', $record->order)),\n ViewColumn::make('carrier')\n ->label(__('shopper::pages/orders.carrier_service'))\n ->view('shopper::livewire.tables.cells.orders.shipment-carrier'),\n ])\n ->recordActions([\n Action::make('markDelivered')\n ->label(__('shopper::forms.actions.mark_delivered'))\n ->icon(Untitledui::PackageCheck)\n ->color('success')\n ->authorize('edit_orders')\n ->visible(fn (OrderShipping $record): bool => $record->canBeDelivered())\n ->requiresConfirmation()\n ->action(function (OrderShipping $record): void {\n (new MarkShipmentDeliveredAction)->execute($record);\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.shipment_delivered'))\n ->success()\n ->send();\n }),\n Action::make('edit')\n ->label(__('shopper::forms.actions.edit'))\n ->icon(Untitledui::Edit03)\n ->iconButton()\n ->authorize('edit_orders')\n ->modalWidth(Width::Large)\n ->fillForm(fn (OrderShipping $record): array => [\n 'carrier_id' => $record->carrier_id,\n 'tracking_number' => $record->tracking_number,\n 'tracking_url' => $record->tracking_url,\n ])\n ->schema([\n Select::make('carrier_id')\n ->label(__('shopper::pages/orders.carrier_service'))\n ->options(fn (): array => resolve(CarrierRateService::class)->getCarrierSelectOptions())\n ->native(false)\n ->searchable()\n ->allowHtml()\n ->required(),\n TextInput::make('tracking_number')\n ->label(__('shopper::forms.label.tracking_number'))\n ->placeholder('e.g. 1Z999AA10123456784'),\n TextInput::make('tracking_url')\n ->label(__('shopper::forms.label.tracking_url'))\n ->placeholder('https://your-tracking-url.com')\n ->url(),\n ])\n ->action(function (OrderShipping $record, array $data): void {\n $record->update($data);\n\n Notification::make()\n ->title(__('shopper::notifications.update', ['item' => __('shopper::pages/orders.shipments')]))\n ->success()\n ->send();\n }),\n Action::make('view')\n ->label(__('shopper::pages/orders.shipment.manage'))\n ->icon(Untitledui::Sliders)\n ->iconButton()\n ->tooltip(__('shopper::pages/orders.shipment.manage'))\n ->action(fn (OrderShipping $record) => $this->dispatch(\n 'openPanel',\n component: 'shopper-slide-overs.shipment-detail',\n arguments: ['shipment' => $record],\n )),\n ])\n ->filters([\n SelectFilter::make('status')\n ->label(__('shopper::forms.label.status'))\n ->options(ShipmentStatus::options())\n ->multiple(),\n SelectFilter::make('order_id')\n ->label(__('shopper::pages/orders.order_number'))\n ->relationship('order', 'number', fn (Builder $query): Builder => $query->whereHas('shippings'))\n ->searchable()\n ->preload()\n ->optionsLimit(10),\n SelectFilter::make('carrier_id')\n ->label(__('shopper::pages/orders.carrier_service'))\n ->relationship('carrier', 'name')\n ->searchable()\n ->preload(),\n ]);\n }\n" pre_fix = " public function table(Table $table): Table\n {\n return $table\n ->query(\n OrderShipping::query()\n ->with(['order', 'carrier', 'items', 'events'])\n ->latest()\n )\n ->modifyQueryUsing($this->modifyQueryWithActiveTab(...))\n ->columns([\n TextColumn::make('id')\n ->label(__('shopper::pages/orders.shipment_id'))\n ->formatStateUsing(fn (OrderShipping $record): string => 'SHP-'.$record->id)\n ->searchable()\n ->sortable(),\n ViewColumn::make('shipment_event')\n ->label(__('shopper::pages/orders.shipment_event'))\n ->view('shopper::livewire.tables.cells.orders.shipment-stepper'),\n TextColumn::make('status')\n ->label(__('shopper::forms.label.status'))\n ->badge()\n ->color(fn (OrderShipping $record): ?string => $record->status?->getColor())\n ->icon(fn (OrderShipping $record): ?string => $record->status?->getIcon())\n ->formatStateUsing(fn (OrderShipping $record): string => $record->status?->getLabel() ?? '—'),\n TextColumn::make('shipped_at')\n ->label(__('shopper::forms.label.shipped_at'))\n ->date()\n ->sortable(),\n TextColumn::make('order.number')\n ->label(__('shopper::pages/orders.order_number'))\n ->searchable()\n ->sortable()\n ->url(fn (OrderShipping $record): string => route('shopper.orders.detail', $record->order)),\n ViewColumn::make('carrier')\n ->label(__('shopper::pages/orders.carrier_service'))\n ->view('shopper::livewire.tables.cells.orders.shipment-carrier'),\n ])\n ->recordActions([\n Action::make('markDelivered')\n ->label(__('shopper::forms.actions.mark_delivered'))\n ->icon(Untitledui::PackageCheck)\n ->color('success')\n ->visible(fn (OrderShipping $record): bool => $record->canBeDelivered())\n ->requiresConfirmation()\n ->action(function (OrderShipping $record): void {\n (new MarkShipmentDeliveredAction)->execute($record);\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.shipment_delivered'))\n ->success()\n ->send();\n }),\n Action::make('edit')\n ->label(__('shopper::forms.actions.edit'))\n ->icon(Untitledui::Edit03)\n ->iconButton()\n ->modalWidth(Width::Large)\n ->fillForm(fn (OrderShipping $record): array => [\n 'carrier_id' => $record->carrier_id,\n 'tracking_number' => $record->tracking_number,\n 'tracking_url' => $record->tracking_url,\n ])\n ->schema([\n Select::make('carrier_id')\n ->label(__('shopper::pages/orders.carrier_service'))\n ->options(fn (): array => resolve(CarrierRateService::class)->getCarrierSelectOptions())\n ->native(false)\n ->searchable()\n ->allowHtml()\n ->required(),\n TextInput::make('tracking_number')\n ->label(__('shopper::forms.label.tracking_number'))\n ->placeholder('e.g. 1Z999AA10123456784'),\n TextInput::make('tracking_url')\n ->label(__('shopper::forms.label.tracking_url'))\n ->placeholder('https://your-tracking-url.com')\n ->url(),\n ])\n ->action(function (OrderShipping $record, array $data): void {\n $record->update($data);\n\n Notification::make()\n ->title(__('shopper::notifications.update', ['item' => __('shopper::pages/orders.shipments')]))\n ->success()\n ->send();\n }),\n Action::make('view')\n ->label(__('shopper::pages/orders.shipment.manage'))\n ->icon(Untitledui::Sliders)\n ->iconButton()\n ->tooltip(__('shopper::pages/orders.shipment.manage'))\n ->action(fn (OrderShipping $record) => $this->dispatch(\n 'openPanel',\n component: 'shopper-slide-overs.shipment-detail',\n arguments: ['shipment' => $record],\n )),\n ])\n ->filters([\n SelectFilter::make('status')\n ->label(__('shopper::forms.label.status'))\n ->options(ShipmentStatus::options())\n ->multiple(),\n SelectFilter::make('order_id')\n ->label(__('shopper::pages/orders.order_number'))\n ->relationship('order', 'number', fn (Builder $query): Builder => $query->whereHas('shippings'))\n ->searchable()\n ->preload()\n ->optionsLimit(10),\n SelectFilter::make('carrier_id')\n ->label(__('shopper::pages/orders.carrier_service'))\n ->relationship('carrier', 'name')\n ->searchable()\n ->preload(),\n ]);\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "markPaidAction" function_lines = [[88, 113]] id = "shopperlabs-shopper-29811dac402a0d13" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Order/Detail.php" post_fix = " public function markPaidAction(): Action\n {\n return Action::make('markPaid')\n ->label(__('shopper::forms.actions.mark_paid'))\n ->authorize('edit_orders')\n ->visible($this->order->isPaymentPending() || $this->order->isPaymentAuthorized())\n ->action(function (): void {\n $data = ['payment_status' => PaymentStatus::Paid];\n\n if ($this->order->isNew()) {\n $data['status'] = OrderStatus::Processing;\n }\n\n $this->order->update($data);\n\n $this->order->refresh();\n $this->dispatch('order.updated');\n\n event(new OrderPaid($this->order));\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.paid'))\n ->success()\n ->send();\n });\n }\n" pre_fix = " public function markPaidAction(): Action\n {\n return Action::make('markPaid')\n ->label(__('shopper::forms.actions.mark_paid'))\n ->visible($this->order->isPaymentPending() || $this->order->isPaymentAuthorized())\n ->action(function (): void {\n $data = ['payment_status' => PaymentStatus::Paid];\n\n if ($this->order->isNew()) {\n $data['status'] = OrderStatus::Processing;\n }\n\n $this->order->update($data);\n\n $this->order->refresh();\n $this->dispatch('order.updated');\n\n event(new OrderPaid($this->order));\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.paid'))\n ->success()\n ->send();\n });\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "archiveAction" function_lines = [[179, 207]] id = "shopperlabs-shopper-2aeaefee52274ee8" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Order/Detail.php" post_fix = " public function archiveAction(): Action\n {\n return Action::make('archive')\n ->label(__('shopper::forms.actions.archive'))\n ->color('danger')\n ->icon(Untitledui::Archive)\n ->authorize('edit_orders')\n ->visible(! $this->order->isCompleted() && ! $this->order->isPaid())\n ->requiresConfirmation()\n ->modalHeading(__('shopper::pages/orders.modals.archived_number', ['number' => $this->order->number]))\n ->modalDescription(__('shopper::pages/orders.modals.archived_notice'))\n ->modalSubmitActionLabel(__('shopper::forms.actions.confirm'))\n ->action(function (): void {\n $this->order->update([\n 'status' => OrderStatus::Archived,\n 'archived_at' => now(),\n ]);\n\n event(new OrderArchived($this->order));\n\n Notification::make()\n ->title(__('shopper::notifications.orders.archived'))\n ->success()\n ->send();\n\n $this->redirectRoute('shopper.orders.index', navigate: true);\n });\n }\n\n #[On('order.shipping.created')]" pre_fix = " public function archiveAction(): Action\n {\n return Action::make('archive')\n ->label(__('shopper::forms.actions.archive'))\n ->color('danger')\n ->icon(Untitledui::Archive)\n ->visible(! $this->order->isCompleted() && ! $this->order->isPaid())\n ->requiresConfirmation()\n ->modalHeading(__('shopper::pages/orders.modals.archived_number', ['number' => $this->order->number]))\n ->modalDescription(__('shopper::pages/orders.modals.archived_notice'))\n ->modalSubmitActionLabel(__('shopper::forms.actions.confirm'))\n ->action(function (): void {\n $this->order->update([\n 'status' => OrderStatus::Archived,\n 'archived_at' => now(),\n ]);\n\n event(new OrderArchived($this->order));\n\n Notification::make()\n ->title(__('shopper::notifications.orders.archived'))\n ->success()\n ->send();\n\n $this->redirectRoute('shopper.orders.index', navigate: true);\n });\n }\n\n #[On('order.shipping.created')]" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "store" function_lines = [[54, 65]] id = "shopperlabs-shopper-5481a94c34f42fbf" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Components/Products/Form/Files.php" post_fix = " public function store(): void\n {\n $this->authorize('edit_products');\n\n $this->product->update($this->form->getState());\n\n $this->dispatch('product.updated');\n\n Notification::make()\n ->body(__('shopper::pages/products.notifications.files_update'))\n ->success()\n ->send();\n }\n" pre_fix = " public function store(): void\n {\n $this->product->update($this->form->getState());\n\n $this->dispatch('product.updated');\n\n Notification::make()\n ->body(__('shopper::pages/products.notifications.files_update'))\n ->success()\n ->send();\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "store" function_lines = [[56, 67]] id = "shopperlabs-shopper-5a3dcf2a6b6b16c8" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Components/Products/Form/Shipping.php" post_fix = " public function store(): void\n {\n $this->authorize('edit_products');\n\n $this->product->update($this->form->getState());\n\n $this->dispatch('product.updated');\n\n Notification::make()\n ->title(__('shopper::pages/products.notifications.shipping_update'))\n ->success()\n ->send();\n }\n" pre_fix = " public function store(): void\n {\n $this->product->update($this->form->getState());\n\n $this->dispatch('product.updated');\n\n Notification::make()\n ->title(__('shopper::pages/products.notifications.shipping_update'))\n ->success()\n ->send();\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "createPermissionAction" function_lines = [[151, 198]] id = "shopperlabs-shopper-5e6161ace0cb4b97" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php" post_fix = " public function createPermissionAction(): Action\n {\n return Action::make('createPermission')\n ->label(__('shopper::pages/settings/staff.create_permission'))\n ->icon(Untitledui::Lock04)\n ->authorize('access_setting')\n ->modalWidth(Width::ExtraLarge)\n ->modalHeading(__('shopper::modals.permissions.new'))\n ->modalDescription(__('shopper::modals.permissions.new_description'))\n ->modalSubmitActionLabel(__('shopper::forms.actions.save'))\n ->schema([\n Select::make('group_name')\n ->label(__('shopper::forms.label.group_name'))\n ->options(Permission::groups())\n ->native(false)\n ->columnSpan('full'),\n TextInput::make('name')\n ->label(__('shopper::modals.permissions.labels.name'))\n ->placeholder('create_post, manage_articles, etc')\n ->unique(table: Permission::class, column: 'name')\n ->maxLength(30)\n ->required(),\n TextInput::make('display_name')\n ->label(__('shopper::forms.label.display_name'))\n ->placeholder('Create Blog posts')\n ->maxLength(75)\n ->required(),\n Textarea::make('description')\n ->label(__('shopper::forms.label.description'))\n ->rows(3)\n ->columnSpan('full'),\n ])\n ->action(function (array $data): void {\n /** @var Permission $permission */\n $permission = Permission::query()->create($data);\n\n $this->role->givePermissionTo($permission->name);\n\n $this->dispatch('permissionAdded');\n\n Notification::make()\n ->title(__('shopper::notifications.users_roles.permission_add'))\n ->success()\n ->send();\n });\n }\n" pre_fix = " public function createPermissionAction(): Action\n {\n return Action::make('createPermission')\n ->label(__('shopper::pages/settings/staff.create_permission'))\n ->icon(Untitledui::Lock04)\n ->modalWidth(Width::ExtraLarge)\n ->modalHeading(__('shopper::modals.permissions.new'))\n ->modalDescription(__('shopper::modals.permissions.new_description'))\n ->modalSubmitActionLabel(__('shopper::forms.actions.save'))\n ->schema([\n Select::make('group_name')\n ->label(__('shopper::forms.label.group_name'))\n ->options(Permission::groups())\n ->native(false)\n ->columnSpan('full'),\n TextInput::make('name')\n ->label(__('shopper::modals.permissions.labels.name'))\n ->placeholder('create_post, manage_articles, etc')\n ->unique(table: Permission::class, column: 'name')\n ->maxLength(30)\n ->required(),\n TextInput::make('display_name')\n ->label(__('shopper::forms.label.display_name'))\n ->placeholder('Create Blog posts')\n ->maxLength(75)\n ->required(),\n Textarea::make('description')\n ->label(__('shopper::forms.label.description'))\n ->rows(3)\n ->columnSpan('full'),\n ])\n ->action(function (array $data): void {\n $this->authorize('view_users');\n\n /** @var Permission $permission */\n $permission = Permission::query()->create($data);\n\n $this->role->givePermissionTo($permission->name);\n\n $this->dispatch('permissionAdded');\n\n Notification::make()\n ->title(__('shopper::notifications.users_roles.permission_add'))\n ->success()\n ->send();\n });\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "createCarrierAction" function_lines = [[49, 66]] id = "shopperlabs-shopper-61e951b6bcd03186" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Settings/Carriers.php" post_fix = " public function createCarrierAction(): Action\n {\n return Action::make('createCarrier')\n ->label(__('shopper::pages/settings/carriers.add_carrier'))\n ->authorize('access_setting')\n ->modalWidth(Width::ExtraLarge)\n ->modalHeading(__('shopper::pages/settings/carriers.add_carrier'))\n ->modalSubmitActionLabel(__('shopper::forms.actions.save'))\n ->schema($this->getCarrierFormSchema())\n ->action(function (array $data): void {\n Carrier::query()->create($data);\n\n Notification::make()\n ->title(__('shopper::notifications.carrier.add'))\n ->success()\n ->send();\n });\n }\n" pre_fix = " public function createCarrierAction(): Action\n {\n return Action::make('createCarrier')\n ->label(__('shopper::pages/settings/carriers.add_carrier'))\n ->modalWidth(Width::ExtraLarge)\n ->modalHeading(__('shopper::pages/settings/carriers.add_carrier'))\n ->modalSubmitActionLabel(__('shopper::forms.actions.save'))\n ->schema($this->getCarrierFormSchema())\n ->action(function (array $data): void {\n Carrier::query()->create($data);\n\n Notification::make()\n ->title(__('shopper::notifications.carrier.add'))\n ->success()\n ->send();\n });\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "store" function_lines = [[134, 143]] id = "shopperlabs-shopper-7cc69fb293ec0e10" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Collection/Edit.php" post_fix = " public function store(): void\n {\n $this->authorize('edit_collections');\n\n $this->collection->update($this->form->getState());\n\n Notification::make()\n ->title(__('shopper::notifications.update', ['item' => __('shopper::pages/collections.single')]))\n ->success()\n ->send();\n }\n" pre_fix = " public function store(): void\n {\n $this->collection->update($this->form->getState());\n\n Notification::make()\n ->title(__('shopper::notifications.update', ['item' => __('shopper::pages/collections.single')]))\n ->success()\n ->send();\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "generatePermissionsAction" function_lines = [[90, 150]] id = "shopperlabs-shopper-8769d9915b8295a9" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php" post_fix = " public function generatePermissionsAction(): Action\n {\n return Action::make('generatePermissions')\n ->label(__('shopper::pages/settings/staff.generate_permissions'))\n ->icon(Untitledui::ShieldZap)\n ->color('gray')\n ->authorize('access_setting')\n ->modalWidth(Width::Medium)\n ->modalHeading(__('shopper::pages/settings/staff.generate_permissions'))\n ->modalDescription(__('shopper::pages/settings/staff.generate_permissions_description'))\n ->modalSubmitActionLabel(__('shopper::pages/settings/staff.generate_permissions'))\n ->schema([\n TextInput::make('resource')\n ->label(__('shopper::pages/settings/staff.resource_name'))\n ->placeholder('tags, shipments, reviews…')\n ->live(debounce: 300)\n ->required(),\n Select::make('group_name')\n ->label(__('shopper::forms.label.group_name'))\n ->options(Permission::groups())\n ->native(false)\n ->columnSpan('full'),\n TextEntry::make('preview')\n ->label(__('shopper::pages/settings/staff.permissions_preview'))\n ->hidden(fn (Get $get): bool => blank($get('resource')))\n ->state(function (Get $get): HtmlString {\n $resource = $get('resource');\n\n $badges = collect(['browse', 'read', 'edit', 'add', 'delete'])\n ->map(fn (string $prefix): string => Blade::render(\n '{{ $name }}',\n ['name' => \"{$prefix}_{$resource}\"],\n ))\n ->implode('');\n\n return new HtmlString('

'.$badges.'

');\n })\n ->columnSpan('full'),\n ])\n ->action(function (array $data): void {\n $resource = $data['resource'];\n $group = $data['group_name'] ?? null;\n\n Permission::generate($resource, $group);\n\n $prefixes = ['browse', 'read', 'edit', 'add', 'delete'];\n\n foreach ($prefixes as $prefix) {\n $this->role->givePermissionTo(\"{$prefix}_{$resource}\");\n }\n\n $this->dispatch('permissionAdded');\n\n Notification::make()\n ->title(__('shopper::notifications.users_roles.permission_add'))\n ->success()\n ->send();\n });\n }\n" pre_fix = " public function generatePermissionsAction(): Action\n {\n return Action::make('generatePermissions')\n ->label(__('shopper::pages/settings/staff.generate_permissions'))\n ->icon(Untitledui::ShieldZap)\n ->color('gray')\n ->modalWidth(Width::Medium)\n ->modalHeading(__('shopper::pages/settings/staff.generate_permissions'))\n ->modalDescription(__('shopper::pages/settings/staff.generate_permissions_description'))\n ->modalSubmitActionLabel(__('shopper::pages/settings/staff.generate_permissions'))\n ->schema([\n TextInput::make('resource')\n ->label(__('shopper::pages/settings/staff.resource_name'))\n ->placeholder('tags, shipments, reviews…')\n ->live(debounce: 300)\n ->required(),\n Select::make('group_name')\n ->label(__('shopper::forms.label.group_name'))\n ->options(Permission::groups())\n ->native(false)\n ->columnSpan('full'),\n TextEntry::make('preview')\n ->label(__('shopper::pages/settings/staff.permissions_preview'))\n ->hidden(fn (Get $get): bool => blank($get('resource')))\n ->state(function (Get $get): HtmlString {\n $resource = $get('resource');\n\n $badges = collect(['browse', 'read', 'edit', 'add', 'delete'])\n ->map(fn (string $prefix): string => Blade::render(\n '{{ $name }}',\n ['name' => \"{$prefix}_{$resource}\"],\n ))\n ->implode('');\n\n return new HtmlString('

'.$badges.'

');\n })\n ->columnSpan('full'),\n ])\n ->action(function (array $data): void {\n $this->authorize('view_users');\n\n $resource = $data['resource'];\n $group = $data['group_name'] ?? null;\n\n Permission::generate($resource, $group);\n\n $prefixes = ['browse', 'read', 'edit', 'add', 'delete'];\n\n foreach ($prefixes as $prefix) {\n $this->role->givePermissionTo(\"{$prefix}_{$resource}\");\n }\n\n $this->dispatch('permissionAdded');\n\n Notification::make()\n ->title(__('shopper::notifications.users_roles.permission_add'))\n ->success()\n ->send();\n });\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "table" function_lines = [[43, 130]] id = "shopperlabs-shopper-88497bd11908cf4a" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Settings/Currencies.php" post_fix = " public function table(Table $table): Table\n {\n return $table\n ->query(Currency::withoutGlobalScopes()->orderBy('name'))\n ->columns([\n TextColumn::make('name')\n ->label(__('shopper::forms.label.name'))\n ->sortable()\n ->searchable(),\n TextColumn::make('code')\n ->label(__('shopper::pages/settings/currencies.code'))\n ->badge()\n ->color('gray')\n ->searchable(),\n TextColumn::make('symbol')\n ->label(__('shopper::pages/settings/currencies.symbol')),\n TextColumn::make('exchange_rate')\n ->label(__('shopper::pages/settings/currencies.exchange_rate'))\n ->numeric(decimalPlaces: 4)\n ->sortable(),\n ToggleColumn::make('is_enabled')\n ->label(__('shopper::forms.label.status'))\n ->beforeStateUpdated(fn (): mixed => $this->authorize('access_setting')),\n ])\n ->recordActions([\n EditAction::make('edit')\n ->label(__('shopper::forms.actions.edit'))\n ->icon(Untitledui::Edit03)\n ->iconButton()\n ->authorize('access_setting')\n ->modalHeading(__('shopper::pages/settings/currencies.edit_rate'))\n ->modalWidth(Width::Large)\n ->schema([\n TextInput::make('exchange_rate')\n ->label(__('shopper::pages/settings/currencies.exchange_rate'))\n ->helperText(__('shopper::pages/settings/currencies.exchange_rate_help'))\n ->numeric()\n ->step(0.0001)\n ->minValue(0)\n ->required(),\n ])\n ->successNotificationTitle(__('shopper::pages/settings/currencies.rate_updated')),\n ])\n ->filters([\n TernaryFilter::make('is_enabled')\n ->label(__('shopper::forms.label.status')),\n ])\n ->groupedBulkActions([\n BulkAction::make('enable')\n ->label(__('shopper::forms.actions.enable'))\n ->icon(Untitledui::CheckVerified)\n ->modalIcon(Untitledui::CheckVerified)\n ->modalIconColor('success')\n ->authorize('access_setting')\n ->requiresConfirmation()\n ->action(function (Collection $records): void {\n Currency::withoutGlobalScopes()\n ->whereIn('id', $records->pluck('id'))\n ->update(['is_enabled' => true]);\n\n Notification::make()\n ->title(__('shopper::notifications.enabled', [\n 'item' => __('shopper::pages/settings/currencies.single'),\n ]))\n ->success()\n ->send();\n })\n ->deselectRecordsAfterCompletion(),\n BulkAction::make('disable')\n ->label(__('shopper::forms.actions.disable'))\n ->icon(Untitledui::SlashCircle01)\n ->authorize('access_setting')\n ->requiresConfirmation()\n ->color('warning')\n ->action(function (Collection $records): void {\n Currency::withoutGlobalScopes()\n ->whereIn('id', $records->pluck('id'))\n ->update(['is_enabled' => false]);\n\n Notification::make()\n ->title(__('shopper::notifications.disabled', [\n 'item' => __('shopper::pages/settings/currencies.single'),\n ]))\n ->success()\n ->send();\n })\n ->deselectRecordsAfterCompletion(),\n ])\n ->emptyStateIcon(Untitledui::CurrencyDollarCircle)\n ->emptyStateDescription(__('shopper::pages/settings/currencies.no_currency'));\n }\n" pre_fix = " public function table(Table $table): Table\n {\n return $table\n ->query(Currency::withoutGlobalScopes()->orderBy('name'))\n ->columns([\n TextColumn::make('name')\n ->label(__('shopper::forms.label.name'))\n ->sortable()\n ->searchable(),\n TextColumn::make('code')\n ->label(__('shopper::pages/settings/currencies.code'))\n ->badge()\n ->color('gray')\n ->searchable(),\n TextColumn::make('symbol')\n ->label(__('shopper::pages/settings/currencies.symbol')),\n TextColumn::make('exchange_rate')\n ->label(__('shopper::pages/settings/currencies.exchange_rate'))\n ->numeric(decimalPlaces: 4)\n ->sortable(),\n ToggleColumn::make('is_enabled')\n ->label(__('shopper::forms.label.status')),\n ])\n ->recordActions([\n EditAction::make('edit')\n ->label(__('shopper::forms.actions.edit'))\n ->icon(Untitledui::Edit03)\n ->iconButton()\n ->modalHeading(__('shopper::pages/settings/currencies.edit_rate'))\n ->modalWidth(Width::Large)\n ->schema([\n TextInput::make('exchange_rate')\n ->label(__('shopper::pages/settings/currencies.exchange_rate'))\n ->helperText(__('shopper::pages/settings/currencies.exchange_rate_help'))\n ->numeric()\n ->step(0.0001)\n ->minValue(0)\n ->required(),\n ])\n ->successNotificationTitle(__('shopper::pages/settings/currencies.rate_updated')),\n ])\n ->filters([\n TernaryFilter::make('is_enabled')\n ->label(__('shopper::forms.label.status')),\n ])\n ->groupedBulkActions([\n BulkAction::make('enable')\n ->label(__('shopper::forms.actions.enable'))\n ->icon(Untitledui::CheckVerified)\n ->modalIcon(Untitledui::CheckVerified)\n ->modalIconColor('success')\n ->requiresConfirmation()\n ->action(function (Collection $records): void {\n Currency::withoutGlobalScopes()\n ->whereIn('id', $records->pluck('id'))\n ->update(['is_enabled' => true]);\n\n Notification::make()\n ->title(__('shopper::notifications.enabled', [\n 'item' => __('shopper::pages/settings/currencies.single'),\n ]))\n ->success()\n ->send();\n })\n ->deselectRecordsAfterCompletion(),\n BulkAction::make('disable')\n ->label(__('shopper::forms.actions.disable'))\n ->icon(Untitledui::SlashCircle01)\n ->requiresConfirmation()\n ->color('warning')\n ->action(function (Collection $records): void {\n Currency::withoutGlobalScopes()\n ->whereIn('id', $records->pluck('id'))\n ->update(['is_enabled' => false]);\n\n Notification::make()\n ->title(__('shopper::notifications.disabled', [\n 'item' => __('shopper::pages/settings/currencies.single'),\n ]))\n ->success()\n ->send();\n })\n ->deselectRecordsAfterCompletion(),\n ])\n ->emptyStateIcon(Untitledui::CurrencyDollarCircle)\n ->emptyStateDescription(__('shopper::pages/settings/currencies.no_currency'));\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "form" function_lines = [[71, 203]] id = "shopperlabs-shopper-8b7021ee40c51b56" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/SlideOvers/AddVariant.php" post_fix = " public function form(Schema $schema): Schema\n {\n return $schema\n ->components([\n SlideOverWizard::make()\n ->schema([\n StepColumn::make(__('shopper::words.general'))\n ->icon(Untitledui::File02)\n ->schema([\n TextInput::make('name')\n ->label(__('shopper::forms.label.name'))\n ->placeholder('Model Y, Model S (Eg. for Tesla)')\n ->required()\n ->maxLength(255),\n TextInput::make('sku')\n ->label(__('shopper::forms.label.sku'))\n ->unique(\n table: shopper_table('product_variants'),\n column: 'sku',\n modifyRuleUsing: fn (Unique $rule): Unique => $rule->where('product_id', $this->product->id)\n )\n ->maxLength(255),\n Group::make()\n ->visible(fn (): bool => $this->options->isNotEmpty())\n ->schema([\n TextEntry::make('options')\n ->label(__('shopper::pages/products.modals.variants.options.title'))\n ->state(\n new HtmlString(Blade::render(<<<'BLADE'\n

\n {{ __('shopper::pages/products.modals.variants.options.description') }}\n

\n BLADE))\n ),\n Group::make()\n ->schema(\n $this->options->map(\n fn (array $option): Select => Select::make('values.'.$option['id'])\n ->label($option['name'])\n ->key($option['key'])\n ->required()\n ->searchable()\n ->optionsLimit(10)\n ->options(\n collect($option['values'])->mapWithKeys(\n fn (array $value): array => [$value['id'] => $value['value']]\n )\n )\n ->native(false)\n )->toArray()\n )\n ->columns(3),\n TextEntry::make('alert')\n ->visible(fn (Get $get): bool => $get('values') !== null && $this->variantAlreadyExist($get('values')))\n ->hiddenLabel()\n ->state(\n new HtmlString(Blade::render(<<<'BLADE'\n

\n \n

\n BLADE))\n )\n ->columnSpanFull(),\n ])\n ->columnSpanFull(),\n ])\n ->columns(3)\n ->afterValidation(function (Get $get): void {\n if ($get('values') !== null && $this->variantAlreadyExist($get('values'))) {\n throw new Halt;\n }\n }),\n StepColumn::make(__('shopper::words.media'))\n ->icon(Untitledui::Image)\n ->schema([\n SpatieMediaLibraryFileUpload::make('thumbnail')\n ->collection(config('shopper.media.storage.thumbnail_collection'))\n ->label(__('shopper::forms.label.thumbnail'))\n ->helperText(__('shopper::pages/products.thumbnail_helpText'))\n ->image()\n ->maxSize(config('shopper.media.max_size.thumbnail'))\n ->columnSpan(['lg' => 2]),\n SpatieMediaLibraryFileUpload::make('images')\n ->collection(config('shopper.media.storage.collection_name'))\n ->label(__('shopper::words.images'))\n ->helperText(__('shopper::pages/products.variant_images_helpText'))\n ->multiple()\n ->panelLayout('grid')\n ->maxSize(config('shopper.media.max_size.images'))\n ->columnSpanFull(),\n ])\n ->columns(5),\n StepColumn::make(__('shopper::words.pricing'))\n ->icon(Untitledui::CoinsStacked02)\n ->schema(CurrenciesField::make($this->currencies))\n ->statePath('prices'),\n StepColumn::make(__('shopper::pages/settings/menu.location'))\n ->icon(Untitledui::Package)\n ->schema([\n TextEntry::make('stock')\n ->label(__('shopper::pages/products.stock_inventory_heading'))\n ->state(new HtmlString(Blade::render(<<<'BLADE'\n

\n {{ __('shopper::pages/products.stock_inventory_description', ['item' => __('shopper::pages/products.variants.single')]) }}\n

\n {{ __('shopper::pages/products.modals.variants.options.description') }}\n

\n \n

\n {{ __('shopper::pages/products.stock_inventory_description', ['item' => __('shopper::pages/products.variants.single')]) }}\n

\n BLADE))),\n Grid::make()\n ->schema([\n TextInput::make('barcode')\n ->label(__('shopper::forms.label.barcode'))\n ->unique(shopper_table('product_variants'), 'barcode')\n ->maxLength(255),\n TextInput::make('quantity')\n ->label(__('shopper::forms.label.quantity'))\n ->numeric()\n ->rules(['integer', 'min:0']),\n ])\n ->columns(3),\n ]),\n ])\n ->submitAction(new HtmlString(Blade::render(<<<'BLADE'\n \n {{ __('shopper::forms.actions.save') }}\n \n BLADE))),\n ])\n ->statePath('data')\n ->model(config('shopper.models.variant'));\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "store" function_lines = [[60, 72]] id = "shopperlabs-shopper-91023b586e4ab747" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Components/Settings/Legal/PolicyForm.php" post_fix = " public function store(): void\n {\n $this->authorize('access_setting');\n\n $this->legal->update(array_merge($this->form->getState(), [\n 'slug' => $this->legal->slug,\n ]));\n\n Notification::make()\n ->title($this->legal->title)\n ->body(__('shopper::notifications.legal'))\n ->success()\n ->send();\n }\n" pre_fix = " public function store(): void\n {\n $this->legal->update(array_merge($this->form->getState(), [\n 'slug' => $this->legal->slug,\n ]));\n\n Notification::make()\n ->title($this->legal->title)\n ->body(__('shopper::notifications.legal'))\n ->success()\n ->send();\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "togglePermission" function_lines = [[26, 48]] id = "shopperlabs-shopper-995f958bcb3b415b" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Components/Settings/Team/Permissions.php" post_fix = " public function togglePermission(int $id): void\n {\n $this->authorize('view_users');\n\n $permission = Permission::query()->find($id);\n\n if ($permission === null) {\n return;\n }\n\n if ($this->role->hasPermissionTo($permission->name)) {\n $this->role->revokePermissionTo($permission->name);\n\n Notification::make()\n ->title(__('shopper::notifications.users_roles.permission_revoke', ['permission' => $permission->display_name]))\n ->success()\n ->send();\n } else {\n $this->role->givePermissionTo($permission->name);\n\n Notification::make()\n ->title(__('shopper::notifications.users_roles.permission_allow', ['permission' => $permission->display_name]))\n ->success()\n ->send();\n }\n }\n" pre_fix = " public function togglePermission(int $id): void\n {\n $this->authorize('view_users');\n /** @var Permission $permission */\n $permission = Permission::query()->find($id);\n\n if ($this->role->hasPermissionTo($permission->name)) {\n $this->role->revokePermissionTo($permission->name);\n\n Notification::make()\n ->title(__('shopper::notifications.users_roles.permission_revoke', ['permission' => $permission->display_name]))\n ->success()\n ->send();\n } else {\n $this->role->givePermissionTo($permission->name);\n\n Notification::make()\n ->title(__('shopper::notifications.users_roles.permission_allow', ['permission' => $permission->display_name]))\n ->success()\n ->send();\n }\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "createPaymentAction" function_lines = [[49, 66]] id = "shopperlabs-shopper-a413505de3d037f8" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Settings/PaymentMethods.php" post_fix = " public function createPaymentAction(): Action\n {\n return Action::make('createPayment')\n ->label(__('shopper::pages/settings/payments.add_payment'))\n ->authorize('access_setting')\n ->modalWidth(Width::ExtraLarge)\n ->modalHeading(__('shopper::pages/settings/payments.add_payment'))\n ->modalSubmitActionLabel(__('shopper::forms.actions.save'))\n ->schema($this->getPaymentFormSchema())\n ->action(function (array $data): void {\n PaymentMethod::query()->create($data);\n\n Notification::make()\n ->title(__('shopper::notifications.payment.add'))\n ->success()\n ->send();\n });\n }\n" pre_fix = " public function createPaymentAction(): Action\n {\n return Action::make('createPayment')\n ->label(__('shopper::pages/settings/payments.add_payment'))\n ->modalWidth(Width::ExtraLarge)\n ->modalHeading(__('shopper::pages/settings/payments.add_payment'))\n ->modalSubmitActionLabel(__('shopper::forms.actions.save'))\n ->schema($this->getPaymentFormSchema())\n ->action(function (array $data): void {\n PaymentMethod::query()->create($data);\n\n Notification::make()\n ->title(__('shopper::notifications.payment.add'))\n ->success()\n ->send();\n });\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "store" function_lines = [[52, 63]] id = "shopperlabs-shopper-a82b452965e2ffe5" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Components/Products/Form/Seo.php" post_fix = " public function store(): void\n {\n $this->authorize('edit_products');\n\n $this->product->update($this->form->getState());\n\n $this->dispatch('product.updated');\n\n Notification::make()\n ->body(__('shopper::pages/products.notifications.seo_update'))\n ->success()\n ->send();\n }\n" pre_fix = " public function store(): void\n {\n $this->product->update($this->form->getState());\n\n $this->dispatch('product.updated');\n\n Notification::make()\n ->body(__('shopper::pages/products.notifications.seo_update'))\n ->success()\n ->send();\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "form" function_lines = [[84, 283]] id = "shopperlabs-shopper-ab37699016e7189c" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/SlideOvers/AddProduct.php" post_fix = " public function form(Schema $schema): Schema\n {\n return $schema\n ->components([\n SlideOverWizard::make([\n StepColumn::make(__('shopper::forms.label.type'))\n ->icon(Untitledui::Dataflow04)\n ->schema([\n RadioDeck::make('type')\n ->options(ProductType::options())\n ->descriptions([\n ProductType::Virtual->value => __('shopper-core::enum/product.virtual_description'),\n ProductType::External->value => __('shopper-core::enum/product.external_description'),\n ProductType::Standard->value => __('shopper-core::enum/product.standard_product_description'),\n ProductType::Variant->value => __('shopper-core::enum/product.variant_product_description'),\n ])\n ->icons([\n ProductType::Virtual->value => 'phosphor-monitor-duotone',\n ProductType::External->value => 'phosphor-link-simple-duotone',\n ProductType::Standard->value => 'phosphor-tag-duotone',\n ProductType::Variant->value => 'phosphor-swatches-duotone',\n ])\n ->alignment(Alignment::Start)\n ->columns(3)\n ->live()\n ->required(),\n Livewire::make(ProductTypeConfiguration::class, fn (Get $get): array => [\n 'defaultProductType' => $get('type'),\n ]),\n ]),\n StepColumn::make(__('shopper::words.general'))\n ->icon(Untitledui::File02)\n ->extraAttributes([\n 'class' => 'w-full max-w-3xl mx-auto',\n ])\n ->schema([\n Grid::make()\n ->schema([\n TextInput::make('name')\n ->label(__('shopper::forms.label.name'))\n ->placeholder('Table set')\n ->required()\n ->maxLength(255)\n ->live(onBlur: true)\n ->afterStateUpdated(function (?string $state, Set $set): void {\n if ($state) {\n $set('slug', Str::slug($state));\n }\n }),\n TextInput::make('slug')\n ->label(__('shopper::forms.label.slug'))\n ->placeholder('table-set')\n ->disabled()\n ->dehydrated()\n ->required()\n ->maxLength(255)\n ->unique(config('shopper.models.product'), 'slug'),\n Textarea::make('summary')\n ->label(__('shopper::forms.label.summary'))\n ->rows(4)\n ->columnSpanFull(),\n RichEditor::make('description')\n ->label(__('shopper::forms.label.description'))\n ->columnSpanFull(),\n ]),\n Separator::make(),\n Grid::make()\n ->schema([\n Toggle::make('is_visible')\n ->label(__('shopper::forms.label.visible'))\n ->helperText(__('shopper::pages/products.visible_help_text')),\n DateTimePicker::make('published_at')\n ->label(__('shopper::forms.label.availability'))\n ->native(false)\n ->minDate(now()->subHour())\n ->helperText(__('shopper::pages/products.availability_description'))\n ->required(),\n ]),\n ]),\n StepColumn::make(__('shopper::pages/products.product_associations'))\n ->icon(Untitledui::GitBranch)\n ->extraAttributes([\n 'class' => 'w-full max-w-3xl mx-auto',\n ])\n ->schema([\n Select::make('brand_id')\n ->label(__('shopper::forms.label.brand'))\n ->relationship(\n name: 'brand',\n titleAttribute: 'name',\n modifyQueryUsing: fn (Builder $query) => $query->where('is_enabled', true)\n )\n ->searchable()\n ->optionsLimit(10)\n ->preload()\n ->visible(Feature::enabled('brand')),\n SelectTree::make('categories')\n ->label(__('shopper::pages/categories.menu'))\n ->enableBranchNode()\n ->relationship(\n relationship: 'categories',\n titleAttribute: 'name',\n parentAttribute: 'parent_id',\n modifyQueryUsing: fn (Builder $query) => $query->where('is_enabled', true)\n )\n ->searchable()\n ->visible(Feature::enabled('category'))\n ->withCount(),\n Select::make('channels')\n ->label(__('shopper::pages/settings/menu.sales'))\n ->relationship(\n name: 'channels',\n titleAttribute: 'name',\n modifyQueryUsing: fn (Builder $query) => $query->where('is_enabled', true)\n )\n ->searchable()\n ->preload()\n ->multiple(),\n Select::make('collections')\n ->label(__('shopper::pages/collections.menu'))\n ->relationship('collections', 'name')\n ->searchable()\n ->preload()\n ->multiple()\n ->optionsLimit(10)\n ->visible(Feature::enabled('collection')),\n ])\n ->columns()\n ->visible(\n Feature::enabled('brand')\n || Feature::enabled('category')\n || Feature::enabled('collection')\n ),\n StepColumn::make(__('shopper::words.media'))\n ->icon(Untitledui::Image)\n ->schema([\n SpatieMediaLibraryFileUpload::make('thumbnail')\n ->collection(config('shopper.media.storage.thumbnail_collection'))\n ->label(__('shopper::forms.label.thumbnail'))\n ->helperText(__('shopper::pages/products.thumbnail_helpText'))\n ->image()\n ->maxSize(config('shopper.media.max_size.thumbnail'))\n ->columnSpan(['lg' => 2]),\n SpatieMediaLibraryFileUpload::make('images')\n ->collection(config('shopper.media.storage.collection_name'))\n ->label(__('shopper::words.images'))\n ->helperText(__('shopper::pages/products.images_helpText'))\n ->multiple()\n ->panelLayout('grid')\n ->maxSize(config('shopper.media.max_size.images'))\n ->columnSpanFull(),\n ])\n ->columns(5),\n StepColumn::make(__('shopper::pages/products.stock_inventory_heading'))\n ->icon(Untitledui::Package)\n ->schema([\n TextEntry::make('stock')\n ->label(__('shopper::pages/products.stock_inventory_heading'))\n ->state(new HtmlString(Blade::render(<<<'BLADE'\n

\n {{ __('shopper::pages/products.stock_inventory_description', ['item' => __('shopper::pages/products.single')]) }}\n

\n BLADE))),\n Grid::make()\n ->schema([\n TextInput::make('sku')\n ->label(__('shopper::forms.label.sku'))\n ->unique(config('shopper.models.product'), 'sku')\n ->maxLength(255),\n TextInput::make('barcode')\n ->label(__('shopper::forms.label.barcode'))\n ->unique(config('shopper.models.product'), 'barcode')\n ->maxLength(255),\n TextInput::make('quantity')\n ->label(__('shopper::forms.label.quantity'))\n ->numeric()\n ->rules(['integer', 'min:0']),\n TextInput::make('security_stock')\n ->label(__('shopper::forms.label.safety_stock'))\n ->helperText(__('shopper::pages/products.safety_security_help_text'))\n ->numeric()\n ->default(0)\n ->rules(['integer', 'min:0']),\n ])\n ->columns(),\n ]),\n ])\n ->startOnStep($this->startStep)\n ->submitAction(new HtmlString(Blade::render(<<<'BLADE'\n \n \n {{ __('shopper::forms.actions.save') }}\n \n BLADE)))\n ->persistStepInQueryString(),\n ])\n ->statePath('data')\n ->model(config('shopper.models.product'));\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "updateStockAction" function_lines = [[46, 81]] id = "shopperlabs-shopper-b37cd0c75b594760" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Product/Variant.php" post_fix = " public function updateStockAction(): Action\n {\n return Action::make('updateStock')\n ->label(__('shopper::forms.actions.edit'))\n ->color('gray')\n ->authorize('edit_products')\n ->modalWidth(Width::Large)\n ->fillForm([\n 'sku' => $this->variant->sku,\n 'barcode' => $this->variant->barcode,\n ])\n ->record($this->variant) // @phpstan-ignore-line\n ->schema([\n TextInput::make('sku')\n ->label(__('shopper::forms.label.sku'))\n ->unique(\n table: config('shopper.models.variant'),\n column: 'sku',\n ignoreRecord: true,\n modifyRuleUsing: fn (Unique $rule): Unique => $rule->where('product_id', $this->variant->product_id)\n )\n ->maxLength(255),\n TextInput::make('barcode')\n ->label(__('shopper::forms.label.barcode'))\n ->unique(config('shopper.models.variant'), 'barcode', ignoreRecord: true)\n ->regex('/^[A-Za-z0-9\\-]*$/')\n ->maxLength(255),\n ])\n ->action(function (array $data): void {\n $this->variant->update($data);\n\n Notification::make()\n ->title(__('shopper::pages/products.notifications.variation_update'))\n ->success()\n ->send();\n });\n }\n" pre_fix = " public function updateStockAction(): Action\n {\n return Action::make('updateStock')\n ->label(__('shopper::forms.actions.edit'))\n ->color('gray')\n ->modalWidth(Width::Large)\n ->fillForm([\n 'sku' => $this->variant->sku,\n 'barcode' => $this->variant->barcode,\n ])\n ->record($this->variant) // @phpstan-ignore-line\n ->schema([\n TextInput::make('sku')\n ->label(__('shopper::forms.label.sku'))\n ->unique(\n table: config('shopper.models.variant'),\n column: 'sku',\n ignoreRecord: true,\n modifyRuleUsing: fn (Unique $rule): Unique => $rule->where('product_id', $this->variant->product_id)\n )\n ->maxLength(255),\n TextInput::make('barcode')\n ->label(__('shopper::forms.label.barcode'))\n ->unique(config('shopper.models.variant'), 'barcode', ignoreRecord: true)\n ->maxLength(255),\n ])\n ->action(function (array $data): void {\n $this->variant->update($data);\n\n Notification::make()\n ->title(__('shopper::pages/products.notifications.variation_update'))\n ->success()\n ->send();\n });\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "form" function_lines = [[56, 88]] id = "shopperlabs-shopper-cd42a8054fc4a7f9" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Components/Products/Form/Inventory.php" post_fix = " public function form(Schema $schema): Schema\n {\n return $schema\n ->components([\n Section::make(__('shopper::pages/products.inventory.title'))\n ->aside()\n ->compact()\n ->description(__('shopper::pages/products.inventory.description'))\n ->extraAttributes(['class' => 'sh-section-aside'])\n ->schema([\n Grid::make()\n ->schema([\n TextInput::make('sku')\n ->label(__('shopper::forms.label.sku'))\n ->unique(config('shopper.models.product'), 'sku', ignoreRecord: true)\n ->maxLength(255),\n TextInput::make('barcode')\n ->label(__('shopper::forms.label.barcode'))\n ->unique(config('shopper.models.product'), 'barcode', ignoreRecord: true)\n ->regex('/^[A-Za-z0-9\\-]*$/')\n ->maxLength(255),\n TextInput::make('security_stock')\n ->label(__('shopper::forms.label.safety_stock'))\n ->helperText(__('shopper::pages/products.safety_security_help_text'))\n ->numeric()\n ->default(0)\n ->rules(['integer', 'min:0']),\n ]),\n ]),\n ])\n ->statePath('data')\n ->model($this->product);\n }\n" pre_fix = " public function form(Schema $schema): Schema\n {\n return $schema\n ->components([\n Section::make(__('shopper::pages/products.inventory.title'))\n ->aside()\n ->compact()\n ->description(__('shopper::pages/products.inventory.description'))\n ->extraAttributes(['class' => 'sh-section-aside'])\n ->schema([\n Grid::make()\n ->schema([\n TextInput::make('sku')\n ->label(__('shopper::forms.label.sku'))\n ->unique(config('shopper.models.product'), 'sku', ignoreRecord: true)\n ->maxLength(255),\n TextInput::make('barcode')\n ->label(__('shopper::forms.label.barcode'))\n ->unique(config('shopper.models.product'), 'barcode', ignoreRecord: true)\n ->maxLength(255),\n TextInput::make('security_stock')\n ->label(__('shopper::forms.label.safety_stock'))\n ->helperText(__('shopper::pages/products.safety_security_help_text'))\n ->numeric()\n ->default(0)\n ->rules(['integer', 'min:0']),\n ]),\n ]),\n ])\n ->statePath('data')\n ->model($this->product);\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "cancelOrderAction" function_lines = [[47, 69]] id = "shopperlabs-shopper-cd45e0d6604bb846" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Order/Detail.php" post_fix = " public function cancelOrderAction(): Action\n {\n return Action::make('cancelOrder')\n ->label(__('shopper::forms.actions.cancel_order'))\n ->authorize('edit_orders')\n ->visible($this->order->canBeCancelled())\n ->action(function (): void {\n $this->order->update([\n 'status' => OrderStatus::Cancelled,\n 'cancelled_at' => now(),\n ]);\n\n $this->order->refresh();\n $this->dispatch('order.updated');\n\n event(new OrderCancelled($this->order));\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.cancelled'))\n ->success()\n ->send();\n });\n }\n" pre_fix = " public function cancelOrderAction(): Action\n {\n return Action::make('cancelOrder')\n ->label(__('shopper::forms.actions.cancel_order'))\n ->visible($this->order->canBeCancelled())\n ->action(function (): void {\n $this->order->update([\n 'status' => OrderStatus::Cancelled,\n 'cancelled_at' => now(),\n ]);\n\n $this->order->refresh();\n $this->dispatch('order.updated');\n\n event(new OrderCancelled($this->order));\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.cancelled'))\n ->success()\n ->send();\n });\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "store" function_lines = [[103, 118]] id = "shopperlabs-shopper-d05ad8c2776691be" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Components/Settings/Locations/InventoryForm.php" post_fix = " public function store(): void\n {\n $this->authorize($this->inventory->id ? 'edit_inventories' : 'add_inventories');\n\n if ($this->inventory->id) {\n $this->inventory->update($this->form->getState());\n } else {\n resolve(Inventory::class)::query()->create($this->form->getState());\n }\n\n Notification::make()\n ->title(__('shopper::notifications.save', ['item' => __('shopper::pages/settings/global.location.single')]))\n ->success()\n ->send();\n\n $this->redirectRoute(name: 'shopper.settings.locations', navigate: true);\n }\n" pre_fix = " public function store(): void\n {\n if ($this->inventory->id) {\n $this->inventory->update($this->form->getState());\n } else {\n resolve(Inventory::class)::query()->create($this->form->getState());\n }\n\n Notification::make()\n ->title(__('shopper::notifications.save', ['item' => __('shopper::pages/settings/global.location.single')]))\n ->success()\n ->send();\n\n $this->redirectRoute(name: 'shopper.settings.locations', navigate: true);\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "table" function_lines = [[67, 112]] id = "shopperlabs-shopper-d26bdca35566e799" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Settings/PaymentMethods.php" post_fix = " public function table(Table $table): Table\n {\n return $table\n ->query(PaymentMethod::query()->latest())\n ->columns([\n ImageColumn::make('logo')\n ->label(__('shopper::forms.label.logo'))\n ->circular()\n ->getStateUsing(fn (PaymentMethod $record): ?string => resolve(PaymentProcessingService::class)->getLogoUrl($record))\n ->defaultImageUrl(shopper_fallback_url()),\n TextColumn::make('title')\n ->label(__('shopper::forms.label.title'))\n ->sortable()\n ->searchable(),\n TextColumn::make('driver')\n ->label(__('shopper::forms.label.driver'))\n ->badge()\n ->formatStateUsing(fn (?string $state): string => $state ? Payment::driver($state)->name() : __('shopper::words.manual'))\n ->color(fn (?string $state): string => match (true) {\n $state === null || $state === 'manual' => 'gray',\n Payment::isConfigured($state) => 'success',\n default => 'warning',\n }),\n ToggleColumn::make('is_enabled')\n ->label(__('shopper::forms.label.status'))\n ->beforeStateUpdated(fn (): mixed => $this->authorize('access_setting')),\n TextColumn::make('updated_at')\n ->label(__('shopper::forms.label.updated_at'))\n ->date(),\n ])\n ->recordActions([\n EditAction::make('edit')\n ->label(__('shopper::forms.actions.edit'))\n ->icon(Untitledui::Edit03)\n ->iconButton()\n ->authorize('access_setting')\n ->modalWidth(Width::ExtraLarge)\n ->schema($this->getPaymentFormSchema())\n ->successNotificationTitle(__('shopper::notifications.payment.update')),\n DeleteAction::make('delete')\n ->label(__('shopper::forms.actions.delete'))\n ->icon(Untitledui::Trash03)\n ->authorize('access_setting')\n ->iconButton(),\n ])\n ->emptyStateIcon(Untitledui::CreditCard02)\n ->emptyStateDescription(__('shopper::pages/settings/payments.no_method'));\n }\n" pre_fix = " public function table(Table $table): Table\n {\n return $table\n ->query(PaymentMethod::query()->latest())\n ->columns([\n ImageColumn::make('logo')\n ->label(__('shopper::forms.label.logo'))\n ->circular()\n ->getStateUsing(fn (PaymentMethod $record): ?string => resolve(PaymentProcessingService::class)->getLogoUrl($record))\n ->defaultImageUrl(shopper_fallback_url()),\n TextColumn::make('title')\n ->label(__('shopper::forms.label.title'))\n ->sortable()\n ->searchable(),\n TextColumn::make('driver')\n ->label(__('shopper::forms.label.driver'))\n ->badge()\n ->formatStateUsing(fn (?string $state): string => $state ? Payment::driver($state)->name() : __('shopper::words.manual'))\n ->color(fn (?string $state): string => match (true) {\n $state === null || $state === 'manual' => 'gray',\n Payment::isConfigured($state) => 'success',\n default => 'warning',\n }),\n ToggleColumn::make('is_enabled')\n ->label(__('shopper::forms.label.status')),\n TextColumn::make('updated_at')\n ->label(__('shopper::forms.label.updated_at'))\n ->date(),\n ])\n ->recordActions([\n EditAction::make('edit')\n ->label(__('shopper::forms.actions.edit'))\n ->icon(Untitledui::Edit03)\n ->iconButton()\n ->modalWidth(Width::ExtraLarge)\n ->schema($this->getPaymentFormSchema())\n ->successNotificationTitle(__('shopper::notifications.payment.update')),\n DeleteAction::make('delete')\n ->label(__('shopper::forms.actions.delete'))\n ->icon(Untitledui::Trash03)\n ->iconButton(),\n ])\n ->emptyStateIcon(Untitledui::CreditCard02)\n ->emptyStateDescription(__('shopper::pages/settings/payments.no_method'));\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "startProcessingAction" function_lines = [[70, 87]] id = "shopperlabs-shopper-deb90b541bcac1aa" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Order/Detail.php" post_fix = " public function startProcessingAction(): Action\n {\n return Action::make('startProcessing')\n ->label(__('shopper::forms.actions.start_processing'))\n ->authorize('edit_orders')\n ->visible($this->order->isNew())\n ->action(function (): void {\n $this->order->update(['status' => OrderStatus::Processing]);\n\n $this->order->refresh();\n $this->dispatch('order.updated');\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.processing'))\n ->success()\n ->send();\n });\n }\n" pre_fix = " public function startProcessingAction(): Action\n {\n return Action::make('startProcessing')\n ->label(__('shopper::forms.actions.start_processing'))\n ->visible($this->order->isNew())\n ->action(function (): void {\n $this->order->update(['status' => OrderStatus::Processing]);\n\n $this->order->refresh();\n $this->dispatch('order.updated');\n\n Notification::make()\n ->title(__('shopper::pages/orders.notifications.processing'))\n ->success()\n ->send();\n });\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "createRoleAction" function_lines = [[41, 76]] id = "shopperlabs-shopper-df2391064e3c3332" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Settings/Team/Index.php" post_fix = " public function createRoleAction(): Action\n {\n return Action::make('createRole')\n ->label(__('shopper::pages/settings/staff.new_role'))\n ->icon(Untitledui::Plus)\n ->iconButton()\n ->outlined()\n ->size(Size::Small)\n ->authorize('access_setting')\n ->modalWidth(Width::Large)\n ->modalHeading(__('shopper::modals.roles.new'))\n ->modalDescription(__('shopper::modals.roles.new_description'))\n ->modalSubmitActionLabel(__('shopper::forms.actions.save'))\n ->schema([\n TextInput::make('name')\n ->label(__('shopper::modals.roles.labels.name'))\n ->placeholder('manager')\n ->unique(table: Role::class, column: 'name')\n ->required(),\n TextInput::make('display_name')\n ->label(__('shopper::forms.label.display_name'))\n ->placeholder('Manager'),\n Textarea::make('description')\n ->label(__('shopper::forms.label.description'))\n ->rows(3)\n ->columnSpan('full'),\n ])\n ->action(function (array $data): void {\n Role::create($data);\n\n Notification::make()\n ->title(__('shopper::notifications.users_roles.role_added'))\n ->success()\n ->send();\n });\n }\n" pre_fix = " public function createRoleAction(): Action\n {\n return Action::make('createRole')\n ->label(__('shopper::pages/settings/staff.new_role'))\n ->icon(Untitledui::Plus)\n ->iconButton()\n ->outlined()\n ->size(Size::Small)\n ->modalWidth(Width::Large)\n ->modalHeading(__('shopper::modals.roles.new'))\n ->modalDescription(__('shopper::modals.roles.new_description'))\n ->modalSubmitActionLabel(__('shopper::forms.actions.save'))\n ->schema([\n TextInput::make('name')\n ->label(__('shopper::modals.roles.labels.name'))\n ->placeholder('manager')\n ->unique(table: Role::class, column: 'name')\n ->required(),\n TextInput::make('display_name')\n ->label(__('shopper::forms.label.display_name'))\n ->placeholder('Manager'),\n Textarea::make('description')\n ->label(__('shopper::forms.label.description'))\n ->rows(3)\n ->columnSpan('full'),\n ])\n ->action(function (array $data): void {\n Role::create($data);\n\n Notification::make()\n ->title(__('shopper::notifications.users_roles.role_added'))\n ->success()\n ->send();\n });\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "removePermission" function_lines = [[49, 61]] id = "shopperlabs-shopper-ed89d9515bdaac41" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Components/Settings/Team/Permissions.php" post_fix = " public function removePermission(int $id): void\n {\n $this->authorize('view_users');\n\n $permission = Permission::query()->find($id);\n\n if ($permission === null) {\n return;\n }\n\n $permission->delete();\n\n Notification::make()\n ->title(__('shopper::notifications.delete', ['item' => __('shopper::pages/settings/staff.permission')]))\n ->success()\n ->send();\n }\n\n #[On('permissionAdded')]" pre_fix = " public function removePermission(int $id): void\n {\n $this->authorize('view_users');\n\n Permission::query()->find($id)->delete();\n\n Notification::make()\n ->title(__('shopper::notifications.delete', ['item' => __('shopper::pages/settings/staff.permission')]))\n ->success()\n ->send();\n }\n\n #[On('permissionAdded')]" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "store" function_lines = [[142, 178]] id = "shopperlabs-shopper-f3cb66743db8d5f1" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Customers/Create.php" post_fix = " public function store(): void\n {\n $this->authorize('add_customers');\n\n /** @var array $data */\n $data = $this->form->getState();\n $sendMail = data_get($data, 'send_mail');\n $password = data_get($data, 'password_confirmation');\n\n $customerData = Arr::only($data, [\n 'first_name',\n 'last_name',\n 'email',\n 'phone_number',\n 'gender',\n 'password',\n 'opt_in',\n ]);\n\n $address = array_merge(Arr::only($data, ['address'])['address'], [\n 'first_name' => $data['first_name'],\n 'last_name' => $data['last_name'],\n 'type' => AddressType::Shipping,\n ]);\n\n $userModel = config('auth.providers.users.model');\n\n /** @var ShopperUser $customer */\n $customer = $userModel::create(array_merge(\n $customerData,\n ['email_verified_at' => now()->toDateTimeString()],\n ));\n\n $customer->assignRole(config('shopper.admin.roles.user'));\n $customer->addresses()->create($address);\n\n if ($sendMail) {\n $customer->notify(new CustomerSendCredentials($password));\n }\n\n Notification::make()\n ->title(__('shopper::notifications.create', ['item' => __('shopper::pages/customers.single')]))\n ->success()\n ->send();\n\n $this->redirectRoute(name: 'shopper.customers.index', navigate: true);\n }\n" pre_fix = " public function store(): void\n {\n /** @var array $data */\n $data = $this->form->getState();\n $sendMail = data_get($data, 'send_mail');\n $password = data_get($data, 'password_confirmation');\n\n $customerData = Arr::except($data, ['address', 'send_mail', 'password_confirmation']);\n $address = array_merge(Arr::only($data, ['address'])['address'], [\n 'first_name' => $data['first_name'],\n 'last_name' => $data['last_name'],\n 'type' => AddressType::Shipping,\n ]);\n\n $userModel = config('auth.providers.users.model');\n\n /** @var ShopperUser $customer */\n $customer = $userModel::create(array_merge(\n $customerData,\n ['email_verified_at' => now()->toDateTimeString()],\n ));\n\n $customer->assignRole(config('shopper.admin.roles.user'));\n $customer->addresses()->create($address);\n\n if ($sendMail) {\n $customer->notify(new CustomerSendCredentials($password));\n }\n\n Notification::make()\n ->title(__('shopper::notifications.create', ['item' => __('shopper::pages/customers.single')]))\n ->success()\n ->send();\n\n $this->redirectRoute(name: 'shopper.customers.index', navigate: true);\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-f946-9qp6-vgch" advisory_text = "shopper/framework: Authorization bypass in multiple Livewire admin components\n\n## Impact\n\nMultiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:\n\n- Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with `read_orders` only and did not require `edit_orders`. `capturePayment` could trigger an actual PSP capture.\n- Order shipments table actions (mark delivered, edit tracking) were callable with `browse_orders` only.\n- Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on `store()`, so any authenticated panel user could mutate product data without `edit_products`.\n- `Settings/Team/Index` had no `mount()` authorization at all — any authenticated user could create roles and delete other users.\n- `Settings/Team/RolePermission` gated its write actions on the read-only `view_users` permission, allowing privilege escalation via the RBAC system itself.\n- `PaymentMethods`, `Currencies`, `Carriers` table toggles and per-record actions had no per-action permission check.\n- `Customers/Create::store()` re-passed a Hidden `_password` form field into the create payload.\n\nSeveral public Eloquent model properties on Livewire components were not `#[Locked]`, allowing client-side ID tampering.\n\nA stored XSS surface existed on the product barcode field, which is rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`.\n\n## Patches\n\nFixed in `v2.8.0`. Upgrade via:\n\n```bash\ncomposer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8\n```\n\n```shell\nphp artisan migrate\n```\n\n## Workarounds\n\nNone. Upgrade to `v2.8.0`.\n\n## Resources\n\n- Pull request: https://github.com/shopperlabs/shopper/pull/511\n- CWE-862 Missing Authorization\n- CWE-285 Improper Authorization" commit = "fcd0c5920588702df5b874f432b1042abd77a50b" cwe = "CWE-285" family = "access_control" function = "table" function_lines = [[67, 112]] id = "shopperlabs-shopper-fddd0d6c3c4501aa" language = "php" method = "fix_site" parent = "ceaea6a078025d4a7634d2646d27dde3f13b6f58" path = "packages/admin/src/Livewire/Pages/Settings/Carriers.php" post_fix = " public function table(Table $table): Table\n {\n return $table\n ->query(Carrier::query()->latest())\n ->columns([\n ImageColumn::make('logo')\n ->label(__('shopper::forms.label.logo'))\n ->circular()\n ->getStateUsing(fn (Carrier $record): ?string => resolve(CarrierRateService::class)->getLogoUrl($record))\n ->defaultImageUrl(shopper_fallback_url()),\n TextColumn::make('name')\n ->label(__('shopper::forms.label.name'))\n ->sortable()\n ->searchable(),\n TextColumn::make('driver')\n ->label(__('shopper::forms.label.driver'))\n ->badge()\n ->formatStateUsing(fn (?string $state): string => $state ? Shipping::driver($state)->name() : __('shopper::words.manual'))\n ->color(fn (?string $state, Carrier $record): string => match (true) {\n $state === null || $state === 'manual' => 'gray',\n resolve(CarrierRateService::class)->isDriverConfigured($record) => 'success',\n default => 'warning',\n }),\n ToggleColumn::make('is_enabled')\n ->label(__('shopper::forms.label.status'))\n ->beforeStateUpdated(fn (): mixed => $this->authorize('access_setting')),\n TextColumn::make('updated_at')\n ->label(__('shopper::forms.label.updated_at'))\n ->date(),\n ])\n ->recordActions([\n EditAction::make('edit')\n ->label(__('shopper::forms.actions.edit'))\n ->icon(Untitledui::Edit03)\n ->iconButton()\n ->authorize('access_setting')\n ->modalWidth(Width::ExtraLarge)\n ->schema($this->getCarrierFormSchema())\n ->successNotificationTitle(__('shopper::notifications.carrier.update')),\n DeleteAction::make('delete')\n ->label(__('shopper::forms.actions.delete'))\n ->icon(Untitledui::Trash03)\n ->authorize('access_setting')\n ->iconButton(),\n ])\n ->emptyStateIcon(Untitledui::Truck)\n ->emptyStateDescription(__('shopper::pages/settings/carriers.no_carrier'));\n }\n" pre_fix = " public function table(Table $table): Table\n {\n return $table\n ->query(Carrier::query()->latest())\n ->columns([\n ImageColumn::make('logo')\n ->label(__('shopper::forms.label.logo'))\n ->circular()\n ->getStateUsing(fn (Carrier $record): ?string => resolve(CarrierRateService::class)->getLogoUrl($record))\n ->defaultImageUrl(shopper_fallback_url()),\n TextColumn::make('name')\n ->label(__('shopper::forms.label.name'))\n ->sortable()\n ->searchable(),\n TextColumn::make('driver')\n ->label(__('shopper::forms.label.driver'))\n ->badge()\n ->formatStateUsing(fn (?string $state): string => $state ? Shipping::driver($state)->name() : __('shopper::words.manual'))\n ->color(fn (?string $state, Carrier $record): string => match (true) {\n $state === null || $state === 'manual' => 'gray',\n resolve(CarrierRateService::class)->isDriverConfigured($record) => 'success',\n default => 'warning',\n }),\n ToggleColumn::make('is_enabled')\n ->label(__('shopper::forms.label.status')),\n TextColumn::make('updated_at')\n ->label(__('shopper::forms.label.updated_at'))\n ->date(),\n ])\n ->recordActions([\n EditAction::make('edit')\n ->label(__('shopper::forms.actions.edit'))\n ->icon(Untitledui::Edit03)\n ->iconButton()\n ->modalWidth(Width::ExtraLarge)\n ->schema($this->getCarrierFormSchema())\n ->successNotificationTitle(__('shopper::notifications.carrier.update')),\n DeleteAction::make('delete')\n ->label(__('shopper::forms.actions.delete'))\n ->icon(Untitledui::Trash03)\n ->iconButton(),\n ])\n ->emptyStateIcon(Untitledui::Truck)\n ->emptyStateDescription(__('shopper::pages/settings/carriers.no_carrier'));\n }\n" repo = "shopperlabs/shopper" url = "https://github.com/shopperlabs/shopper.git" [[case]] advisory = "GHSA-7c82-mp33-r854" advisory_text = "Cross-site scripting in bootstrap-select\n\nbootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser." commit = "ab6e068748040cf3cda5859f6349b382402b8767" cwe = "CWE-79" family = "output_encoding" function = "scroll" function_lines = [[1000, 1854]] id = "snapappointments-bootstrap-select-5d3e7953302ad040" language = "javascript" method = "fix_site" parent = "bbd306de22fbcede9016cf7e335fd8ce34d6629d" path = "js/bootstrap-select.js" post_fix = " function scroll (scrollTop, init) {\n var size = that.selectpicker.current.elements.length,\n chunks = [],\n chunkSize,\n chunkCount,\n firstChunk,\n lastChunk,\n currentChunk,\n prevPositions,\n positionIsDifferent,\n previousElements,\n menuIsDifferent = true,\n isVirtual = that.isVirtual();\n\n that.selectpicker.view.scrollTop = scrollTop;\n\n if (isVirtual === true) {\n // if an option that is encountered that is wider than the current menu width, update the menu width accordingly\n if (that.sizeInfo.hasScrollBar && that.$menu[0].offsetWidth > that.sizeInfo.totalMenuWidth) {\n that.sizeInfo.menuWidth = that.$menu[0].offsetWidth;\n that.sizeInfo.totalMenuWidth = that.sizeInfo.menuWidth + that.sizeInfo.scrollBarWidth;\n that.$menu.css('min-width', that.sizeInfo.menuWidth);\n }\n }\n\n chunkSize = Math.ceil(that.sizeInfo.menuInnerHeight / that.sizeInfo.liHeight * 1.5); // number of options in a chunk\n chunkCount = Math.round(size / chunkSize) || 1; // number of chunks\n\n for (var i = 0; i < chunkCount; i++) {\n var endOfChunk = (i + 1) * chunkSize;\n\n if (i === chunkCount - 1) {\n endOfChunk = size;\n }\n\n chunks[i] = [\n (i) * chunkSize + (!i ? 0 : 1),\n endOfChunk\n ];\n\n if (!size) break;\n\n if (currentChunk === undefined && scrollTop <= that.selectpicker.current.data[endOfChunk - 1].position - that.sizeInfo.menuInnerHeight) {\n currentChunk = i;\n }\n }\n\n if (currentChunk === undefined) currentChunk = 0;\n\n prevPositions = [that.selectpicker.view.position0, that.selectpicker.view.position1];\n\n // always display previous, current, and next chunks\n firstChunk = Math.max(0, currentChunk - 1);\n lastChunk = Math.min(chunkCount - 1, currentChunk + 1);\n\n that.selectpicker.view.position0 = Math.max(0, chunks[firstChunk][0]) || 0;\n that.selectpicker.view.position1 = Math.min(size, chunks[lastChunk][1]) || 0;\n\n positionIsDifferent = prevPositions[0] !== that.selectpicker.view.position0 || prevPositions[1] !== that.selectpicker.view.position1;\n\n if (that.activeIndex !== undefined) {\n prevActive = that.selectpicker.current.elements[that.selectpicker.current.map.newIndex[that.prevActiveIndex]];\n active = that.selectpicker.current.elements[that.selectpicker.current.map.newIndex[that.activeIndex]];\n selected = that.selectpicker.current.elements[that.selectpicker.current.map.newIndex[that.selectedIndex]];\n\n if (init) {\n if (that.activeIndex !== that.selectedIndex && active && active.length) {\n active.classList.remove('active');\n if (active.firstChild) active.firstChild.classList.remove('active');\n }\n that.activeIndex = undefined;\n }\n\n if (that.activeIndex && that.activeIndex !== that.selectedIndex && selected && selected.length) {\n selected.classList.remove('active');\n if (selected.firstChild) selected.firstChild.classList.remove('active');\n }\n }\n\n if (that.prevActiveIndex !== undefined && that.prevActiveIndex !== that.activeIndex && that.prevActiveIndex !== that.selectedIndex && prevActive && prevActive.length) {\n prevActive.classList.remove('active');\n if (prevActive.firstChild) prevActive.firstChild.classList.remove('active');\n }\n\n if (init || positionIsDifferent) {\n previousElements = that.selectpicker.view.visibleElements ? that.selectpicker.view.visibleElements.slice() : [];\n\n that.selectpicker.view.visibleElements = that.selectpicker.current.elements.slice(that.selectpicker.view.position0, that.selectpicker.view.position1);\n\n that.setOptionStatus();\n\n // if searching, check to make sure the list has actually been updated before updating DOM\n // this prevents unnecessary repaints\n if (isSearching || (isVirtual === false && init)) menuIsDifferent = !isEqual(previousElements, that.selectpicker.view.visibleElements);\n\n // if virtual scroll is disabled and not searching,\n // menu should never need to be updated more than once\n if ((init || isVirtual === true) && menuIsDifferent) {\n var menuInner = that.$menuInner[0],\n menuFragment = document.createDocumentFragment(),\n emptyMenu = menuInner.firstChild.cloneNode(false),\n marginTop,\n marginBottom,\n elements = isVirtual === true ? that.selectpicker.view.visibleElements : that.selectpicker.current.elements,\n toSanitize = [];\n\n // replace the existing UL with an empty one - this is faster than $.empty()\n menuInner.replaceChild(emptyMenu, menuInner.firstChild);\n\n for (var i = 0, visibleElementsLen = elements.length; i < visibleElementsLen; i++) {\n var element = elements[i],\n elText,\n elementData;\n\n if (that.options.sanitize) {\n elText = element.lastChild;\n\n if (elText) {\n elementData = that.selectpicker.current.data[i + that.selectpicker.view.position0].data;\n\n if (elementData && elementData.content && !elementData.sanitized) {\n toSanitize.push(elText);\n elementData.sanitized = true;\n }\n }\n }\n\n menuFragment.appendChild(element);\n }\n\n if (that.options.sanitize && toSanitize.length) {\n sanitizeHtml(toSanitize, that.options.whiteList, that.options.sanitizeFn);\n }\n\n if (isVirtual === true) {\n marginTop = (that.selectpicker.view.position0 === 0 ? 0 : that.selectpicker.current.data[that.selectpicker.view.position0 - 1].position);\n marginBottom = (that.selectpicker.view.position1 > size - 1 ? 0 : that.selectpicker.current.data[size - 1].position - that.selectpicker.current.data[that.selectpicker.view.position1 - 1].position);\n\n menuInner.firstChild.style.marginTop = marginTop + 'px';\n menuInner.firstChild.style.marginBottom = marginBottom + 'px';\n }\n\n menuInner.firstChild.appendChild(menuFragment);\n }\n }\n\n that.prevActiveIndex = that.activeIndex;\n\n if (!that.options.liveSearch) {\n that.$menuInner.trigger('focus');\n } else if (isSearching && init) {\n var index = 0,\n newActive;\n\n if (!that.selectpicker.view.canHighlight[index]) {\n index = 1 + that.selectpicker.view.canHighlight.slice(1).indexOf(true);\n }\n\n newActive = that.selectpicker.view.visibleElements[index];\n\n if (that.selectpicker.view.currentActive) {\n that.selectpicker.view.currentActive.classList.remove('active');\n if (that.selectpicker.view.currentActive.firstChild) that.selectpicker.view.currentActive.firstChild.classList.remove('active');\n }\n\n if (newActive) {\n newActive.classList.add('active');\n if (newActive.firstChild) newActive.firstChild.classList.add('active');\n }\n\n that.activeIndex = that.selectpicker.current.map.originalIndex[index];\n }\n }\n\n $(window)\n .off('resize' + EVENT_KEY + '.' + this.selectId + '.createView')\n .on('resize' + EVENT_KEY + '.' + this.selectId + '.createView', function () {\n var isActive = that.$newElement.hasClass(classNames.SHOW);\n\n if (isActive) scroll(that.$menuInner[0].scrollTop);\n });\n },\n\n setPlaceholder: function () {\n var updateIndex = false;\n\n if (this.options.title && !this.multiple) {\n if (!this.selectpicker.view.titleOption) this.selectpicker.view.titleOption = document.createElement('option');\n\n // this option doesn't create a new

element, but does add a new option, so liIndex is decreased\n // since newIndex is recalculated on every refresh, liIndex needs to be decreased even if the titleOption is already appended\n updateIndex = true;\n\n var element = this.$element[0],\n isSelected = false,\n titleNotAppended = !this.selectpicker.view.titleOption.parentNode;\n\n if (titleNotAppended) {\n // Use native JS to prepend option (faster)\n this.selectpicker.view.titleOption.className = 'bs-title-option';\n this.selectpicker.view.titleOption.value = '';\n\n // Check if selected or data-selected attribute is already set on an option. If not, select the titleOption option.\n // the selected item may have been changed by user or programmatically before the bootstrap select plugin runs,\n // if so, the select will have the data-selected attribute\n var $opt = $(element.options[element.selectedIndex]);\n isSelected = $opt.attr('selected') === undefined && this.$element.data('selected') === undefined;\n }\n\n if (titleNotAppended || this.selectpicker.view.titleOption.index !== 0) {\n element.insertBefore(this.selectpicker.view.titleOption, element.firstChild);\n }\n\n // Set selected *after* appending to select,\n // otherwise the option doesn't get selected in IE\n // set using selectedIndex, as setting the selected attr to true here doesn't work in IE11\n if (isSelected) element.selectedIndex = 0;\n }\n\n return updateIndex;\n },\n\n createLi: function () {\n var that = this,\n iconBase = that.options.iconBase,\n mainElements = [],\n widestOption,\n widestOptionLength = 0,\n mainData = [],\n optID = 0,\n headerIndex = 0,\n liIndex = -1; // increment liIndex whenever a new

element is created to ensure newIndex is correct\n\n var checkMark;\n\n if (that.options.showTick || that.multiple) {\n checkMark = elementTemplates.span.cloneNode(false);\n checkMark.className = iconBase + ' ' + that.options.tickIcon + ' check-mark';\n elementTemplates.a.appendChild(checkMark);\n }\n\n if (this.setPlaceholder()) liIndex--;\n\n var selectOptions = this.$element[0].options;\n\n for (var index = 0, len = selectOptions.length; index < len; index++) {\n var option = selectOptions[index];\n\n liIndex++;\n\n if (option.classList.contains('bs-title-option')) continue;\n\n var thisData = {\n content: option.getAttribute('data-content'),\n tokens: option.getAttribute('data-tokens'),\n subtext: option.getAttribute('data-subtext'),\n icon: option.getAttribute('data-icon'),\n hidden: option.getAttribute('data-hidden') === 'true',\n divider: option.getAttribute('data-divider') === 'true'\n };\n\n // Get the class and text for the option\n var optionClass = option.className || '',\n cssText = option.style.cssText,\n inline = cssText ? htmlEscape(cssText) : '',\n optionContent = thisData.content,\n text = option.textContent,\n parent = option.parentNode,\n next = option.nextElementSibling,\n previous = option.previousElementSibling,\n isOptgroup = parent.tagName === 'OPTGROUP',\n isOptgroupDisabled = isOptgroup && parent.disabled,\n isDisabled = option.disabled || isOptgroupDisabled,\n prevHiddenIndex,\n showDivider = previous && previous.tagName === 'OPTGROUP',\n textElement,\n labelElement,\n prevHidden;\n\n var parentData = {\n hidden: parent.getAttribute('data-hidden') === 'true'\n };\n\n if (\n (\n (thisData.hidden === true || option.hidden) ||\n (isOptgroup && (parentData.hidden === true || parent.hidden))\n ) ||\n (that.options.hideDisabled && (isDisabled || isOptgroupDisabled))\n ) {\n // set prevHiddenIndex - the index of the first hidden option in a group of hidden options\n // used to determine whether or not a divider should be placed after an optgroup if there are\n // hidden options between the optgroup and the first visible option\n prevHiddenIndex = option.prevHiddenIndex;\n if (next) next.prevHiddenIndex = (prevHiddenIndex !== undefined ? prevHiddenIndex : index);\n\n liIndex--;\n\n continue;\n } else {\n if (next && next.prevHiddenIndex !== undefined) next.prevHiddenIndex = undefined;\n }\n\n if (isOptgroup && thisData.divider !== true) {\n var optGroupClass = ' ' + parent.className || '',\n previousOption = option.previousElementSibling;\n\n prevHiddenIndex = option.prevHiddenIndex;\n\n // Get the first visible option before the first hidden option in the group.\n // Ensures a divider is shown if, for example, the first option in the optgroup is hidden.\n if (prevHiddenIndex !== undefined) {\n previousOption = selectOptions[prevHiddenIndex].previousElementSibling;\n }\n\n // if there is no previous option, this option is the first visible option in the optgroup\n if (!previousOption) {\n optID += 1;\n\n parentData.subtext = parent.getAttribute('data-subtext');\n parentData.icon = parent.getAttribute('data-icon');\n\n // Get the opt group label\n var label = parent.label,\n labelEscaped = htmlEscape(label),\n labelSubtext = parentData.subtext,\n labelIcon = parentData.icon;\n\n if (index !== 0 && mainElements.length > 0) { // Is it NOT the first option of the select && are there elements in the dropdown?\n liIndex++;\n mainElements.push(\n generateOption.li(\n false,\n classNames.DIVIDER,\n optID + 'div'\n )\n );\n mainData.push({\n type: 'divider',\n optID: optID\n });\n }\n liIndex++;\n\n labelElement = generateOption.label({\n labelEscaped: labelEscaped,\n labelSubtext: labelSubtext,\n labelIcon: labelIcon,\n iconBase: iconBase\n });\n\n mainElements.push(generateOption.li(labelElement, 'dropdown-header' + optGroupClass, optID));\n mainData.push({\n content: labelEscaped,\n subtext: labelSubtext,\n type: 'optgroup-label',\n optID: optID\n });\n\n headerIndex = liIndex - 1;\n }\n\n textElement = generateOption.text({\n text: text,\n optionContent: optionContent,\n optionSubtext: thisData.subtext,\n optionIcon: thisData.icon,\n iconBase: iconBase\n });\n\n mainElements.push(generateOption.li(generateOption.a(textElement, 'opt ' + optionClass + optGroupClass, inline), '', optID));\n mainData.push({\n content: optionContent || text,\n subtext: thisData.subtext,\n tokens: thisData.tokens,\n type: 'option',\n optID: optID,\n headerIndex: headerIndex,\n lastIndex: headerIndex + parent.childElementCount,\n originalIndex: index,\n data: thisData\n });\n } else if (thisData.divider === true) {\n mainElements.push(generateOption.li(false, classNames.DIVIDER));\n mainData.push({\n type: 'divider',\n originalIndex: index,\n data: thisData\n });\n } else {\n if (that.options.hideDisabled) {\n if (showDivider) {\n var disabledOptions = previous.querySelectorAll('option:disabled');\n\n if (disabledOptions.length === previous.children.length) showDivider = false;\n } else {\n prevHiddenIndex = option.prevHiddenIndex;\n\n if (prevHiddenIndex !== undefined) {\n // select the element **before** the first hidden element in the group\n prevHidden = selectOptions[prevHiddenIndex].previousElementSibling;\n\n if (prevHidden && prevHidden.tagName === 'OPTGROUP' && !prevHidden.disabled) {\n var disabledOptions = prevHidden.querySelectorAll('option:disabled');\n\n if (disabledOptions.length < prevHidden.children.length) showDivider = true;\n }\n }\n }\n }\n\n if (showDivider && mainData.length && mainData[mainData.length - 1].type !== 'divider') {\n liIndex++;\n mainElements.push(\n generateOption.li(\n false,\n classNames.DIVIDER,\n optID + 'div'\n )\n );\n mainData.push({\n type: 'divider',\n optID: optID\n });\n }\n\n textElement = generateOption.text({\n text: text,\n optionContent: optionContent,\n optionSubtext: thisData.subtext,\n optionIcon: thisData.icon,\n iconBase: iconBase\n });\n\n mainElements.push(generateOption.li(generateOption.a(textElement, optionClass, inline)));\n mainData.push({\n content: optionContent || text,\n subtext: thisData.subtext,\n tokens: thisData.tokens,\n type: 'option',\n originalIndex: index,\n data: thisData\n });\n }\n\n that.selectpicker.main.map.newIndex[index] = liIndex;\n that.selectpicker.main.map.originalIndex[liIndex] = index;\n\n // get the most recent option info added to mainData\n var _mainDataLast = mainData[mainData.length - 1];\n\n _mainDataLast.disabled = isDisabled;\n\n var combinedLength = 0;\n\n // count the number of characters in the option - not perfect, but should work in most cases\n if (_mainDataLast.content) combinedLength += _mainDataLast.content.length;\n if (_mainDataLast.subtext) combinedLength += _mainDataLast.subtext.length;\n // if there is an icon, ensure this option's width is checked\n if (thisData.icon) combinedLength += 1;\n\n if (combinedLength > widestOptionLength) {\n widestOptionLength = combinedLength;\n\n // guess which option is the widest\n // use this when calculating menu width\n // not perfect, but it's fast, and the width will be updating accordingly when scrolling\n widestOption = mainElements[mainElements.length - 1];\n }\n }\n\n this.selectpicker.main.elements = mainElements;\n this.selectpicker.main.data = mainData;\n\n this.selectpicker.current = this.selectpicker.main;\n\n this.selectpicker.view.widestOption = widestOption;\n },\n\n findLis: function () {\n return this.$menuInner.find('.inner > li');\n },\n\n render: function () {\n // ensure titleOption is appended and selected (if necessary) before getting selectedOptions\n this.setPlaceholder();\n\n var that = this,\n selectedOptions = this.$element[0].selectedOptions,\n selectedCount = selectedOptions.length,\n buttonInner = this.$button.find('.filter-option-inner-inner')[0],\n multipleSeparator = document.createTextNode(this.options.multipleSeparator),\n titleFragment = elementTemplates.fragment.cloneNode(false),\n showCount,\n countMax;\n\n this.togglePlaceholder();\n\n this.tabIndex();\n\n if (this.options.selectedTextFormat === 'static') {\n titleFragment = generateOption.text({ text: this.options.title }, true);\n } else {\n showCount = this.multiple && this.options.selectedTextFormat.indexOf('count') !== -1 && selectedCount > 1;\n\n // determine if the number of selected options will be shown (showCount === true)\n if (showCount) {\n countMax = this.options.selectedTextFormat.split('>');\n showCount = (countMax.length > 1 && selectedCount > countMax[1]) || (countMax.length === 1 && selectedCount >= 2);\n }\n\n // only loop through all selected options if the count won't be shown\n if (showCount === false) {\n for (var selectedIndex = 0; selectedIndex < selectedCount; selectedIndex++) {\n if (selectedIndex < 50) {\n var option = selectedOptions[selectedIndex],\n titleOptions = {},\n thisData = {\n content: option.getAttribute('data-content'),\n subtext: option.getAttribute('data-subtext'),\n icon: option.getAttribute('data-icon')\n };\n\n if (this.multiple && selectedIndex > 0) {\n titleFragment.appendChild(multipleSeparator.cloneNode(false));\n }\n\n if (option.title) {\n titleOptions.text = option.title;\n } else if (thisData.content && that.options.showContent) {\n titleOptions.optionContent = thisData.content.toString();\n } else {\n if (that.options.showIcon) {\n titleOptions.optionIcon = thisData.icon;\n titleOptions.iconBase = this.options.iconBase;\n }\n if (that.options.showSubtext && !that.multiple && thisData.subtext) titleOptions.optionSubtext = ' ' + thisData.subtext;\n titleOptions.text = option.textContent.trim();\n }\n\n titleFragment.appendChild(generateOption.text(titleOptions, true));\n } else {\n break;\n }\n }\n\n // add ellipsis\n if (selectedCount > 49) {\n titleFragment.appendChild(document.createTextNode('...'));\n }\n } else {\n var optionSelector = ':not([hidden]):not([data-hidden=\"true\"]):not([data-divider=\"true\"])';\n if (this.options.hideDisabled) optionSelector += ':not(:disabled)';\n\n // If this is a multiselect, and selectedTextFormat is count, then show 1 of 2 selected, etc.\n var totalCount = this.$element[0].querySelectorAll('select > option' + optionSelector + ', optgroup' + optionSelector + ' option' + optionSelector).length,\n tr8nText = (typeof this.options.countSelectedText === 'function') ? this.options.countSelectedText(selectedCount, totalCount) : this.options.countSelectedText;\n\n titleFragment = generateOption.text({\n text: tr8nText.replace('{0}', selectedCount.toString()).replace('{1}', totalCount.toString())\n }, true);\n }\n }\n\n if (this.options.title == undefined) {\n // use .attr to ensure undefined is returned if title attribute is not set\n this.options.title = this.$element.attr('title');\n }\n\n // If the select doesn't have a title, then use the default, or if nothing is set at all, use noneSelectedText\n if (!titleFragment.childNodes.length) {\n titleFragment = generateOption.text({\n text: typeof this.options.title !== 'undefined' ? this.options.title : this.options.noneSelectedText\n }, true);\n }\n\n // strip all HTML tags and trim the result, then unescape any escaped tags\n this.$button[0].title = titleFragment.textContent.replace(/<[^>]*>?/g, '').trim();\n\n buttonInner.innerHTML = '';\n buttonInner.appendChild(titleFragment);\n\n this.$element.trigger('rendered' + EVENT_KEY);\n },\n\n /**\n * @param [style]\n * @param [status]\n */\n setStyle: function (style, status) {\n var button = this.$button[0];\n if (this.$element.attr('class')) {\n this.$newElement.addClass(this.$element.attr('class').replace(/selectpicker|mobile-device|bs-select-hidden|validate\\[.*\\]/gi, ''));\n }\n\n var buttonClass = style || this.options.style;\n\n if (status == 'add') {\n button.classList.add(buttonClass);\n } else if (status == 'remove') {\n button.classList.remove(buttonClass);\n } else {\n button.classList.remove(this.options.style);\n button.classList.add(buttonClass);\n }\n },\n\n liHeight: function (refresh) {\n if (!refresh && (this.options.size === false || this.sizeInfo)) return;\n\n if (!this.sizeInfo) this.sizeInfo = {};\n\n var newElement = document.createElement('div'),\n menu = document.createElement('div'),\n menuInner = document.createElement('div'),\n menuInnerInner = document.createElement('ul'),\n divider = document.createElement('li'),\n dropdownHeader = document.createElement('li'),\n li = document.createElement('li'),\n a = document.createElement('a'),\n text = document.createElement('span'),\n header = this.options.header && this.$menu.find('.' + classNames.POPOVERHEADER).length > 0 ? this.$menu.find('.' + classNames.POPOVERHEADER)[0].cloneNode(true) : null,\n search = this.options.liveSearch ? document.createElement('div') : null,\n actions = this.options.actionsBox && this.multiple && this.$menu.find('.bs-actionsbox').length > 0 ? this.$menu.find('.bs-actionsbox')[0].cloneNode(true) : null,\n doneButton = this.options.doneButton && this.multiple && this.$menu.find('.bs-donebutton').length > 0 ? this.$menu.find('.bs-donebutton')[0].cloneNode(true) : null,\n firstOption = this.$element.find('option')[0];\n\n this.sizeInfo.selectWidth = this.$newElement[0].offsetWidth;\n\n text.className = 'text';\n a.className = 'dropdown-item ' + (firstOption ? firstOption.className : '');\n newElement.className = this.$menu[0].parentNode.className + ' ' + classNames.SHOW;\n newElement.style.width = this.sizeInfo.selectWidth + 'px';\n if (this.options.width === 'auto') menu.style.minWidth = 0;\n menu.className = classNames.MENU + ' ' + classNames.SHOW;\n menuInner.className = 'inner ' + classNames.SHOW;\n menuInnerInner.className = classNames.MENU + ' inner ' + (version.major === '4' ? classNames.SHOW : '');\n divider.className = classNames.DIVIDER;\n dropdownHeader.className = 'dropdown-header';\n\n text.appendChild(document.createTextNode('\\u200b'));\n a.appendChild(text);\n li.appendChild(a);\n dropdownHeader.appendChild(text.cloneNode(true));\n\n if (this.selectpicker.view.widestOption) {\n menuInnerInner.appendChild(this.selectpicker.view.widestOption.cloneNode(true));\n }\n\n menuInnerInner.appendChild(li);\n menuInnerInner.appendChild(divider);\n menuInnerInner.appendChild(dropdownHeader);\n if (header) menu.appendChild(header);\n if (search) {\n var input = document.createElement('input');\n search.className = 'bs-searchbox';\n input.className = 'form-control';\n search.appendChild(input);\n menu.appendChild(search);\n }\n if (actions) menu.appendChild(actions);\n menuInner.appendChild(menuInnerInner);\n menu.appendChild(menuInner);\n if (doneButton) menu.appendChild(doneButton);\n newElement.appendChild(menu);\n\n document.body.appendChild(newElement);\n\n var liHeight = a.offsetHeight,\n dropdownHeaderHeight = dropdownHeader ? dropdownHeader.offsetHeight : 0,\n headerHeight = header ? header.offsetHeight : 0,\n searchHeight = search ? search.offsetHeight : 0,\n actionsHeight = actions ? actions.offsetHeight : 0,\n doneButtonHeight = doneButton ? doneButton.offsetHeight : 0,\n dividerHeight = $(divider).outerHeight(true),\n // fall back to jQuery if getComputedStyle is not supported\n menuStyle = window.getComputedStyle ? window.getComputedStyle(menu) : false,\n menuWidth = menu.offsetWidth,\n $menu = menuStyle ? null : $(menu),\n menuPadding = {\n vert: toInteger(menuStyle ? menuStyle.paddingTop : $menu.css('paddingTop')) +\n toInteger(menuStyle ? menuStyle.paddingBottom : $menu.css('paddingBottom')) +\n toInteger(menuStyle ? menuStyle.borderTopWidth : $menu.css('borderTopWidth')) +\n toInteger(menuStyle ? menuStyle.borderBottomWidth : $menu.css('borderBottomWidth')),\n horiz: toInteger(menuStyle ? menuStyle.paddingLeft : $menu.css('paddingLeft')) +\n toInteger(menuStyle ? menuStyle.paddingRight : $menu.css('paddingRight')) +\n toInteger(menuStyle ? menuStyle.borderLeftWidth : $menu.css('borderLeftWidth')) +\n toInteger(menuStyle ? menuStyle.borderRightWidth : $menu.css('borderRightWidth'))\n },\n menuExtras = {\n vert: menuPadding.vert +\n toInteger(menuStyle ? menuStyle.marginTop : $menu.css('marginTop')) +\n toInteger(menuStyle ? menuStyle.marginBottom : $menu.css('marginBottom')) + 2,\n horiz: menuPadding.horiz +\n toInteger(menuStyle ? menuStyle.marginLeft : $menu.css('marginLeft')) +\n toInteger(menuStyle ? menuStyle.marginRight : $menu.css('marginRight')) + 2\n },\n scrollBarWidth;\n\n menuInner.style.overflowY = 'scroll';\n\n scrollBarWidth = menu.offsetWidth - menuWidth;\n\n document.body.removeChild(newElement);\n\n this.sizeInfo.liHeight = liHeight;\n this.sizeInfo.dropdownHeaderHeight = dropdownHeaderHeight;\n this.sizeInfo.headerHeight = headerHeight;\n this.sizeInfo.searchHeight = searchHeight;\n this.sizeInfo.actionsHeight = actionsHeight;\n this.sizeInfo.doneButtonHeight = doneButtonHeight;\n this.sizeInfo.dividerHeight = dividerHeight;\n this.sizeInfo.menuPadding = menuPadding;\n this.sizeInfo.menuExtras = menuExtras;\n this.sizeInfo.menuWidth = menuWidth;\n this.sizeInfo.totalMenuWidth = this.sizeInfo.menuWidth;\n this.sizeInfo.scrollBarWidth = scrollBarWidth;\n this.sizeInfo.selectHeight = this.$newElement[0].offsetHeight;\n\n this.setPositionData();\n },\n\n getSelectPosition: function () {\n var that = this,\n $window = $(window),\n pos = that.$newElement.offset(),\n $container = $(that.options.container),\n containerPos;\n\n if (that.options.container && $container.length && !$container.is('body')) {\n containerPos = $container.offset();\n containerPos.top += parseInt($container.css('borderTopWidth'));\n containerPos.left += parseInt($container.css('borderLeftWidth'));\n } else {\n containerPos = { top: 0, left: 0 };\n }\n\n var winPad = that.options.windowPadding;\n\n this.sizeInfo.selectOffsetTop = pos.top - containerPos.top - $window.scrollTop();\n this.sizeInfo.selectOffsetBot = $window.height() - this.sizeInfo.selectOffsetTop - this.sizeInfo.selectHeight - containerPos.top - winPad[2];\n this.sizeInfo.selectOffsetLeft = pos.left - containerPos.left - $window.scrollLeft();\n this.sizeInfo.selectOffsetRight = $window.width() - this.sizeInfo.selectOffsetLeft - this.sizeInfo.selectWidth - containerPos.left - winPad[1];\n this.sizeInfo.selectOffsetTop -= winPad[0];\n this.sizeInfo.selectOffsetLeft -= winPad[3];\n },\n\n setMenuSize: function (isAuto) {\n this.getSelectPosition();\n\n var selectWidth = this.sizeInfo.selectWidth,\n liHeight = this.sizeInfo.liHeight,\n headerHeight = this.sizeInfo.headerHeight,\n searchHeight = this.sizeInfo.searchHeight,\n actionsHeight = this.sizeInfo.actionsHeight,\n doneButtonHeight = this.sizeInfo.doneButtonHeight,\n divHeight = this.sizeInfo.dividerHeight,\n menuPadding = this.sizeInfo.menuPadding,\n menuInnerHeight,\n menuHeight,\n divLength = 0,\n minHeight,\n _minHeight,\n maxHeight,\n menuInnerMinHeight,\n estimate;\n\n if (this.options.dropupAuto) {\n // Get the estimated height of the menu without scrollbars.\n // This is useful for smaller menus, where there might be plenty of room\n // below the button without setting dropup, but we can't know\n // the exact height of the menu until createView is called later\n estimate = liHeight * this.selectpicker.current.elements.length + menuPadding.vert;\n this.$newElement.toggleClass(classNames.DROPUP, this.sizeInfo.selectOffsetTop - this.sizeInfo.selectOffsetBot > this.sizeInfo.menuExtras.vert && estimate + this.sizeInfo.menuExtras.vert + 50 > this.sizeInfo.selectOffsetBot);\n }\n\n if (this.options.size === 'auto') {\n _minHeight = this.selectpicker.current.elements.length > 3 ? this.sizeInfo.liHeight * 3 + this.sizeInfo.menuExtras.vert - 2 : 0;\n menuHeight = this.sizeInfo.selectOffsetBot - this.sizeInfo.menuExtras.vert;\n minHeight = _minHeight + headerHeight + searchHeight + actionsHeight + doneButtonHeight;\n menuInnerMinHeight = Math.max(_minHeight - menuPadding.vert, 0);\n\n if (this.$newElement.hasClass(classNames.DROPUP)) {\n menuHeight = this.sizeInfo.selectOffsetTop - this.sizeInfo.menuExtras.vert;\n }\n\n maxHeight = menuHeight;\n menuInnerHeight = menuHeight - headerHeight - searchHeight - actionsHeight - doneButtonHeight - menuPadding.vert;\n } else if (this.options.size && this.options.size != 'auto' && this.selectpicker.current.elements.length > this.options.size) {\n for (var i = 0; i < this.options.size; i++) {\n if (this.selectpicker.current.data[i].type === 'divider') divLength++;\n }\n\n menuHeight = liHeight * this.options.size + divLength * divHeight + menuPadding.vert;\n menuInnerHeight = menuHeight - menuPadding.vert;\n maxHeight = menuHeight + headerHeight + searchHeight + actionsHeight + doneButtonHeight;\n minHeight = menuInnerMinHeight = '';\n }\n\n if (this.options.dropdownAlignRight === 'auto') {\n this.$menu.toggleClass(classNames.MENURIGHT, this.sizeInfo.selectOffsetLeft > this.sizeInfo.selectOffsetRight && this.sizeInfo.selectOffsetRight < (this.sizeInfo.totalMenuWidth - selectWidth));\n }\n\n this.$menu.css({\n 'max-height': maxHeight + 'px',\n 'overflow': 'hidden',\n 'min-height': minHeight + 'px'\n });\n\n this.$menuInner.css({\n 'max-height': menuInnerHeight + 'px',\n 'overflow-y': 'auto',\n 'min-height': menuInnerMinHeight + 'px'\n });\n\n // ensure menuInnerHeight is always a positive number to prevent issues calculating chunkSize in createView\n this.sizeInfo.menuInnerHeight = Math.max(menuInnerHeight, 1);\n\n if (this.selectpicker.current.data.length && this.selectpicker.current.data[this.selectpicker.current.data.length - 1].position > this.sizeInfo.menuInnerHeight) {\n this.sizeInfo.hasScrollBar = true;\n this.sizeInfo.totalMenuWidth = this.sizeInfo.menuWidth + this.sizeInfo.scrollBarWidth;\n\n this.$menu.css('min-width', this.sizeInfo.totalMenuWidth);\n }\n\n if (this.dropdown && this.dropdown._popper) this.dropdown._popper.update();\n },\n\n setSize: function (refresh) {\n this.liHeight(refresh);\n\n if (this.options.header) this.$menu.css('padding-top', 0);\n if (this.options.size === false) return;\n\n var that = this,\n $window = $(window),\n selectedIndex,\n offset = 0;\n\n this.setMenuSize();\n\n if (this.options.liveSearch) {\n this.$searchbox\n .off('input.setMenuSize propertychange.setMenuSize')\n .on('input.setMenuSize propertychange.setMenuSize', function () {\n return that.setMenuSize();\n });\n }\n\n if (this.options.size === 'auto') {\n $window\n .off('resize' + EVENT_KEY + '.' + this.selectId + '.setMenuSize' + ' scroll' + EVENT_KEY + '.' + this.selectId + '.setMenuSize')\n .on('resize' + EVENT_KEY + '.' + this.selectId + '.setMenuSize' + ' scroll' + EVENT_KEY + '.' + this.selectId + '.setMenuSize', function () {\n return that.setMenuSize();\n });\n } else if (this.options.size && this.options.size != 'auto' && this.selectpicker.current.elements.length > this.options.size) {\n $window.off('resize' + EVENT_KEY + '.' + this.selectId + '.setMenuSize' + ' scroll' + EVENT_KEY + '.' + this.selectId + '.setMenuSize');\n }\n\n if (refresh) {\n offset = this.$menuInner[0].scrollTop;\n } else if (!that.multiple) {\n selectedIndex = that.selectpicker.main.map.newIndex[that.$element[0].selectedIndex];\n\n if (typeof selectedIndex === 'number' && that.options.size !== false) {\n offset = that.sizeInfo.liHeight * selectedIndex;\n offset = offset - (that.sizeInfo.menuInnerHeight / 2) + (that.sizeInfo.liHeight / 2);\n }\n }\n\n that.createView(false, offset);\n },\n\n setWidth: function () {\n var that = this;\n\n if (this.options.width === 'auto') {" repo = "snapappointments/bootstrap-select" url = "https://github.com/snapappointments/bootstrap-select.git" [[case]] advisory = "GHSA-fggg-964j-3j7h" advisory_text = "Spatie Laravel Media Library contains a server-side request forgery vulnerability\n\nSpatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php." commit = "608ea03703d3887c46434f5dda6af56de6346aba" cwe = "CWE-918" family = "untrusted_destination" function = "defaultSanitizer" function_lines = [[470, 489]] id = "spatie-laravel-medialibrary-17bc134397b9d3f7" language = "php" method = "fix_site" parent = "eea7cc3ba711827d3472e2c0ce4f6554d711c0a1" path = "src/MediaCollections/FileAdder.php" post_fix = " public function defaultSanitizer(string $fileName): string\n {\n $sanitizedFileName = preg_replace('#\\p{C}+#u', '', $fileName);\n\n $sanitizedFileName = str_replace(['#', '/', '\\\\', ' '], '-', $sanitizedFileName);\n\n $this->guardAgainstDisallowedFileName($fileName, $sanitizedFileName);\n\n return $sanitizedFileName;\n }\n" pre_fix = " public function defaultSanitizer(string $fileName): string\n {\n $sanitizedFileName = preg_replace('#\\p{C}+#u', '', $fileName);\n\n $sanitizedFileName = str_replace(['#', '/', '\\\\', ' '], '-', $sanitizedFileName);\n\n $phpExtensions = [\n '.php', '.php3', '.php4', '.php5', '.php7', '.php8', '.phtml', '.phar',\n ];\n\n if (Str::endsWith(strtolower($sanitizedFileName), $phpExtensions)) {\n throw FileNameNotAllowed::create($fileName, $sanitizedFileName);\n }\n\n return $sanitizedFileName;\n }\n\n /**\n * @return $this\n */" repo = "spatie/laravel-medialibrary" url = "https://github.com/spatie/laravel-medialibrary.git" [[case]] advisory = "GHSA-fggg-964j-3j7h" advisory_text = "Spatie Laravel Media Library contains a server-side request forgery vulnerability\n\nSpatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php." commit = "608ea03703d3887c46434f5dda6af56de6346aba" cwe = "CWE-918" family = "untrusted_destination" function = "create" function_lines = [[7, 11]] id = "spatie-laravel-medialibrary-9b12f440411602e2" language = "php" method = "fix_site" parent = "eea7cc3ba711827d3472e2c0ce4f6554d711c0a1" path = "src/MediaCollections/Exceptions/FileNameNotAllowed.php" post_fix = " public static function create(string $originalName, string $sanitizedName, ?string $extension = null): self\n {\n $reason = $extension !== null\n ? \"The extension `{$extension}` is not allowed because it poses a security risk.\"\n : 'Its extension is not allowed because it poses a security risk.';\n\n return new static(\"The file name `{$originalName}` was sanitized to `{$sanitizedName}`. {$reason}\");\n }\n}" pre_fix = " public static function create(string $orignalName, string $sanitizedName): self\n {\n return new static(\"The file name `{$orignalName}` was sanitized to `{$sanitizedName}`. This sanitized file name is not allowed because it is a PHP file.\");\n }\n}" repo = "spatie/laravel-medialibrary" url = "https://github.com/spatie/laravel-medialibrary.git" [[case]] advisory = "GHSA-8r88-6cj9-9fh5" advisory_text = "auth-js Vulnerable to Insecure Path Routing from Malformed User Input\n\n### Impact\nThe library functions `getUserById`, `deleteUser`, `updateUserById`, `listFactors` and `deleteFactor` did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called.\n\nImplementations that follow security best practice and validate user controlled inputs, such as the `userId` are not affected by this.\n\n### Patches\nStrict value checks have been added to all affected functions. These functions now require that the `userId` and `factorId` parameters MUST be valid UUID (v4).\n\n**Patched version:** >= 2.69.1\n\n### Workarounds\nImplementations that follow security best practice and validate user controlled inputs, such as the `userId` are not affected by this. It is recommended that users of the auth-js library always follow security best practice and validate all inputs, before passing these to other functions or libraries.\n\n### References\nhttps://github.com/supabase/auth-js/pull/1063" commit = "1bcb76e479e51cd9bca2d7732d0bf3199e07a693" cwe = "CWE-22" family = "path" function = "getAlgorithm" function_lines = [[343, 359]] id = "supabase-auth-js-13d9df5e852b0156" language = "typescript" method = "fix_site" parent = "eff5048a41a6af908f752e25a40f29b43dc824b3" path = "src/lib/helpers.ts" post_fix = "export function getAlgorithm(alg: 'RS256' | 'ES256'): RsaHashedImportParams | EcKeyImportParams {\n switch (alg) {\n case 'RS256':\n return {\n name: 'RSASSA-PKCS1-v1_5',\n hash: { name: 'SHA-256' },\n }\n case 'ES256':\n return {\n name: 'ECDSA',\n namedCurve: 'P-256',\n hash: { name: 'SHA-256' },\n }\n default:\n throw new Error('Invalid alg claim')\n }\n}\n\nconst UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/\n" pre_fix = "export function getAlgorithm(alg: 'RS256' | 'ES256'): RsaHashedImportParams | EcKeyImportParams {\n switch (alg) {\n case 'RS256':\n return {\n name: 'RSASSA-PKCS1-v1_5',\n hash: { name: 'SHA-256' },\n }\n case 'ES256':\n return {\n name: 'ECDSA',\n namedCurve: 'P-256',\n hash: { name: 'SHA-256' },\n }\n default:\n throw new Error('Invalid alg claim')\n }\n}" repo = "supabase/auth-js" url = "https://github.com/supabase/auth-js.git" [[case]] advisory = "GHSA-824w-x939-6cmc" advisory_text = "TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint\n\n### Impact\n\nThe `/internal/object_storage` endpoint accepts a caller-supplied JSON `storage_path` parameter that dynamically overrides the TensorZero `[object_storage]` configuration.\n\nBy abusing the `filesystem` storage type, a caller can read arbitrary files from the gateway filesystem, including files that may contain sensitive credentials. Similarly, by abusing the `s3_compatible` storage type, the caller can coerce the gateway into making outbound object storage requests to attacker-chosen internal/cloud-metadata endpoints.\n\nThis vulnerability only applies when the gateway can be accessed by untrusted callers. If a developer's TensorZero deployment has authentication enabled, only authenticated callers can exploit this vulnerability. If a developer's deployment has authentication disabled, any caller can exploit this vulnerability.\n\n### Remediation\n\nThe vulnerability has been patched in version `2026.6.0`. See PR #7527.\n\n### Workarounds\n\nIf developers are unable to upgrade a gateway that is exposed to untrusted callers, please block external access to the `/internal/object_storage` endpoint." commit = "0abbc838bae3394fe7491dad7009670d4e3b6cf8" cwe = "CWE-918" family = "untrusted_destination" function = "resolveFile" function_lines = [[115, 133]] id = "tensorzero-tensorzero-1df57d6b5c9fc101" language = "typescript" method = "fix_site" parent = "61761d5afca5899534697db9a20e9cc0e0bc17f8" path = "ui/app/utils/resolve.server.ts" post_fix = "async function resolveFile(\n content: ZodFileContent,\n): Promise {\n const object = await getTensorZeroClient().getObject(\n content.storage_path.path,\n );\n const json = JSON.parse(object);\n return {\n // Keep the canonical internal representation as raw base64.\n // Display code can wrap this in a data URL or Blob URL as needed.\n data: json.data,\n mime_type: content.file.mime_type,\n };\n}\n\n/**\n * Loads the content of files for an `Input`.\n * Converts `ObjectStoragePointer` to `File` with `file_type: \"object_storage\"`.\n *\n * TODO (#4674 #4675): This will be handled in the gateway.\n */" pre_fix = "async function resolveFile(\n content: ZodFileContent,\n): Promise {\n const object = await getTensorZeroClient().getObject(content.storage_path);\n const json = JSON.parse(object);\n return {\n // Keep the canonical internal representation as raw base64.\n // Display code can wrap this in a data URL or Blob URL as needed.\n data: json.data,\n mime_type: content.file.mime_type,\n };\n}\n\n/**\n * Loads the content of files for an `Input`.\n * Converts `ObjectStoragePointer` to `File` with `file_type: \"object_storage\"`.\n *\n * TODO (#4674 #4675): This will be handled in the gateway.\n */" repo = "tensorzero/tensorzero" url = "https://github.com/tensorzero/tensorzero.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "loader" function_lines = [[23, 75]] id = "triggerdotdev-trigger.dev-00a60694b44cad58" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/routes/account.authorization-code.$authorizationCode/route.tsx" post_fix = "export const loader = async ({ request, params }: LoaderFunctionArgs) => {\n await requireUserId(request);\n\n const { authorizationCode } = parseParams(params);\n const { source, clientName } = parseSearch(request);\n\n const mintable = await isAuthorizationCodeMintable(authorizationCode);\n\n return typedjson({\n status: mintable ? (\"consent\" as const) : (\"invalid\" as const),\n source,\n clientName,\n });\n};\n" pre_fix = "export const loader = async ({ request, params }: LoaderFunctionArgs) => {\n const userId = await requireUserId(request);\n\n const parsedParams = ParamsSchema.safeParse(params);\n\n if (!parsedParams.success) {\n logger.info(\"Invalid params\", { params });\n throw new Response(undefined, {\n status: 400,\n statusText: \"Invalid params\",\n });\n }\n\n const url = new URL(request.url);\n const searchObject = Object.fromEntries(url.searchParams.entries());\n\n const searchParams = SearchParamsSchema.safeParse(searchObject);\n\n const source = (searchParams.success ? searchParams.data.source : undefined) ?? \"cli\";\n const clientName = (searchParams.success ? searchParams.data.clientName : undefined) ?? \"unknown\";\n\n try {\n const _personalAccessToken = await createPersonalAccessTokenFromAuthorizationCode(\n parsedParams.data.authorizationCode,\n userId\n );\n return typedjson({\n success: true as const,\n source,\n clientName,\n });\n } catch (error) {\n if (error instanceof Response) {\n throw error;\n }\n\n if (error instanceof Error) {\n return typedjson({\n success: false as const,\n error: error.message,\n source,\n clientName,\n });\n }\n\n logger.error(JSON.stringify(error));\n throw new Response(undefined, {\n status: 400,\n statusText: \"Something went wrong, if this problem persists please contact support.\",\n });\n }\n};\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "getExecutionSnapshotsSince" function_lines = [[291, 642]] id = "triggerdotdev-trigger.dev-017c730f695963d1" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "internal-packages/run-engine/src/engine/systems/executionSnapshotSystem.ts" post_fix = "export async function getExecutionSnapshotsSince(\n prisma: PrismaClientOrTransaction,\n runId: string,\n sinceSnapshotId: string,\n runStore?: RunStore,\n // The primary, for read-repair when `prisma` is a lagging read replica (see Step 3). Omit when\n // `prisma` is already the primary.\n repairClient?: PrismaClientOrTransaction,\n // When set, scopes both reads to this environment (tenant boundary): a run in another env reads as\n // not-found. Omit to read regardless of environment (internal callers).\n environmentId?: string\n): Promise {\n const envScope = environmentId ? { environmentId } : {};\n\n // Step 1: Find the createdAt of the sinceSnapshotId\n const sinceSnapshot = runStore\n ? await runStore.findExecutionSnapshot(\n {\n where: { id: sinceSnapshotId, runId, ...envScope },\n select: { createdAt: true },\n },\n prisma\n )\n : await prisma.taskRunExecutionSnapshot.findFirst({\n where: { id: sinceSnapshotId, runId, ...envScope },\n select: { createdAt: true },\n });\n\n if (!sinceSnapshot) {\n throw new ExecutionSnapshotNotFoundError(sinceSnapshotId);\n }\n\n // Step 2: Fetch snapshots WITHOUT waitpoints to avoid N×M data explosion\n const snapshots = runStore\n ? await runStore.findManyExecutionSnapshots(\n {\n where: {\n runId,\n isValid: true,\n createdAt: { gt: sinceSnapshot.createdAt },\n ...envScope,\n },\n include: {\n checkpoint: true,\n // DO NOT include completedWaitpoints here - this causes the N×M explosion\n },\n orderBy: { createdAt: \"desc\" },\n take: 50,\n },\n prisma\n )\n : await prisma.taskRunExecutionSnapshot.findMany({\n where: {\n runId,\n isValid: true,\n createdAt: { gt: sinceSnapshot.createdAt },\n ...envScope,\n },\n include: {\n checkpoint: true,\n // DO NOT include completedWaitpoints here - this causes the N×M explosion\n },\n orderBy: { createdAt: \"desc\" },\n take: 50,\n });\n\n if (snapshots.length === 0) return [];\n\n // Step 3: Get waitpoint IDs for the LATEST snapshot only (first in desc order)\n const latestSnapshot = snapshots[0];\n let readClient = prisma;\n const { present, ids } = await getSnapshotWaitpointIdsWithPresence(\n prisma,\n latestSnapshot.id,\n runStore,\n runId\n );\n let waitpointIds = ids;\n\n // Read-repair (multi-reader): Step 2 saw this snapshot, but on a multi-reader replica the join read\n // can hit a laggier reader that does not have it yet. present=false means its empty id list is not\n // authoritative - re-read from the primary so the runner is not handed a waitpoint-less continue\n // (which it silently drops, hanging the run). Single-reader replicas never hit this (present stays true).\n if (repairClient && repairClient !== prisma && !present) {\n waitpointIds = await getSnapshotWaitpointIds(repairClient, latestSnapshot.id, runStore, runId);\n readClient = repairClient;\n }\n\n // Read-repair (batch): completedWaitpointOrder is written on the snapshot row in the same statement as the\n // snapshot, so it is authoritative. If it lists more waitpoints than the join read returned, the\n // _completedWaitpoints rows are stale on this client (a lagging read replica) - re-read them from the\n // primary so the runner is not handed a waitpoint-less continue, which it drops and the run hangs.\n // Distinct: completedWaitpointOrder can list the same id twice (a run batched under one idempotency\n // key) while the _completedWaitpoints join is deduped, so compare unique ids or the repair fires every\n // poll even against a caught-up replica.\n const expectedCount = new Set(latestSnapshot.completedWaitpointOrder ?? []).size;\n if (repairClient && repairClient !== prisma && waitpointIds.length < expectedCount) {\n const repaired = await getSnapshotWaitpointIds(\n repairClient,\n latestSnapshot.id,\n runStore,\n runId\n );\n if (repaired.length > waitpointIds.length) {\n waitpointIds = repaired;\n readClient = repairClient;\n }\n }\n\n // Step 4: Fetch waitpoints in chunks to avoid NAPI string conversion limits\n const waitpoints = await fetchWaitpointsInChunks(readClient, waitpointIds, runStore, runId);\n\n // Step 5: Build enhanced snapshots - only latest gets waitpoints, others get empty arrays\n // The runner only uses completedWaitpoints from the latest snapshot anyway\n return snapshots.reverse().map((snapshot) => {\n const isLatest = snapshot.id === latestSnapshot.id;\n return enhanceExecutionSnapshotWithWaitpoints(\n snapshot,\n isLatest ? waitpoints : [],\n latestSnapshot.completedWaitpointOrder\n );\n });\n}\n\nexport class ExecutionSnapshotSystem {\n private readonly $: SystemResources;\n private readonly heartbeatTimeouts: HeartbeatTimeouts;\n\n constructor(private readonly options: ExecutionSnapshotSystemOptions) {\n this.$ = options.resources;\n this.heartbeatTimeouts = options.heartbeatTimeouts;\n }\n\n public async createExecutionSnapshot(\n prisma: PrismaClientOrTransaction,\n {\n run,\n snapshot,\n previousSnapshotId,\n batchId,\n environmentId,\n environmentType,\n projectId,\n organizationId,\n checkpointId,\n workerId,\n runnerId,\n completedWaitpoints,\n error,\n }: {\n run: { id: string; status: TaskRunStatus; attemptNumber?: number | null };\n snapshot: {\n executionStatus: TaskRunExecutionStatus;\n description: string;\n metadata?: Prisma.JsonValue;\n };\n previousSnapshotId?: string;\n batchId?: string;\n environmentId: string;\n environmentType: RuntimeEnvironmentType;\n projectId: string;\n organizationId: string;\n checkpointId?: string;\n workerId?: string;\n runnerId?: string;\n completedWaitpoints?: {\n id: string;\n index?: number;\n }[];\n error?: string;\n },\n // When set (inside runStore.runInTransaction), the snapshot write goes through the owning store\n // with `prisma` = that store's own tx, so it shares ONE transaction with the sibling write (e.g.\n // startAttempt) and a mid-pair failure rolls both back. Otherwise the router routes it.\n // The heartbeat/eventBus side effects below are unchanged.\n store?: RunStore\n ) {\n const newSnapshot = await (store ?? this.$.runStore).createExecutionSnapshot(\n {\n run,\n snapshot,\n previousSnapshotId,\n batchId,\n environmentId,\n environmentType,\n projectId,\n organizationId,\n checkpointId,\n workerId,\n runnerId,\n completedWaitpoints,\n error,\n },\n prisma\n );\n\n if (!error) {\n //set heartbeat (if relevant)\n const intervalMs = this.#getHeartbeatIntervalMs(newSnapshot.executionStatus);\n if (intervalMs !== null) {\n await this.$.worker.enqueue({\n id: `heartbeatSnapshot.${run.id}`,\n job: \"heartbeatSnapshot\",\n payload: { snapshotId: newSnapshot.id, runId: run.id },\n availableAt: new Date(Date.now() + intervalMs),\n });\n }\n }\n\n this.$.eventBus.emit(\"executionSnapshotCreated\", {\n time: newSnapshot.createdAt,\n run: {\n id: newSnapshot.runId,\n },\n snapshot: {\n ...newSnapshot,\n completedWaitpointIds: completedWaitpoints?.map((w) => w.id) ?? [],\n },\n });\n\n return {\n ...newSnapshot,\n friendlyId: SnapshotId.toFriendlyId(newSnapshot.id),\n runFriendlyId: RunId.toFriendlyId(newSnapshot.runId),\n };\n }\n\n public async heartbeatRun({\n runId,\n snapshotId,\n workerId,\n runnerId,\n tx,\n }: {\n runId: string;\n snapshotId: string;\n workerId?: string;\n runnerId?: string;\n tx?: PrismaClientOrTransaction;\n }): Promise {\n const prisma = tx ?? this.$.prisma;\n\n //we don't need to acquire a run lock for any of this, it's not critical if it happens on an older version\n const latestSnapshot = await getLatestExecutionSnapshot(prisma, runId, this.$.runStore);\n if (latestSnapshot.id !== snapshotId) {\n this.$.logger.log(\"heartbeatRun: no longer the latest snapshot, stopping the heartbeat.\", {\n runId,\n snapshotId,\n latestSnapshot,\n workerId,\n runnerId,\n });\n\n return executionResultFromSnapshot(latestSnapshot);\n }\n\n if (latestSnapshot.workerId && latestSnapshot.workerId !== workerId) {\n this.$.logger.debug(\"heartbeatRun: worker ID does not match the latest snapshot\", {\n runId,\n snapshotId,\n latestSnapshot,\n workerId,\n runnerId,\n });\n }\n\n this.$.logger.info(\"heartbeatRun snapshot heartbeat updated\", {\n id: latestSnapshot.id,\n runId: latestSnapshot.runId,\n lastHeartbeatAt: new Date(),\n });\n\n //extending the heartbeat\n const intervalMs = this.#getHeartbeatIntervalMs(latestSnapshot.executionStatus);\n if (intervalMs !== null) {\n await this.$.worker.reschedule(\n `heartbeatSnapshot.${runId}`,\n new Date(Date.now() + intervalMs)\n );\n }\n\n return executionResultFromSnapshot(latestSnapshot);\n }\n\n public async restartHeartbeatForRun({\n runId,\n delayMs,\n restartAttempt,\n tx,\n }: {\n runId: string;\n delayMs: number;\n restartAttempt: number;\n tx?: PrismaClientOrTransaction;\n }): Promise {\n const prisma = tx ?? this.$.prisma;\n\n const latestSnapshot = await getLatestExecutionSnapshot(prisma, runId, this.$.runStore);\n\n this.$.logger.debug(\"restartHeartbeatForRun: enqueuing heartbeat\", {\n runId,\n snapshotId: latestSnapshot.id,\n delayMs,\n });\n\n await this.$.worker.enqueue({\n id: `heartbeatSnapshot.${runId}`,\n job: \"heartbeatSnapshot\",\n payload: { snapshotId: latestSnapshot.id, runId, restartAttempt },\n availableAt: new Date(Date.now() + delayMs),\n });\n\n return executionResultFromSnapshot(latestSnapshot);\n }\n\n /**\n * Enqueues a heartbeat job for a snapshot if the execution status requires one.\n * Use this after nesting a snapshot create inside a taskRun.update() to replicate\n * the heartbeat side effect that createExecutionSnapshot normally handles.\n */\n public async enqueueHeartbeatIfNeeded(snapshot: {\n id: string;\n runId: string;\n executionStatus: TaskRunExecutionStatus;\n }) {\n const intervalMs = this.#getHeartbeatIntervalMs(snapshot.executionStatus);\n if (intervalMs !== null) {\n await this.$.worker.enqueue({\n id: `heartbeatSnapshot.${snapshot.runId}`,\n job: \"heartbeatSnapshot\",\n payload: { snapshotId: snapshot.id, runId: snapshot.runId },\n availableAt: new Date(Date.now() + intervalMs),\n });\n }\n }\n\n #getHeartbeatIntervalMs(status: TaskRunExecutionStatus): number | null {\n switch (status) {\n case \"PENDING_EXECUTING\": {\n return this.heartbeatTimeouts.PENDING_EXECUTING;\n }\n case \"PENDING_CANCEL\": {\n return this.heartbeatTimeouts.PENDING_CANCEL;\n }\n case \"EXECUTING\": {\n return this.heartbeatTimeouts.EXECUTING;\n }\n case \"EXECUTING_WITH_WAITPOINTS\": {\n return this.heartbeatTimeouts.EXECUTING_WITH_WAITPOINTS;\n }\n case \"SUSPENDED\": {\n return this.heartbeatTimeouts.SUSPENDED;\n }\n default: {\n return null;\n }\n }\n }\n}" pre_fix = "export async function getExecutionSnapshotsSince(\n prisma: PrismaClientOrTransaction,\n runId: string,\n sinceSnapshotId: string,\n runStore?: RunStore,\n // The primary, for read-repair when `prisma` is a lagging read replica (see Step 3). Omit when\n // `prisma` is already the primary.\n repairClient?: PrismaClientOrTransaction\n): Promise {\n // Step 1: Find the createdAt of the sinceSnapshotId\n const sinceSnapshot = runStore\n ? await runStore.findExecutionSnapshot(\n {\n where: { id: sinceSnapshotId, runId },\n select: { createdAt: true },\n },\n prisma\n )\n : await prisma.taskRunExecutionSnapshot.findFirst({\n where: { id: sinceSnapshotId, runId },\n select: { createdAt: true },\n });\n\n if (!sinceSnapshot) {\n throw new ExecutionSnapshotNotFoundError(sinceSnapshotId);\n }\n\n // Step 2: Fetch snapshots WITHOUT waitpoints to avoid N×M data explosion\n const snapshots = runStore\n ? await runStore.findManyExecutionSnapshots(\n {\n where: {\n runId,\n isValid: true,\n createdAt: { gt: sinceSnapshot.createdAt },\n },\n include: {\n checkpoint: true,\n // DO NOT include completedWaitpoints here - this causes the N×M explosion\n },\n orderBy: { createdAt: \"desc\" },\n take: 50,\n },\n prisma\n )\n : await prisma.taskRunExecutionSnapshot.findMany({\n where: {\n runId,\n isValid: true,\n createdAt: { gt: sinceSnapshot.createdAt },\n },\n include: {\n checkpoint: true,\n // DO NOT include completedWaitpoints here - this causes the N×M explosion\n },\n orderBy: { createdAt: \"desc\" },\n take: 50,\n });\n\n if (snapshots.length === 0) return [];\n\n // Step 3: Get waitpoint IDs for the LATEST snapshot only (first in desc order)\n const latestSnapshot = snapshots[0];\n let readClient = prisma;\n const { present, ids } = await getSnapshotWaitpointIdsWithPresence(\n prisma,\n latestSnapshot.id,\n runStore,\n runId\n );\n let waitpointIds = ids;\n\n // Read-repair (multi-reader): Step 2 saw this snapshot, but on a multi-reader replica the join read\n // can hit a laggier reader that does not have it yet. present=false means its empty id list is not\n // authoritative - re-read from the primary so the runner is not handed a waitpoint-less continue\n // (which it silently drops, hanging the run). Single-reader replicas never hit this (present stays true).\n if (repairClient && repairClient !== prisma && !present) {\n waitpointIds = await getSnapshotWaitpointIds(repairClient, latestSnapshot.id, runStore, runId);\n readClient = repairClient;\n }\n\n // Read-repair (batch): completedWaitpointOrder is written on the snapshot row in the same statement as the\n // snapshot, so it is authoritative. If it lists more waitpoints than the join read returned, the\n // _completedWaitpoints rows are stale on this client (a lagging read replica) - re-read them from the\n // primary so the runner is not handed a waitpoint-less continue, which it drops and the run hangs.\n // Distinct: completedWaitpointOrder can list the same id twice (a run batched under one idempotency\n // key) while the _completedWaitpoints join is deduped, so compare unique ids or the repair fires every\n // poll even against a caught-up replica.\n const expectedCount = new Set(latestSnapshot.completedWaitpointOrder ?? []).size;\n if (repairClient && repairClient !== prisma && waitpointIds.length < expectedCount) {\n const repaired = await getSnapshotWaitpointIds(\n repairClient,\n latestSnapshot.id,\n runStore,\n runId\n );\n if (repaired.length > waitpointIds.length) {\n waitpointIds = repaired;\n readClient = repairClient;\n }\n }\n\n // Step 4: Fetch waitpoints in chunks to avoid NAPI string conversion limits\n const waitpoints = await fetchWaitpointsInChunks(readClient, waitpointIds, runStore, runId);\n\n // Step 5: Build enhanced snapshots - only latest gets waitpoints, others get empty arrays\n // The runner only uses completedWaitpoints from the latest snapshot anyway\n return snapshots.reverse().map((snapshot) => {\n const isLatest = snapshot.id === latestSnapshot.id;\n return enhanceExecutionSnapshotWithWaitpoints(\n snapshot,\n isLatest ? waitpoints : [],\n latestSnapshot.completedWaitpointOrder\n );\n });\n}\n\nexport class ExecutionSnapshotSystem {\n private readonly $: SystemResources;\n private readonly heartbeatTimeouts: HeartbeatTimeouts;\n\n constructor(private readonly options: ExecutionSnapshotSystemOptions) {\n this.$ = options.resources;\n this.heartbeatTimeouts = options.heartbeatTimeouts;\n }\n\n public async createExecutionSnapshot(\n prisma: PrismaClientOrTransaction,\n {\n run,\n snapshot,\n previousSnapshotId,\n batchId,\n environmentId,\n environmentType,\n projectId,\n organizationId,\n checkpointId,\n workerId,\n runnerId,\n completedWaitpoints,\n error,\n }: {\n run: { id: string; status: TaskRunStatus; attemptNumber?: number | null };\n snapshot: {\n executionStatus: TaskRunExecutionStatus;\n description: string;\n metadata?: Prisma.JsonValue;\n };\n previousSnapshotId?: string;\n batchId?: string;\n environmentId: string;\n environmentType: RuntimeEnvironmentType;\n projectId: string;\n organizationId: string;\n checkpointId?: string;\n workerId?: string;\n runnerId?: string;\n completedWaitpoints?: {\n id: string;\n index?: number;\n }[];\n error?: string;\n },\n // When set (inside runStore.runInTransaction), the snapshot write goes through the owning store\n // with `prisma` = that store's own tx, so it shares ONE transaction with the sibling write (e.g.\n // startAttempt) and a mid-pair failure rolls both back. Otherwise the router routes it.\n // The heartbeat/eventBus side effects below are unchanged.\n store?: RunStore\n ) {\n const newSnapshot = await (store ?? this.$.runStore).createExecutionSnapshot(\n {\n run,\n snapshot,\n previousSnapshotId,\n batchId,\n environmentId,\n environmentType,\n projectId,\n organizationId,\n checkpointId,\n workerId,\n runnerId,\n completedWaitpoints,\n error,\n },\n prisma\n );\n\n if (!error) {\n //set heartbeat (if relevant)\n const intervalMs = this.#getHeartbeatIntervalMs(newSnapshot.executionStatus);\n if (intervalMs !== null) {\n await this.$.worker.enqueue({\n id: `heartbeatSnapshot.${run.id}`,\n job: \"heartbeatSnapshot\",\n payload: { snapshotId: newSnapshot.id, runId: run.id },\n availableAt: new Date(Date.now() + intervalMs),\n });\n }\n }\n\n this.$.eventBus.emit(\"executionSnapshotCreated\", {\n time: newSnapshot.createdAt,\n run: {\n id: newSnapshot.runId,\n },\n snapshot: {\n ...newSnapshot,\n completedWaitpointIds: completedWaitpoints?.map((w) => w.id) ?? [],\n },\n });\n\n return {\n ...newSnapshot,\n friendlyId: SnapshotId.toFriendlyId(newSnapshot.id),\n runFriendlyId: RunId.toFriendlyId(newSnapshot.runId),\n };\n }\n\n public async heartbeatRun({\n runId,\n snapshotId,\n workerId,\n runnerId,\n tx,\n }: {\n runId: string;\n snapshotId: string;\n workerId?: string;\n runnerId?: string;\n tx?: PrismaClientOrTransaction;\n }): Promise {\n const prisma = tx ?? this.$.prisma;\n\n //we don't need to acquire a run lock for any of this, it's not critical if it happens on an older version\n const latestSnapshot = await getLatestExecutionSnapshot(prisma, runId, this.$.runStore);\n if (latestSnapshot.id !== snapshotId) {\n this.$.logger.log(\"heartbeatRun: no longer the latest snapshot, stopping the heartbeat.\", {\n runId,\n snapshotId,\n latestSnapshot,\n workerId,\n runnerId,\n });\n\n return executionResultFromSnapshot(latestSnapshot);\n }\n\n if (latestSnapshot.workerId && latestSnapshot.workerId !== workerId) {\n this.$.logger.debug(\"heartbeatRun: worker ID does not match the latest snapshot\", {\n runId,\n snapshotId,\n latestSnapshot,\n workerId,\n runnerId,\n });\n }\n\n this.$.logger.info(\"heartbeatRun snapshot heartbeat updated\", {\n id: latestSnapshot.id,\n runId: latestSnapshot.runId,\n lastHeartbeatAt: new Date(),\n });\n\n //extending the heartbeat\n const intervalMs = this.#getHeartbeatIntervalMs(latestSnapshot.executionStatus);\n if (intervalMs !== null) {\n await this.$.worker.reschedule(\n `heartbeatSnapshot.${runId}`,\n new Date(Date.now() + intervalMs)\n );\n }\n\n return executionResultFromSnapshot(latestSnapshot);\n }\n\n public async restartHeartbeatForRun({\n runId,\n delayMs,\n restartAttempt,\n tx,\n }: {\n runId: string;\n delayMs: number;\n restartAttempt: number;\n tx?: PrismaClientOrTransaction;\n }): Promise {\n const prisma = tx ?? this.$.prisma;\n\n const latestSnapshot = await getLatestExecutionSnapshot(prisma, runId, this.$.runStore);\n\n this.$.logger.debug(\"restartHeartbeatForRun: enqueuing heartbeat\", {\n runId,\n snapshotId: latestSnapshot.id,\n delayMs,\n });\n\n await this.$.worker.enqueue({\n id: `heartbeatSnapshot.${runId}`,\n job: \"heartbeatSnapshot\",\n payload: { snapshotId: latestSnapshot.id, runId, restartAttempt },\n availableAt: new Date(Date.now() + delayMs),\n });\n\n return executionResultFromSnapshot(latestSnapshot);\n }\n\n /**\n * Enqueues a heartbeat job for a snapshot if the execution status requires one.\n * Use this after nesting a snapshot create inside a taskRun.update() to replicate\n * the heartbeat side effect that createExecutionSnapshot normally handles.\n */\n public async enqueueHeartbeatIfNeeded(snapshot: {\n id: string;\n runId: string;\n executionStatus: TaskRunExecutionStatus;\n }) {\n const intervalMs = this.#getHeartbeatIntervalMs(snapshot.executionStatus);\n if (intervalMs !== null) {\n await this.$.worker.enqueue({\n id: `heartbeatSnapshot.${snapshot.runId}`,\n job: \"heartbeatSnapshot\",\n payload: { snapshotId: snapshot.id, runId: snapshot.runId },\n availableAt: new Date(Date.now() + intervalMs),\n });\n }\n }\n\n #getHeartbeatIntervalMs(status: TaskRunExecutionStatus): number | null {\n switch (status) {\n case \"PENDING_EXECUTING\": {\n return this.heartbeatTimeouts.PENDING_EXECUTING;\n }\n case \"PENDING_CANCEL\": {\n return this.heartbeatTimeouts.PENDING_CANCEL;\n }\n case \"EXECUTING\": {\n return this.heartbeatTimeouts.EXECUTING;\n }\n case \"EXECUTING_WITH_WAITPOINTS\": {\n return this.heartbeatTimeouts.EXECUTING_WITH_WAITPOINTS;\n }\n case \"SUSPENDED\": {\n return this.heartbeatTimeouts.SUSPENDED;\n }\n default: {\n return null;\n }\n }\n }\n}" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "scheduleWhereClause" function_lines = [[22, 37]] id = "triggerdotdev-trigger.dev-0303c786b3f9def3" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/models/schedules.server.ts" post_fix = "export function scheduleWhereClause(\n projectId: string,\n scheduleId: string\n): Prisma.TaskScheduleWhereInput {\n if (scheduleId.startsWith(\"sched_\")) {\n return {\n friendlyId: scheduleId,\n projectId,\n };\n }\n\n return {\n projectId,\n deduplicationKey: scheduleId,\n };\n}\n\n/**\n * Resolve a schedule's visibility for an environment-scoped caller.\n *\n * - \"visible\": the schedule exists in the project and has at least one\n * instance bound to `environmentId` (or has no instances yet).\n * - \"hidden\": the schedule exists but none of its instances live in the\n * caller's environment.\n * - \"missing\": no schedule exists for the (project, scheduleId) pair.\n *\n * A schedule can be bound to several environments at once, so visibility\n * mirrors the \"some instance is in this environment\" rule the schedule\n * list uses: a schedule that is listed for a key must also be readable\n * and mutable by that key. This still rejects cross-environment access to\n * schedules the caller has no instance in, and `scheduleWhereClause`\n * already confines the lookup to the caller's project.\n *\n * The tri-state lets PUT (upsert) disambiguate \"hidden\" (refuse) from\n * \"missing\" (fall through to create). DELETE/GET treat hidden and\n * missing the same way.\n */\nexport type ScheduleEnvVisibility =\n | { status: \"visible\"; schedule: TaskSchedule }\n | { status: \"hidden\" }\n | { status: \"missing\" };\n" pre_fix = "export function scheduleWhereClause(\n projectId: string,\n scheduleId: string\n): Prisma.TaskScheduleWhereInput {\n if (scheduleId.startsWith(\"sched_\")) {\n return {\n friendlyId: scheduleId,\n projectId,\n };\n }\n\n return {\n projectId,\n deduplicationKey: scheduleId,\n };\n}" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "createWorkload" function_lines = [[592, 714]] id = "triggerdotdev-trigger.dev-03db63004dde1012" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/index.ts" post_fix = " private async createWorkload(message: DequeuedMessage, timings: WarmStartTimings) {\n const createStart = performance.now();\n try {\n if (!message.deployment.friendlyId) {\n // mostly a type guard, deployments always exists for deployed environments\n // a proper fix would be to use a discriminated union schema to differentiate between dequeued runs in dev and in deployed environments.\n throw new Error(\"Deployment is missing\");\n }\n\n if (!message.image) {\n // same type-guard situation as deployment above\n throw new Error(\"Image is missing\");\n }\n\n const deploymentToken = await mintDeploymentToken({\n deployment: message.deployment.friendlyId,\n deployment_version: message.backgroundWorker.version,\n environment_id: message.environment.id,\n environment_type: message.environment.type,\n org_id: message.organization.id,\n project_id: message.project.id,\n });\n\n await this.workloadManager.create({\n dequeuedAt: message.dequeuedAt,\n dequeueResponseMs: timings.dequeueResponseMs,\n pollingIntervalMs: timings.pollingIntervalMs,\n warmStartCheckMs: timings.warmStartCheckMs,\n envId: message.environment.id,\n envType: message.environment.type,\n image: message.image,\n machine: message.run.machine,\n orgId: message.organization.id,\n projectId: message.project.id,\n deploymentFriendlyId: message.deployment.friendlyId,\n deploymentVersion: message.backgroundWorker.version,\n runtime: message.backgroundWorker.runtime,\n deploymentToken,\n runId: message.run.id,\n runFriendlyId: message.run.friendlyId,\n version: message.version,\n nextAttemptNumber: message.run.attemptNumber,\n snapshotId: message.snapshot.id,\n snapshotFriendlyId: message.snapshot.friendlyId,\n placementTags: message.placementTags,\n traceContext: message.run.traceContext,\n annotations: message.run.annotations,\n hasPrivateLink: message.organization.hasPrivateLink,\n });\n recordPhaseSince(\"workload_create\", createStart, undefined);\n workloadCreateDuration.observe(\n { backend: this.workloadManagerBackend, outcome: \"success\" },\n (performance.now() - createStart) / 1000\n );\n\n // Disabled for now\n // this.resourceMonitor.blockResources({\n // cpu: message.run.machine.cpu,\n // memory: message.run.machine.memory,\n // });\n } catch (error) {\n recordPhaseSince(\n \"workload_create\",\n createStart,\n error instanceof Error ? error : new Error(String(error))\n );\n workloadCreateDuration.observe(\n { backend: this.workloadManagerBackend, outcome: \"error\" },\n (performance.now() - createStart) / 1000\n );\n this.logger.error(\"Failed to create workload\", {\n runId: message.run.friendlyId,\n error,\n });\n }\n }\n\n private async tryWarmStart(\n dequeuedMessage: DequeuedMessage,\n traceparent: string | undefined\n ): Promise {\n if (!this.warmStartUrl) {\n return false;\n }\n\n const warmStartUrlWithPath = new URL(\"/warm-start\", this.warmStartUrl);\n\n const headers: Record = {\n \"Content-Type\": \"application/json\",\n };\n // Propagate the inbound W3C traceparent so the upstream warm-start\n // receiver continues the same trace instead of minting a new one. Gated\n // by the same kill switch as the wide-event emission so the whole PR is\n // a no-op on the wire when disabled.\n if (this.wideEventOpts.enabled && traceparent) {\n headers.traceparent = traceparent;\n }\n\n try {\n const res = await fetch(warmStartUrlWithPath.href, {\n method: \"POST\",\n headers,\n body: JSON.stringify({ dequeuedMessage }),\n });\n\n if (!res.ok) {\n this.logger.error(\"Warm start failed\", {\n runId: dequeuedMessage.run.id,\n });\n return false;\n }\n\n const data = await res.json();\n const parsedData = z.object({ didWarmStart: z.boolean() }).safeParse(data);\n\n if (!parsedData.success) {\n this.logger.error(\"Warm start response invalid\", {\n runId: dequeuedMessage.run.id,\n data,\n });\n return false;\n }\n\n return parsedData.data.didWarmStart;\n } catch (error) {\n this.logger.error(\"Warm start error\", {\n runId: dequeuedMessage.run.id,\n error,\n });\n return false;\n }\n }\n" pre_fix = " private async createWorkload(message: DequeuedMessage, timings: WarmStartTimings) {\n const createStart = performance.now();\n try {\n if (!message.deployment.friendlyId) {\n // mostly a type guard, deployments always exists for deployed environments\n // a proper fix would be to use a discriminated union schema to differentiate between dequeued runs in dev and in deployed environments.\n throw new Error(\"Deployment is missing\");\n }\n\n if (!message.image) {\n // same type-guard situation as deployment above\n throw new Error(\"Image is missing\");\n }\n\n await this.workloadManager.create({\n dequeuedAt: message.dequeuedAt,\n dequeueResponseMs: timings.dequeueResponseMs,\n pollingIntervalMs: timings.pollingIntervalMs,\n warmStartCheckMs: timings.warmStartCheckMs,\n envId: message.environment.id,\n envType: message.environment.type,\n image: message.image,\n machine: message.run.machine,\n orgId: message.organization.id,\n projectId: message.project.id,\n deploymentFriendlyId: message.deployment.friendlyId,\n deploymentVersion: message.backgroundWorker.version,\n runtime: message.backgroundWorker.runtime,\n runId: message.run.id,\n runFriendlyId: message.run.friendlyId,\n version: message.version,\n nextAttemptNumber: message.run.attemptNumber,\n snapshotId: message.snapshot.id,\n snapshotFriendlyId: message.snapshot.friendlyId,\n placementTags: message.placementTags,\n traceContext: message.run.traceContext,\n annotations: message.run.annotations,\n hasPrivateLink: message.organization.hasPrivateLink,\n });\n recordPhaseSince(\"workload_create\", createStart, undefined);\n workloadCreateDuration.observe(\n { backend: this.workloadManagerBackend, outcome: \"success\" },\n (performance.now() - createStart) / 1000\n );\n\n // Disabled for now\n // this.resourceMonitor.blockResources({\n // cpu: message.run.machine.cpu,\n // memory: message.run.machine.memory,\n // });\n } catch (error) {\n recordPhaseSince(\n \"workload_create\",\n createStart,\n error instanceof Error ? error : new Error(String(error))\n );\n workloadCreateDuration.observe(\n { backend: this.workloadManagerBackend, outcome: \"error\" },\n (performance.now() - createStart) / 1000\n );\n this.logger.error(\"Failed to create workload\", {\n runId: message.run.friendlyId,\n error,\n });\n }\n }\n\n private async tryWarmStart(\n dequeuedMessage: DequeuedMessage,\n traceparent: string | undefined\n ): Promise {\n if (!this.warmStartUrl) {\n return false;\n }\n\n const warmStartUrlWithPath = new URL(\"/warm-start\", this.warmStartUrl);\n\n const headers: Record = {\n \"Content-Type\": \"application/json\",\n };\n // Propagate the inbound W3C traceparent so the upstream warm-start\n // receiver continues the same trace instead of minting a new one. Gated\n // by the same kill switch as the wide-event emission so the whole PR is\n // a no-op on the wire when disabled.\n if (this.wideEventOpts.enabled && traceparent) {\n headers.traceparent = traceparent;\n }\n\n try {\n const res = await fetch(warmStartUrlWithPath.href, {\n method: \"POST\",\n headers,\n body: JSON.stringify({ dequeuedMessage }),\n });\n\n if (!res.ok) {\n this.logger.error(\"Warm start failed\", {\n runId: dequeuedMessage.run.id,\n });\n return false;\n }\n\n const data = await res.json();\n const parsedData = z.object({ didWarmStart: z.boolean() }).safeParse(data);\n\n if (!parsedData.success) {\n this.logger.error(\"Warm start response invalid\", {\n runId: dequeuedMessage.run.id,\n data,\n });\n return false;\n }\n\n return parsedData.data.didWarmStart;\n } catch (error) {\n this.logger.error(\"Warm start error\", {\n runId: dequeuedMessage.run.id,\n error,\n });\n return false;\n }\n }\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "action" function_lines = [[10, 52]] id = "triggerdotdev-trigger.dev-0847872016dff82d" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/routes/api.v1.token.ts" post_fix = "export async function action({ request }: ActionFunctionArgs) {\n logger.info(\"Getting PersonalAccessToken from AuthorizationCode\", { url: request.url });\n\n // Ensure this is a POST request\n if (request.method.toUpperCase() !== \"POST\") {\n return { status: 405, body: \"Method Not Allowed\" };\n }\n\n //There is no authentication on this endpoint, anyone can create an AuthorizationCode.\n //But only a logged in user can create a PersonalAccessToken, so for a user who can't login to the app this will always fail.\n\n // Now parse the request body\n const anyBody = await request.json();\n const body = GetPersonalAccessTokenRequestSchema.safeParse(anyBody);\n if (!body.success) {\n return json({ error: generateErrorMessage(body.error.issues) }, { status: 422 });\n }\n\n // Per-code rate limit (keyed by the code, not the IP, so the CLI's poll loop\n // isn't broken behind a shared NAT).\n try {\n await checkAuthorizationCodeTokenPollRateLimit(body.data.authorizationCode);\n } catch (error) {\n if (error instanceof AuthorizationCodeRateLimitError) {\n return json(\n { error: \"Too many requests, please try again later.\" },\n { status: 429, headers: { \"Retry-After\": Math.ceil(error.retryAfter / 1000).toString() } }\n );\n }\n throw error;\n }\n\n try {\n const personalAccessToken = await getPersonalAccessTokenFromAuthorizationCode(\n body.data.authorizationCode\n );\n\n const responseJson: GetPersonalAccessTokenResponse = {\n token: personalAccessToken.token,\n };\n return json(responseJson);\n } catch (error) {\n if (error instanceof Error) {\n const expected = error.message === \"Invalid authorization code, or code expired\";\n const fields = { url: request.url, error: error.message };\n if (expected) {\n logger.warn(\"Error getting PersonalAccessToken from AuthorizationCode\", fields);\n } else {\n logger.error(\"Error getting PersonalAccessToken from AuthorizationCode\", fields);\n }\n\n return json({ error: clientSafeErrorMessage(error) }, { status: 400 });\n }\n\n return json({ error: \"Something went wrong\" }, { status: 400 });\n }\n}" pre_fix = "export async function action({ request }: ActionFunctionArgs) {\n logger.info(\"Getting PersonalAccessToken from AuthorizationCode\", { url: request.url });\n\n // Ensure this is a POST request\n if (request.method.toUpperCase() !== \"POST\") {\n return { status: 405, body: \"Method Not Allowed\" };\n }\n\n //There is no authentication on this endpoint, anyone can create an AuthorizationCode.\n //But only a logged in user can create a PersonalAccessToken, so for a user who can't login to the app this will always fail.\n\n // Now parse the request body\n const anyBody = await request.json();\n const body = GetPersonalAccessTokenRequestSchema.safeParse(anyBody);\n if (!body.success) {\n return json({ error: generateErrorMessage(body.error.issues) }, { status: 422 });\n }\n\n try {\n const personalAccessToken = await getPersonalAccessTokenFromAuthorizationCode(\n body.data.authorizationCode\n );\n\n const responseJson: GetPersonalAccessTokenResponse = {\n token: personalAccessToken.token,\n };\n return json(responseJson);\n } catch (error) {\n if (error instanceof Error) {\n const expected = error.message === \"Invalid authorization code, or code expired\";\n const fields = { url: request.url, error: error.message };\n if (expected) {\n logger.warn(\"Error getting PersonalAccessToken from AuthorizationCode\", fields);\n } else {\n logger.error(\"Error getting PersonalAccessToken from AuthorizationCode\", fields);\n }\n\n return json({ error: clientSafeErrorMessage(error) }, { status: 400 });\n }\n\n return json({ error: \"Something went wrong\" }, { status: 400 });\n }\n}" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "Page" function_lines = [[76, 115]] id = "triggerdotdev-trigger.dev-0b7c25791baf4ea7" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/routes/account.authorization-code.$authorizationCode/route.tsx" post_fix = "export default function Page() {\n const loaderData = useTypedLoaderData();\n const actionData = useTypedActionData();\n\n // After the consent POST: success or failure.\n if (actionData) {\n return (\n \n {actionData.success ? (\n

\n \n Successfully\n authenticated\n \n \n {getInstructionsForSource(actionData.source, actionData.clientName)}\n \n

\n ) : (\n

\n Authentication failed\n \n {actionData.error}\n \n \n There was a problem authenticating you, please try logging in with your CLI again.\n \n

\n )}\n \n );\n }\n\n // Initial GET: invalid/expired code, or the consent prompt.\n if (loaderData.status === \"invalid\") {\n return (\n \n

\n Authentication failed\n \n This login link is invalid or has expired.\n \n \n Please try logging in with your CLI again to get a fresh link.\n \n

\n \n );\n }\n\n return (\n \n

\n Authorize login\n {getConsentPrompt(loaderData.source, loaderData.clientName)}\n \n \n Only authorize if you started this login yourself. If you didn't, close this page.\n \n

\n \n );\n}\n" pre_fix = "export default function Page() {\n const result = useTypedLoaderData();\n\n return (\n \n \n

\n {result.success ? (\n

\n \n Successfully\n authenticated\n \n {getInstructionsForSource(result.source, result.clientName)}\n

\n ) : (\n

\n Authentication failed\n \n {result.error}\n \n \n There was a problem authenticating you, please try logging in with your CLI again.\n \n

\n )}\n

\n \n \n );\n}\n\nconst prettyClientNames: Record = {\n \"claude-code\": \"Claude Code\",\n \"cursor-vscode\": \"Cursor\",\n \"Visual Studio Code\": \"VSCode\",\n \"windsurf-client\": \"Windsurf\",\n \"claude-ai\": \"Claude Desktop\",\n};\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "completeRunAttempt" function_lines = [[162, 180]] id = "triggerdotdev-trigger.dev-0d903711cc0bf246" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "packages/core/src/v3/runEngineWorker/supervisor/http.ts" post_fix = " async completeRunAttempt(\n runId: string,\n snapshotId: string,\n body: WorkerApiRunAttemptCompleteRequestBody,\n runnerId?: string,\n environmentId?: string\n ) {\n return wrapZodFetch(\n WorkerApiRunAttemptCompleteResponseBody,\n `${this.apiUrl}/engine/v1/worker-actions/runs/${runId}/snapshots/${snapshotId}/attempts/complete`,\n {\n method: \"POST\",\n headers: {\n ...this.defaultHeaders,\n ...this.runnerIdHeader(runnerId),\n ...this.environmentIdHeader(environmentId),\n },\n body: JSON.stringify(body),\n }\n );\n }" pre_fix = " async completeRunAttempt(\n runId: string,\n snapshotId: string,\n body: WorkerApiRunAttemptCompleteRequestBody,\n runnerId?: string\n ) {\n return wrapZodFetch(\n WorkerApiRunAttemptCompleteResponseBody,\n `${this.apiUrl}/engine/v1/worker-actions/runs/${runId}/snapshots/${snapshotId}/attempts/complete`,\n {\n method: \"POST\",\n headers: {\n ...this.defaultHeaders,\n ...this.runnerIdHeader(runnerId),\n },\n body: JSON.stringify(body),\n }\n );\n }" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "action" function_lines = [[14, 75]] id = "triggerdotdev-trigger.dev-0eb72665259b13c2" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/routes/api.v1.schedules.$scheduleId.deactivate.ts" post_fix = "export async function action({ request, params }: ActionFunctionArgs) {\n // Ensure this is a POST request\n if (request.method.toUpperCase() !== \"POST\") {\n return { status: 405, body: \"Method Not Allowed\" };\n }\n\n // Authenticate the request\n const authenticationResult = await authenticateApiRequest(request);\n\n if (!authenticationResult) {\n return json({ error: \"Invalid or Missing API Key\" }, { status: 401 });\n }\n\n const parsedParams = ParamsSchema.safeParse(params);\n\n if (!parsedParams.success) {\n return json(\n { error: \"Invalid request parameters\", issues: parsedParams.error.issues },\n { status: 400 }\n );\n }\n\n try {\n // Env-scoped API keys can only toggle schedules that have an instance in\n // their own environment. Without this a key scoped to one environment\n // could enable/disable a schedule that only runs in another environment\n // of the same project.\n const visibility = await getScheduleEnvVisibility(\n prisma,\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId,\n authenticationResult.environment.id\n );\n if (visibility.status !== \"visible\") {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n await prisma.taskSchedule.update({\n where: scheduleUniqWhereClause(\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId\n ),\n data: {\n active: false,\n },\n });\n\n const presenter = new ViewSchedulePresenter();\n\n const result = await presenter.call({\n projectId: authenticationResult.environment.projectId,\n friendlyId: parsedParams.data.scheduleId,\n environmentId: authenticationResult.environment.id,\n });\n\n if (!result) {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n return json(presenter.toJSONResponse(result), { status: 200 });\n } catch (error) {\n logger.error(\"Failed to deactivate schedule\", { error });\n return json({ error: \"Something went wrong, please try again.\" }, { status: 500 });\n }\n}" pre_fix = "export async function action({ request, params }: ActionFunctionArgs) {\n // Ensure this is a POST request\n if (request.method.toUpperCase() !== \"POST\") {\n return { status: 405, body: \"Method Not Allowed\" };\n }\n\n // Authenticate the request\n const authenticationResult = await authenticateApiRequest(request);\n\n if (!authenticationResult) {\n return json({ error: \"Invalid or Missing API Key\" }, { status: 401 });\n }\n\n const parsedParams = ParamsSchema.safeParse(params);\n\n if (!parsedParams.success) {\n return json(\n { error: \"Invalid request parameters\", issues: parsedParams.error.issues },\n { status: 400 }\n );\n }\n\n try {\n const existingSchedule = await prisma.taskSchedule.findFirst({\n where: scheduleWhereClause(\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId\n ),\n });\n\n if (!existingSchedule) {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n await prisma.taskSchedule.update({\n where: scheduleUniqWhereClause(\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId\n ),\n data: {\n active: false,\n },\n });\n\n const presenter = new ViewSchedulePresenter();\n\n const result = await presenter.call({\n projectId: authenticationResult.environment.projectId,\n friendlyId: parsedParams.data.scheduleId,\n environmentId: authenticationResult.environment.id,\n });\n\n if (!result) {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n return json(presenter.toJSONResponse(result), { status: 200 });\n } catch (error) {\n logger.error(\"Failed to deactivate schedule\", { error });\n return json({ error: \"Something went wrong, please try again.\" }, { status: 500 });\n }\n}" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "action" function_lines = [[14, 75]] id = "triggerdotdev-trigger.dev-124d417d0ae18fbe" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/routes/api.v1.schedules.$scheduleId.activate.ts" post_fix = "export async function action({ request, params }: ActionFunctionArgs) {\n // Ensure this is a POST request\n if (request.method.toUpperCase() !== \"POST\") {\n return { status: 405, body: \"Method Not Allowed\" };\n }\n\n // Authenticate the request\n const authenticationResult = await authenticateApiRequest(request);\n\n if (!authenticationResult) {\n return json({ error: \"Invalid or Missing API Key\" }, { status: 401 });\n }\n\n const parsedParams = ParamsSchema.safeParse(params);\n\n if (!parsedParams.success) {\n return json(\n { error: \"Invalid request parameters\", issues: parsedParams.error.issues },\n { status: 400 }\n );\n }\n\n try {\n // Env-scoped API keys can only toggle schedules that have an instance in\n // their own environment. Without this a key scoped to one environment\n // could enable/disable a schedule that only runs in another environment\n // of the same project.\n const visibility = await getScheduleEnvVisibility(\n prisma,\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId,\n authenticationResult.environment.id\n );\n if (visibility.status !== \"visible\") {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n await prisma.taskSchedule.update({\n where: scheduleUniqWhereClause(\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId\n ),\n data: {\n active: true,\n },\n });\n\n const presenter = new ViewSchedulePresenter();\n\n const result = await presenter.call({\n projectId: authenticationResult.environment.projectId,\n friendlyId: parsedParams.data.scheduleId,\n environmentId: authenticationResult.environment.id,\n });\n\n if (!result) {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n return json(presenter.toJSONResponse(result), { status: 200 });\n } catch (error) {\n logger.error(\"Failed to activate schedule\", { error });\n return json({ error: \"Something went wrong, please try again.\" }, { status: 500 });\n }\n}" pre_fix = "export async function action({ request, params }: ActionFunctionArgs) {\n // Ensure this is a POST request\n if (request.method.toUpperCase() !== \"POST\") {\n return { status: 405, body: \"Method Not Allowed\" };\n }\n\n // Authenticate the request\n const authenticationResult = await authenticateApiRequest(request);\n\n if (!authenticationResult) {\n return json({ error: \"Invalid or Missing API Key\" }, { status: 401 });\n }\n\n const parsedParams = ParamsSchema.safeParse(params);\n\n if (!parsedParams.success) {\n return json(\n { error: \"Invalid request parameters\", issues: parsedParams.error.issues },\n { status: 400 }\n );\n }\n\n try {\n const existingSchedule = await prisma.taskSchedule.findFirst({\n where: scheduleWhereClause(\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId\n ),\n });\n\n if (!existingSchedule) {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n await prisma.taskSchedule.update({\n where: scheduleUniqWhereClause(\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId\n ),\n data: {\n active: true,\n },\n });\n\n const presenter = new ViewSchedulePresenter();\n\n const result = await presenter.call({\n projectId: authenticationResult.environment.projectId,\n friendlyId: parsedParams.data.scheduleId,\n environmentId: authenticationResult.environment.id,\n });\n\n if (!result) {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n return json(presenter.toJSONResponse(result), { status: 200 });\n } catch (error) {\n logger.error(\"Failed to activate schedule\", { error });\n return json({ error: \"Something went wrong, please try again.\" }, { status: 500 });\n }\n}" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "applyMetadataOperations" function_lines = [[10, 168]] id = "triggerdotdev-trigger.dev-1389b2b039433f1d" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "packages/core/src/v3/runMetadata/operations.ts" post_fix = "export function applyMetadataOperations(\n currentMetadata: Record,\n operations: RunMetadataChangeOperation | RunMetadataChangeOperation[]\n): ApplyOperationResult {\n const unappliedOperations: RunMetadataChangeOperation[] = [];\n // Start with a mutable copy of the current metadata\n let newMetadata: Record = structuredClone(currentMetadata);\n\n for (const operation of Array.isArray(operations) ? operations : [operations]) {\n // Prevent unsafe JSON paths and direct __proto__ assignments from changing Object.prototype.\n // (\"update\" carries no key.)\n if (operation.type !== \"update\" && !isSafeMetadataKey(operation.key)) {\n unappliedOperations.push(operation);\n continue;\n }\n\n switch (operation.type) {\n case \"set\": {\n if (operation.key.startsWith(\"$.\")) {\n const path = new JSONHeroPath(operation.key);\n path.set(newMetadata, operation.value);\n } else {\n // Set the value directly\n newMetadata[operation.key] = operation.value;\n }\n\n break;\n }\n\n case \"delete\": {\n // Safely delete the key if it exists\n if (operation.key in newMetadata) {\n delete newMetadata[operation.key];\n }\n break;\n }\n\n case \"append\": {\n if (operation.key.startsWith(\"$.\")) {\n const path = new JSONHeroPath(operation.key);\n const currentValue = path.first(newMetadata);\n\n if (currentValue === undefined) {\n // Initialize as array with single item\n path.set(newMetadata, [operation.value]);\n } else if (Array.isArray(currentValue)) {\n // Append to existing array\n path.set(newMetadata, [...currentValue, operation.value]);\n } else {\n // Convert to array if not already\n path.set(newMetadata, [currentValue, operation.value]);\n }\n } else {\n // Ensure the value at key is an array or initialize as an array\n const existingValue = newMetadata[operation.key];\n if (Array.isArray(existingValue)) {\n existingValue.push(operation.value);\n } else if (existingValue === undefined) {\n newMetadata[operation.key] = [operation.value];\n } else {\n // Convert to array if not already\n newMetadata[operation.key] = [existingValue, operation.value];\n }\n }\n\n break;\n }\n\n case \"remove\": {\n if (operation.key.startsWith(\"$.\")) {\n const path = new JSONHeroPath(operation.key);\n const currentValue = path.first(newMetadata);\n\n if (Array.isArray(currentValue)) {\n // Remove the value from array using deep equality check\n const newArray = currentValue.filter((item) => !dequal(item, operation.value));\n path.set(newMetadata, newArray);\n } else {\n unappliedOperations.push(operation);\n }\n } else {\n // Remove matching values if the key points to an array\n const existingValue = newMetadata[operation.key];\n\n if (Array.isArray(existingValue)) {\n newMetadata[operation.key] = existingValue.filter(\n (item) => !dequal(item, operation.value)\n );\n } else {\n unappliedOperations.push(operation);\n }\n }\n\n break;\n }\n\n case \"increment\": {\n let currentValue = operation.key.startsWith(\"$.\")\n ? new JSONHeroPath(operation.key).first(newMetadata)\n : newMetadata[operation.key];\n\n const newValue = (typeof currentValue === \"number\" ? currentValue : 0) + operation.value;\n\n if (operation.key.startsWith(\"$.\")) {\n new JSONHeroPath(operation.key).set(newMetadata, newValue);\n } else {\n newMetadata[operation.key] = newValue;\n }\n\n break;\n }\n\n case \"update\": {\n // Update the metadata object with the new object\n newMetadata = operation.value;\n break;\n }\n\n default: {\n // Log unsupported operation type\n unappliedOperations.push(operation);\n break;\n }\n }\n }\n\n return { newMetadata, unappliedOperations };\n}\n\n/**\n * Collapses metadata operations to reduce payload size and avoid 413 \"Request Entity Too Large\" errors.\n *\n * When there are many operations queued up (e.g., 10k increment operations), sending them all\n * individually can result in request payloads exceeding the server's 1MB limit. This function\n * intelligently combines operations where possible to reduce the payload size:\n *\n * - **Increment operations**: Multiple increments on the same key are summed into a single increment\n * - Example: increment(\"counter\", 1) + increment(\"counter\", 2) → increment(\"counter\", 3)\n *\n * - **Set operations**: Multiple sets on the same key keep only the last one (since later sets override earlier ones)\n * - Example: set(\"status\", \"processing\") + set(\"status\", \"done\") → set(\"status\", \"done\")\n *\n * - **Delete operations**: Multiple deletes on the same key keep only one (duplicates are redundant)\n * - Example: del(\"temp\") + del(\"temp\") → del(\"temp\")\n *\n * - **Append, remove, and update operations**: Preserved as-is to maintain correctness since order matters\n *\n * @param operations Array of metadata change operations to collapse\n * @returns Collapsed array with fewer operations that produce the same final result\n *\n * @example\n * ```typescript\n * const operations = [\n * { type: \"increment\", key: \"counter\", value: 1 },\n * { type: \"increment\", key: \"counter\", value: 2 },\n * { type: \"set\", key: \"status\", value: \"processing\" },\n * { type: \"set\", key: \"status\", value: \"done\" }\n * ];\n *\n * const collapsed = collapseOperations(operations);\n * // Result: [\n * // { type: \"increment\", key: \"counter\", value: 3 },\n * // { type: \"set\", key: \"status\", value: \"done\" }\n * // ]\n * ```\n */" pre_fix = "export function applyMetadataOperations(\n currentMetadata: Record,\n operations: RunMetadataChangeOperation | RunMetadataChangeOperation[]\n): ApplyOperationResult {\n const unappliedOperations: RunMetadataChangeOperation[] = [];\n // Start with a mutable copy of the current metadata\n let newMetadata: Record = structuredClone(currentMetadata);\n\n for (const operation of Array.isArray(operations) ? operations : [operations]) {\n switch (operation.type) {\n case \"set\": {\n if (operation.key.startsWith(\"$.\")) {\n const path = new JSONHeroPath(operation.key);\n path.set(newMetadata, operation.value);\n } else {\n // Set the value directly\n newMetadata[operation.key] = operation.value;\n }\n\n break;\n }\n\n case \"delete\": {\n // Safely delete the key if it exists\n if (operation.key in newMetadata) {\n delete newMetadata[operation.key];\n }\n break;\n }\n\n case \"append\": {\n if (operation.key.startsWith(\"$.\")) {\n const path = new JSONHeroPath(operation.key);\n const currentValue = path.first(newMetadata);\n\n if (currentValue === undefined) {\n // Initialize as array with single item\n path.set(newMetadata, [operation.value]);\n } else if (Array.isArray(currentValue)) {\n // Append to existing array\n path.set(newMetadata, [...currentValue, operation.value]);\n } else {\n // Convert to array if not already\n path.set(newMetadata, [currentValue, operation.value]);\n }\n } else {\n // Ensure the value at key is an array or initialize as an array\n const existingValue = newMetadata[operation.key];\n if (Array.isArray(existingValue)) {\n existingValue.push(operation.value);\n } else if (existingValue === undefined) {\n newMetadata[operation.key] = [operation.value];\n } else {\n // Convert to array if not already\n newMetadata[operation.key] = [existingValue, operation.value];\n }\n }\n\n break;\n }\n\n case \"remove\": {\n if (operation.key.startsWith(\"$.\")) {\n const path = new JSONHeroPath(operation.key);\n const currentValue = path.first(newMetadata);\n\n if (Array.isArray(currentValue)) {\n // Remove the value from array using deep equality check\n const newArray = currentValue.filter((item) => !dequal(item, operation.value));\n path.set(newMetadata, newArray);\n } else {\n unappliedOperations.push(operation);\n }\n } else {\n // Remove matching values if the key points to an array\n const existingValue = newMetadata[operation.key];\n\n if (Array.isArray(existingValue)) {\n newMetadata[operation.key] = existingValue.filter(\n (item) => !dequal(item, operation.value)\n );\n } else {\n unappliedOperations.push(operation);\n }\n }\n\n break;\n }\n\n case \"increment\": {\n let currentValue = operation.key.startsWith(\"$.\")\n ? new JSONHeroPath(operation.key).first(newMetadata)\n : newMetadata[operation.key];\n\n const newValue = (typeof currentValue === \"number\" ? currentValue : 0) + operation.value;\n\n if (operation.key.startsWith(\"$.\")) {\n new JSONHeroPath(operation.key).set(newMetadata, newValue);\n } else {\n newMetadata[operation.key] = newValue;\n }\n\n break;\n }\n\n case \"update\": {\n // Update the metadata object with the new object\n newMetadata = operation.value;\n break;\n }\n\n default: {\n // Log unsupported operation type\n unappliedOperations.push(operation);\n break;\n }\n }\n }\n\n return { newMetadata, unappliedOperations };\n}\n\n/**\n * Collapses metadata operations to reduce payload size and avoid 413 \"Request Entity Too Large\" errors.\n *\n * When there are many operations queued up (e.g., 10k increment operations), sending them all\n * individually can result in request payloads exceeding the server's 1MB limit. This function\n * intelligently combines operations where possible to reduce the payload size:\n *\n * - **Increment operations**: Multiple increments on the same key are summed into a single increment\n * - Example: increment(\"counter\", 1) + increment(\"counter\", 2) → increment(\"counter\", 3)\n *\n * - **Set operations**: Multiple sets on the same key keep only the last one (since later sets override earlier ones)\n * - Example: set(\"status\", \"processing\") + set(\"status\", \"done\") → set(\"status\", \"done\")\n *\n * - **Delete operations**: Multiple deletes on the same key keep only one (duplicates are redundant)\n * - Example: del(\"temp\") + del(\"temp\") → del(\"temp\")\n *\n * - **Append, remove, and update operations**: Preserved as-is to maintain correctness since order matters\n *\n * @param operations Array of metadata change operations to collapse\n * @returns Collapsed array with fewer operations that produce the same final result\n *\n * @example\n * ```typescript\n * const operations = [\n * { type: \"increment\", key: \"counter\", value: 1 },\n * { type: \"increment\", key: \"counter\", value: 2 },\n * { type: \"set\", key: \"status\", value: \"processing\" },\n * { type: \"set\", key: \"status\", value: \"done\" }\n * ];\n *\n * const collapsed = collapseOperations(operations);\n * // Result: [\n * // { type: \"increment\", key: \"counter\", value: 3 },\n * // { type: \"set\", key: \"status\", value: \"done\" }\n * // ]\n * ```\n */" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "runConnected" function_lines = [[725, 743]] id = "triggerdotdev-trigger.dev-1609ba0be33d1321" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/workloadServer/index.ts" post_fix = " const runConnected = (friendlyId: string) => {\n socketLogger.debug(\"runConnected\", { ...getSocketMetadata() });\n\n // Only the owning runner may (re)bind a run. A live socket from a *different*\n // runner keeps its binding so an unrelated connection can't hijack the run. But\n // the newest socket for the *same* runner is a legitimate reconnection/handoff and\n // is allowed to take over even while the stale socket still reports connected -\n // otherwise, during a reconnect race the fresh socket would silently stay unbound\n // (missing continue/cancel/suspend notifications) until the dead socket times out.\n const existing = this.runSockets.get(friendlyId);\n if (existing && existing.id !== socket.id && existing.connected) {\n const sameRunner =\n !!socket.data.runnerId && existing.data.runnerId === socket.data.runnerId;\n\n if (!sameRunner) {\n socketLogger.warn(\"runConnected: run already bound to another socket\", {\n ...getSocketMetadata(),\n friendlyId,\n existingSocketId: existing.id,\n });\n return;\n }\n\n socketLogger.debug(\"runConnected: replacing stale socket for same runner\", {\n ...getSocketMetadata(),\n friendlyId,\n existingSocketId: existing.id,\n });\n }\n\n // If there's already a run ID set, we should \"disconnect\" it from this socket\n if (socket.data.runFriendlyId && socket.data.runFriendlyId !== friendlyId) {\n socketLogger.debug(\"runConnected: disconnecting existing run\", {\n ...getSocketMetadata(),\n newRunId: friendlyId,\n oldRunId: socket.data.runFriendlyId,\n });\n runDisconnected(socket.data.runFriendlyId, \"socket_run_replaced\");\n }\n\n this.runSockets.set(friendlyId, socket);\n this.emit(\"runConnected\", { run: { friendlyId } });\n socket.data.runFriendlyId = friendlyId;\n emitSocketLifecycle(\"run_connected\", friendlyId);\n };\n" pre_fix = " const runConnected = (friendlyId: string) => {\n socketLogger.debug(\"runConnected\", { ...getSocketMetadata() });\n\n // If there's already a run ID set, we should \"disconnect\" it from this socket\n if (socket.data.runFriendlyId && socket.data.runFriendlyId !== friendlyId) {\n socketLogger.debug(\"runConnected: disconnecting existing run\", {\n ...getSocketMetadata(),\n newRunId: friendlyId,\n oldRunId: socket.data.runFriendlyId,\n });\n runDisconnected(socket.data.runFriendlyId, \"socket_run_replaced\");\n }\n\n this.runSockets.set(friendlyId, socket);\n this.emit(\"runConnected\", { run: { friendlyId } });\n socket.data.runFriendlyId = friendlyId;\n emitSocketLifecycle(\"run_connected\", friendlyId);\n };\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "loader" function_lines = [[15, 95]] id = "triggerdotdev-trigger.dev-173943fa33a292d8" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/routes/sync.traces.runs.$traceId.ts" post_fix = "export async function loader({ params, request }: LoaderFunctionArgs) {\n try {\n const userId = await getUserId(request);\n\n const parsedParams = Params.safeParse(params);\n if (!parsedParams.success) {\n return new Response(\"Not found\", { status: 404 });\n }\n const { traceId } = parsedParams.data;\n\n logger.log(`/sync/runs/${traceId}`, { userId });\n\n if (!userId) {\n return new Response(\"No user found in cookie\", { status: 401 });\n }\n\n let run = await runStore.findRun(\n {\n traceId,\n },\n {\n select: {\n projectId: true,\n runtimeEnvironmentId: true,\n },\n },\n $replica\n );\n\n if (!run) {\n // Read-your-writes: a just-created run may not have replicated yet. Re-read the owning\n // primary before 404ing so a live run's realtime trace feed isn't spuriously not-found.\n run = await runStore.findRunOnPrimary(\n { traceId },\n { select: { projectId: true, runtimeEnvironmentId: true } }\n );\n }\n\n if (!run) {\n return new Response(\"No run found\", { status: 404 });\n }\n\n const resolvedEnv = await controlPlaneResolver.resolveEnv(run.runtimeEnvironmentId);\n\n if (!resolvedEnv) {\n return new Response(\"No run found\", { status: 404 });\n }\n\n const member = await $replica.orgMember.findFirst({\n where: {\n organizationId: resolvedEnv.organizationId,\n userId,\n },\n });\n\n if (!member) {\n return new Response(\"Not a member of this org\", { status: 401 });\n }\n\n const url = new URL(request.url);\n const originUrl = new URL(`${env.ELECTRIC_ORIGIN}/v1/shape/public.\"TaskRun\"`);\n // Strip params we set ourselves so the caller can't override them.\n url.searchParams.forEach((value, key) => {\n if (RESERVED_ELECTRIC_SHAPE_PARAMS.has(key)) return;\n originUrl.searchParams.set(key, value);\n });\n\n originUrl.searchParams.set(\n \"where\",\n // Scope by non-null projectId, not the nullable organizationId (legacy\n // rows would vanish). Tenant-safe: membership was verified against this\n // project's org and a trace's runs all live in one project.\n buildElectricTraceWhereClause({\n traceId,\n scope: { column: \"projectId\", id: run.projectId },\n })\n );\n\n const finalUrl = originUrl.toString();\n\n logger.log(\"Fetching trace runs data\", { url: finalUrl });\n\n return longPollingFetch(finalUrl);\n } catch (error) {\n if (error instanceof Response) {\n // Error responses from longPollingFetch\n return error;\n } else if (error instanceof TypeError) {\n // Unexpected errors\n logger.error(\"Unexpected error in loader:\", { error: error.message });\n return new Response(\"An unexpected error occurred\", { status: 500 });\n } else {\n // Unknown errors\n logger.error(\"Unknown error occurred in loader, not Error\", { error: JSON.stringify(error) });\n return new Response(\"An unknown error occurred\", { status: 500 });\n }\n }\n}" pre_fix = "export async function loader({ params, request }: LoaderFunctionArgs) {\n try {\n const userId = await getUserId(request);\n const { traceId } = Params.parse(params);\n\n logger.log(`/sync/runs/${traceId}`, { userId });\n\n if (!userId) {\n return new Response(\"No user found in cookie\", { status: 401 });\n }\n\n let run = await runStore.findRun(\n {\n traceId,\n },\n {\n select: {\n runtimeEnvironmentId: true,\n },\n },\n $replica\n );\n\n if (!run) {\n // Read-your-writes: a just-created run may not have replicated yet. Re-read the owning\n // primary before 404ing so a live run's realtime trace feed isn't spuriously not-found.\n run = await runStore.findRunOnPrimary(\n { traceId },\n { select: { runtimeEnvironmentId: true } }\n );\n }\n\n if (!run) {\n return new Response(\"No run found\", { status: 404 });\n }\n\n const resolvedEnv = await controlPlaneResolver.resolveEnv(run.runtimeEnvironmentId);\n\n if (!resolvedEnv) {\n return new Response(\"No run found\", { status: 404 });\n }\n\n const member = await $replica.orgMember.findFirst({\n where: {\n organizationId: resolvedEnv.organizationId,\n userId,\n },\n });\n\n if (!member) {\n return new Response(\"Not a member of this org\", { status: 401 });\n }\n\n const url = new URL(request.url);\n const originUrl = new URL(`${env.ELECTRIC_ORIGIN}/v1/shape/public.\"TaskRun\"`);\n url.searchParams.forEach((value, key) => {\n originUrl.searchParams.set(key, value);\n });\n\n originUrl.searchParams.set(\"where\", `\"traceId\"='${traceId}'`);\n\n const finalUrl = originUrl.toString();\n\n logger.log(\"Fetching trace runs data\", { url: finalUrl });\n\n return longPollingFetch(finalUrl);\n } catch (error) {\n if (error instanceof Response) {\n // Error responses from longPollingFetch\n return error;\n } else if (error instanceof TypeError) {\n // Unexpected errors\n logger.error(\"Unexpected error in loader:\", { error: error.message });\n return new Response(\"An unexpected error occurred\", { status: 500 });\n } else {\n // Unknown errors\n logger.error(\"Unknown error occurred in loader, not Error\", { error: JSON.stringify(error) });\n return new Response(\"An unknown error occurred\", { status: 500 });\n }\n }\n}" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "call" function_lines = [[24, 315]] id = "triggerdotdev-trigger.dev-2240070f2c86924b" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/v3/services/initializeDeployment.server.ts" post_fix = " public async call(\n environment: AuthenticatedEnvironment,\n payload: InitializeDeploymentRequestBody\n ) {\n return this.traceWithEnv(\"call\", environment, async () => {\n if (payload.gitMeta?.commitSha?.startsWith(\"deployment_\")) {\n // When we introduced automatic deployments via the build server, we slightly changed the deployment flow\n // mainly in the initialization and starting step: now deployments are first initialized in the `PENDING` status\n // and updated to `BUILDING` once the build server dequeues the build job.\n // Newer versions of the `deploy` command in the CLI will automatically attach to the existing deployment\n // and continue with the build process. For older versions, we can't change the command's client-side behavior,\n // so we need to handle this case here in the initialization endpoint. As we control the env variables which\n // the git meta is extracted from in the build server, we can use those to pass the existing deployment ID\n // to this endpoint. This doesn't affect the git meta on the deployment as it is set prior to this step using the\n // /start endpoint. It's a rather hacky solution, but it will do for now as it enables us to avoid degrading the\n // build server experience for users with older CLI versions. We'll eventually be able to remove this workaround\n // once we stop supporting 3.x CLI versions.\n\n const existingDeploymentId = payload.gitMeta.commitSha;\n const existingDeployment = await this._prisma.workerDeployment.findFirst({\n where: {\n environmentId: environment.id,\n friendlyId: existingDeploymentId,\n },\n });\n\n if (!existingDeployment) {\n throw new ServiceValidationError(\n \"Existing deployment not found during deployment initialization\"\n );\n }\n\n return {\n deployment: existingDeployment,\n imageRef: existingDeployment.imageReference ?? \"\",\n };\n }\n\n // v4 CLI versions always send `payload.type` (\"MANAGED\" or \"V1\"). v3 CLI\n // versions never do, so the absence of `type` is a reliable signal that\n // the request came from a 3.x CLI. Detection always runs (so we can\n // observe how many deploys are still using v3), enforcement is gated\n // behind DEPRECATE_V3_CLI_DEPLOYS_ENABLED so it can be rolled out safely.\n if (!payload.type) {\n const enforced = env.DEPRECATE_V3_CLI_DEPLOYS_ENABLED === \"1\";\n\n logger.warn(\"Detected deploy from deprecated v3 CLI\", {\n environmentId: environment.id,\n projectId: environment.projectId,\n organizationId: environment.project.organizationId,\n enforced,\n });\n\n if (enforced) {\n throw new ServiceValidationError(\n \"The trigger.dev CLI v3 is no longer supported for deployments. Please upgrade your project to v4: https://trigger.dev/docs/migrating-from-v3\"\n );\n }\n }\n\n if (payload.type === \"UNMANAGED\") {\n throw new ServiceValidationError(\"UNMANAGED deployments are not supported\");\n }\n\n // Upgrade the project to engine \"V2\" if it's not already. This should cover cases where people deploy to V2 without running dev first.\n if (payload.type === \"MANAGED\" && environment.project.engine === \"V1\") {\n await this._prisma.project.update({\n where: {\n id: environment.project.id,\n },\n data: {\n engine: \"V2\",\n },\n });\n }\n\n if (payload.selfHosted && remoteBuildsEnabled()) {\n throw new ServiceValidationError(\n \"Self-hosted deployments are not supported on this instance\"\n );\n }\n\n // For the `PENDING` initial status, defer the creation of the Depot build until the deployment is started to avoid token expiration issues.\n // For local and native builds we don't need to generate the Depot tokens. We still need to create an empty object sadly due to a bug in older CLI versions.\n const generateExternalBuildToken =\n payload.initialStatus === \"PENDING\" || payload.isNativeBuild || payload.isLocalBuild;\n\n const externalBuildData = generateExternalBuildToken\n ? ({\n projectId: \"-\",\n buildToken: \"-\",\n buildId: \"-\",\n } satisfies ExternalBuildData)\n : await createRemoteImageBuild(environment.project);\n\n const triggeredBy = payload.userId\n ? await this._prisma.user.findFirst({\n where: {\n id: payload.userId,\n orgMemberships: {\n some: {\n organizationId: environment.project.organizationId,\n },\n },\n },\n })\n : undefined;\n\n const isV4Deployment = payload.type === \"MANAGED\";\n const registryConfig = getRegistryConfig(isV4Deployment);\n\n const deploymentShortCode = nanoid(8);\n\n // We keep using `BUILDING` as the initial status if not explicitly set\n // to avoid changing the behavior for deployments not created in the build server.\n // Native builds always start in the `PENDING` status.\n const initialStatus =\n payload.initialStatus ?? (payload.isNativeBuild ? \"PENDING\" : \"BUILDING\");\n\n const deploymentService = new DeploymentService();\n const s2StreamOrFail = await deploymentService\n .createEventStream(environment.project, { shortCode: deploymentShortCode })\n .andThen(({ basin, stream }) =>\n deploymentService.getEventStreamAccessToken(environment.project).map((accessToken) => ({\n basin,\n stream,\n accessToken,\n }))\n );\n\n if (s2StreamOrFail.isErr()) {\n logger.error(\n \"Failed to create S2 event stream on deployment initialization, continuing without logs stream\",\n {\n environmentId: environment.id,\n projectId: environment.projectId,\n error: s2StreamOrFail.error,\n }\n );\n }\n\n const eventStream = s2StreamOrFail.isOk()\n ? {\n s2: {\n basin: s2StreamOrFail.value.basin,\n stream: s2StreamOrFail.value.stream,\n accessToken: s2StreamOrFail.value.accessToken,\n },\n }\n : undefined;\n\n const buildServerMetadata: BuildServerMetadata | undefined =\n payload.isNativeBuild || payload.buildId\n ? {\n buildId: payload.buildId,\n ...(payload.isNativeBuild\n ? {\n isNativeBuild: payload.isNativeBuild,\n artifactKey: payload.artifactKey,\n skipPromotion: payload.skipPromotion,\n configFilePath: payload.configFilePath,\n skipEnqueue: payload.skipEnqueue,\n }\n : {}),\n }\n : undefined;\n\n // Concurrent deploys to the same environment race on the\n // `(environmentId, version)` unique constraint. The helper retries on\n // P2002, recomputing the version (and re-running the image ref call so\n // the persisted imageReference always matches the persisted version)\n // each attempt.\n const deployment = await createDeploymentWithNextVersion(\n this._prisma,\n environment.id,\n async (nextVersion) => {\n const [imageRefError, imageRefResult] = await tryCatch(\n getDeploymentImageRef({\n registry: registryConfig,\n projectRef: environment.project.externalRef,\n nextVersion,\n environmentType: environment.type,\n deploymentShortCode,\n })\n );\n\n if (imageRefError) {\n logger.error(\"Failed to get deployment image ref\", {\n environmentId: environment.id,\n projectId: environment.projectId,\n version: nextVersion,\n triggeredById: triggeredBy?.id,\n type: payload.type,\n cause: imageRefError.message,\n });\n throw new ServiceValidationError(\"Failed to get deployment image ref\");\n }\n\n const { imageRef, isEcr, repoCreated } = imageRefResult;\n\n logger.debug(\"Creating deployment\", {\n environmentId: environment.id,\n projectId: environment.projectId,\n version: nextVersion,\n triggeredById: triggeredBy?.id,\n type: payload.type,\n imageRef,\n isEcr,\n repoCreated,\n initialStatus,\n artifactKey: payload.isNativeBuild ? payload.artifactKey : undefined,\n isNativeBuild: payload.isNativeBuild,\n });\n\n return {\n // Regenerated per attempt: each attempt is a fresh `create` that\n // must satisfy `WorkerDeployment.friendlyId @unique`, so reusing a\n // friendlyId across retries would risk a spurious P2002 on\n // friendlyId instead of the version collision we're retrying.\n friendlyId: generateFriendlyId(\"deployment\"),\n contentHash: payload.contentHash,\n shortCode: deploymentShortCode,\n status: initialStatus,\n projectId: environment.projectId,\n externalBuildData,\n buildServerMetadata,\n triggeredById: triggeredBy?.id,\n type: payload.type,\n imageReference: imageRef,\n imagePlatform: env.DEPLOY_IMAGE_PLATFORM,\n git: payload.gitMeta ?? undefined,\n commitSHA: payload.gitMeta?.commitSha ?? undefined,\n runtime: payload.runtime ?? undefined,\n triggeredVia: payload.triggeredVia ?? undefined,\n startedAt: initialStatus === \"BUILDING\" ? new Date() : undefined,\n };\n }\n );\n\n const timeoutMs =\n deployment.status === \"PENDING\" ? env.DEPLOY_QUEUE_TIMEOUT_MS : env.DEPLOY_TIMEOUT_MS;\n\n await TimeoutDeploymentService.enqueue(\n deployment.id,\n deployment.status,\n \"Building timed out\",\n new Date(Date.now() + timeoutMs)\n );\n\n // For github integration there is no artifactKey, hence we skip it here\n if (payload.isNativeBuild && payload.artifactKey && !payload.skipEnqueue) {\n const result = await deploymentService\n .enqueueBuild(environment, deployment, payload.artifactKey, {\n skipPromotion: payload.skipPromotion,\n configFilePath: payload.configFilePath,\n })\n .orElse((error) => {\n logger.error(\"Failed to enqueue build\", {\n environmentId: environment.id,\n projectId: environment.projectId,\n deploymentId: deployment.id,\n error: error.cause,\n });\n\n return deploymentService\n .cancelDeployment({ id: environment.id }, deployment.friendlyId, {\n canceledReason: \"Failed to enqueue build, please try again shortly.\",\n })\n .orTee((cancelError) =>\n logger.error(\"Failed to cancel deployment after failed build enqueue\", {\n environmentId: environment.id,\n projectId: environment.projectId,\n deploymentId: deployment.id,\n error: cancelError,\n })\n )\n .andThen(() => errAsync(error))\n .orElse(() => errAsync(error));\n });\n\n if (result.isErr()) {\n throw Error(\"Failed to enqueue build\");\n }\n }\n\n return {\n deployment,\n imageRef: deployment.imageReference ?? \"\",\n eventStream,\n };\n });\n }" pre_fix = " public async call(\n environment: AuthenticatedEnvironment,\n payload: InitializeDeploymentRequestBody\n ) {\n return this.traceWithEnv(\"call\", environment, async () => {\n if (payload.gitMeta?.commitSha?.startsWith(\"deployment_\")) {\n // When we introduced automatic deployments via the build server, we slightly changed the deployment flow\n // mainly in the initialization and starting step: now deployments are first initialized in the `PENDING` status\n // and updated to `BUILDING` once the build server dequeues the build job.\n // Newer versions of the `deploy` command in the CLI will automatically attach to the existing deployment\n // and continue with the build process. For older versions, we can't change the command's client-side behavior,\n // so we need to handle this case here in the initialization endpoint. As we control the env variables which\n // the git meta is extracted from in the build server, we can use those to pass the existing deployment ID\n // to this endpoint. This doesn't affect the git meta on the deployment as it is set prior to this step using the\n // /start endpoint. It's a rather hacky solution, but it will do for now as it enables us to avoid degrading the\n // build server experience for users with older CLI versions. We'll eventually be able to remove this workaround\n // once we stop supporting 3.x CLI versions.\n\n const existingDeploymentId = payload.gitMeta.commitSha;\n const existingDeployment = await this._prisma.workerDeployment.findFirst({\n where: {\n environmentId: environment.id,\n friendlyId: existingDeploymentId,\n },\n });\n\n if (!existingDeployment) {\n throw new ServiceValidationError(\n \"Existing deployment not found during deployment initialization\"\n );\n }\n\n return {\n deployment: existingDeployment,\n imageRef: existingDeployment.imageReference ?? \"\",\n };\n }\n\n // v4 CLI versions always send `payload.type` (\"MANAGED\" or \"V1\"). v3 CLI\n // versions never do, so the absence of `type` is a reliable signal that\n // the request came from a 3.x CLI. Detection always runs (so we can\n // observe how many deploys are still using v3), enforcement is gated\n // behind DEPRECATE_V3_CLI_DEPLOYS_ENABLED so it can be rolled out safely.\n if (!payload.type) {\n const enforced = env.DEPRECATE_V3_CLI_DEPLOYS_ENABLED === \"1\";\n\n logger.warn(\"Detected deploy from deprecated v3 CLI\", {\n environmentId: environment.id,\n projectId: environment.projectId,\n organizationId: environment.project.organizationId,\n enforced,\n });\n\n if (enforced) {\n throw new ServiceValidationError(\n \"The trigger.dev CLI v3 is no longer supported for deployments. Please upgrade your project to v4: https://trigger.dev/docs/migrating-from-v3\"\n );\n }\n }\n\n if (payload.type === \"UNMANAGED\") {\n throw new ServiceValidationError(\"UNMANAGED deployments are not supported\");\n }\n\n // Upgrade the project to engine \"V2\" if it's not already. This should cover cases where people deploy to V2 without running dev first.\n if (payload.type === \"MANAGED\" && environment.project.engine === \"V1\") {\n await this._prisma.project.update({\n where: {\n id: environment.project.id,\n },\n data: {\n engine: \"V2\",\n },\n });\n }\n\n if (payload.selfHosted && remoteBuildsEnabled()) {\n throw new ServiceValidationError(\n \"Self-hosted deployments are not supported on this instance\"\n );\n }\n\n // For the `PENDING` initial status, defer the creation of the Depot build until the deployment is started to avoid token expiration issues.\n // For local and native builds we don't need to generate the Depot tokens. We still need to create an empty object sadly due to a bug in older CLI versions.\n const generateExternalBuildToken =\n payload.initialStatus === \"PENDING\" || payload.isNativeBuild || payload.isLocalBuild;\n\n const externalBuildData = generateExternalBuildToken\n ? ({\n projectId: \"-\",\n buildToken: \"-\",\n buildId: \"-\",\n } satisfies ExternalBuildData)\n : await createRemoteImageBuild(environment.project);\n\n const triggeredBy = payload.userId\n ? await this._prisma.user.findFirst({\n where: {\n id: payload.userId,\n orgMemberships: {\n some: {\n organizationId: environment.project.organizationId,\n },\n },\n },\n })\n : undefined;\n\n const isV4Deployment = payload.type === \"MANAGED\";\n const registryConfig = getRegistryConfig(isV4Deployment);\n\n const deploymentShortCode = nanoid(8);\n\n // We keep using `BUILDING` as the initial status if not explicitly set\n // to avoid changing the behavior for deployments not created in the build server.\n // Native builds always start in the `PENDING` status.\n const initialStatus =\n payload.initialStatus ?? (payload.isNativeBuild ? \"PENDING\" : \"BUILDING\");\n\n const deploymentService = new DeploymentService();\n const s2StreamOrFail = await deploymentService\n .createEventStream(environment.project, { shortCode: deploymentShortCode })\n .andThen(({ basin, stream }) =>\n deploymentService.getEventStreamAccessToken(environment.project).map((accessToken) => ({\n basin,\n stream,\n accessToken,\n }))\n );\n\n if (s2StreamOrFail.isErr()) {\n logger.error(\n \"Failed to create S2 event stream on deployment initialization, continuing without logs stream\",\n {\n environmentId: environment.id,\n projectId: environment.projectId,\n error: s2StreamOrFail.error,\n }\n );\n }\n\n const eventStream = s2StreamOrFail.isOk()\n ? {\n s2: {\n basin: s2StreamOrFail.value.basin,\n stream: s2StreamOrFail.value.stream,\n accessToken: s2StreamOrFail.value.accessToken,\n },\n }\n : undefined;\n\n const buildServerMetadata: BuildServerMetadata | undefined =\n payload.isNativeBuild || payload.buildId\n ? {\n buildId: payload.buildId,\n ...(payload.isNativeBuild\n ? {\n isNativeBuild: payload.isNativeBuild,\n artifactKey: payload.artifactKey,\n skipPromotion: payload.skipPromotion,\n configFilePath: payload.configFilePath,\n skipEnqueue: payload.skipEnqueue,\n }\n : {}),\n }\n : undefined;\n\n // Concurrent deploys to the same environment race on the\n // `(environmentId, version)` unique constraint. The helper retries on\n // P2002, recomputing the version (and re-running the image ref call so\n // the persisted imageReference always matches the persisted version)\n // each attempt.\n const deployment = await createDeploymentWithNextVersion(\n this._prisma,\n environment.id,\n async (nextVersion) => {\n const [imageRefError, imageRefResult] = await tryCatch(\n getDeploymentImageRef({\n registry: registryConfig,\n projectRef: environment.project.externalRef,\n nextVersion,\n environmentType: environment.type,\n deploymentShortCode,\n })\n );\n\n if (imageRefError) {\n logger.error(\"Failed to get deployment image ref\", {\n environmentId: environment.id,\n projectId: environment.projectId,\n version: nextVersion,\n triggeredById: triggeredBy?.id,\n type: payload.type,\n cause: imageRefError.message,\n });\n throw new ServiceValidationError(\"Failed to get deployment image ref\");\n }\n\n const { imageRef, isEcr, repoCreated } = imageRefResult;\n\n logger.debug(\"Creating deployment\", {\n environmentId: environment.id,\n projectId: environment.projectId,\n version: nextVersion,\n triggeredById: triggeredBy?.id,\n type: payload.type,\n imageRef,\n isEcr,\n repoCreated,\n initialStatus,\n artifactKey: payload.isNativeBuild ? payload.artifactKey : undefined,\n isNativeBuild: payload.isNativeBuild,\n });\n\n return {\n // Regenerated per attempt: each attempt is a fresh `create` that\n // must satisfy `WorkerDeployment.friendlyId @unique`, so reusing a\n // friendlyId across retries would risk a spurious P2002 on\n // friendlyId instead of the version collision we're retrying.\n friendlyId: generateFriendlyId(\"deployment\"),\n contentHash: payload.contentHash,\n shortCode: deploymentShortCode,\n status: initialStatus,\n projectId: environment.projectId,\n externalBuildData,\n buildServerMetadata,\n triggeredById: triggeredBy?.id,\n type: payload.type,\n imageReference: imageRef,\n imagePlatform: env.DEPLOY_IMAGE_PLATFORM,\n git: payload.gitMeta ?? undefined,\n commitSHA: payload.gitMeta?.commitSha ?? undefined,\n runtime: payload.runtime ?? undefined,\n triggeredVia: payload.triggeredVia ?? undefined,\n startedAt: initialStatus === \"BUILDING\" ? new Date() : undefined,\n };\n }\n );\n\n const timeoutMs =\n deployment.status === \"PENDING\" ? env.DEPLOY_QUEUE_TIMEOUT_MS : env.DEPLOY_TIMEOUT_MS;\n\n await TimeoutDeploymentService.enqueue(\n deployment.id,\n deployment.status,\n \"Building timed out\",\n new Date(Date.now() + timeoutMs)\n );\n\n // For github integration there is no artifactKey, hence we skip it here\n if (payload.isNativeBuild && payload.artifactKey && !payload.skipEnqueue) {\n const result = await deploymentService\n .enqueueBuild(environment, deployment, payload.artifactKey, {\n skipPromotion: payload.skipPromotion,\n configFilePath: payload.configFilePath,\n })\n .orElse((error) => {\n logger.error(\"Failed to enqueue build\", {\n environmentId: environment.id,\n projectId: environment.projectId,\n deploymentId: deployment.id,\n error: error.cause,\n });\n\n return deploymentService\n .cancelDeployment(environment, deployment.friendlyId, {\n canceledReason: \"Failed to enqueue build, please try again shortly.\",\n })\n .orTee((cancelError) =>\n logger.error(\"Failed to cancel deployment after failed build enqueue\", {\n environmentId: environment.id,\n projectId: environment.projectId,\n deploymentId: deployment.id,\n error: cancelError,\n })\n )\n .andThen(() => errAsync(error))\n .orElse(() => errAsync(error));\n });\n\n if (result.isErr()) {\n throw Error(\"Failed to enqueue build\");\n }\n }\n\n return {\n deployment,\n imageRef: deployment.imageReference ?? \"\",\n eventStream,\n };\n });\n }" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "call" function_lines = [[17, 129]] id = "triggerdotdev-trigger.dev-23e4ffbc736b2960" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/v3/services/checkSchedule.server.ts" post_fix = " public async call(projectId: string, schedule: Schedule, environmentIds: string[]) {\n //validate the cron expression\n try {\n CronPattern.parse(schedule.cron);\n } catch (e) {\n if (e instanceof ZodError) {\n throw new ServiceValidationError(`Invalid cron expression: ${e.issues[0].message}`);\n }\n\n throw new ServiceValidationError(\n `Invalid cron expression: ${e instanceof Error ? e.message : JSON.stringify(e)}`\n );\n }\n\n //chek it's a valid timezone\n if (schedule.timezone) {\n const possibleTimezones = getTimezones();\n if (!possibleTimezones.includes(schedule.timezone)) {\n throw new ServiceValidationError(\n `Invalid IANA timezone: '${schedule.timezone}'. View the list of valid timezones at ${env.APP_ORIGIN}/timezones`\n );\n }\n }\n\n //check the task exists\n const task = await this._prisma.backgroundWorkerTask.findFirst({\n where: {\n slug: schedule.taskIdentifier,\n projectId: projectId,\n },\n orderBy: {\n createdAt: \"desc\",\n },\n });\n\n if (!task) {\n throw new ServiceValidationError(\n `Task with identifier ${schedule.taskIdentifier} not found in project.`\n );\n }\n\n if (task.triggerSource !== \"SCHEDULED\") {\n throw new ServiceValidationError(\n `Task with identifier ${schedule.taskIdentifier} is not a scheduled task.`\n );\n }\n\n //check they're within their limit\n const project = await this._prisma.project.findFirst({\n where: {\n id: projectId,\n },\n select: {\n organizationId: true,\n environments: {\n select: {\n id: true,\n type: true,\n archivedAt: true,\n },\n },\n },\n });\n\n if (!project) {\n throw new ServiceValidationError(\"Project not found\");\n }\n\n // Reject (don't silently drop) any environmentId that doesn't belong to the\n // authorized project.\n const scopedEnvironments = resolveProjectScopedEnvironments(\n environmentIds,\n project.environments\n );\n if (scopedEnvironments.kind === \"foreign\") {\n throw new ServiceValidationError(\n `Environment ${scopedEnvironments.foreignEnvironmentId} does not belong to this project.`\n );\n }\n\n const environments = scopedEnvironments.environments;\n if (environments.some((env) => env.archivedAt)) {\n throw new ServiceValidationError(\"Can't add or edit a schedule for an archived branch\");\n }\n\n //if creating a schedule, check they're under the limits\n if (!schedule.friendlyId) {\n const limit = await getLimit(project.organizationId, \"schedules\", 100_000_000);\n const schedulesCount = await CheckScheduleService.getUsedSchedulesCount({\n prisma: this._prisma,\n projectId,\n });\n\n if (schedulesCount >= limit) {\n throw new ServiceValidationError(\n `You have created ${schedulesCount}/${limit} schedules so you'll need to increase your limits or delete some schedules.`\n );\n }\n }\n }\n\n static async getUsedSchedulesCount({\n prisma,\n projectId,\n }: {\n prisma: PrismaClientOrTransaction;\n projectId: string;\n }) {\n return await prisma.taskScheduleInstance.count({\n where: {\n projectId,\n active: true,\n environment: {\n type: {\n not: \"DEVELOPMENT\",\n },\n archivedAt: null,\n },\n taskSchedule: {\n active: true,\n },\n },\n });\n }\n}" pre_fix = " public async call(projectId: string, schedule: Schedule, environmentIds: string[]) {\n //validate the cron expression\n try {\n CronPattern.parse(schedule.cron);\n } catch (e) {\n if (e instanceof ZodError) {\n throw new ServiceValidationError(`Invalid cron expression: ${e.issues[0].message}`);\n }\n\n throw new ServiceValidationError(\n `Invalid cron expression: ${e instanceof Error ? e.message : JSON.stringify(e)}`\n );\n }\n\n //chek it's a valid timezone\n if (schedule.timezone) {\n const possibleTimezones = getTimezones();\n if (!possibleTimezones.includes(schedule.timezone)) {\n throw new ServiceValidationError(\n `Invalid IANA timezone: '${schedule.timezone}'. View the list of valid timezones at ${env.APP_ORIGIN}/timezones`\n );\n }\n }\n\n //check the task exists\n const task = await this._prisma.backgroundWorkerTask.findFirst({\n where: {\n slug: schedule.taskIdentifier,\n projectId: projectId,\n },\n orderBy: {\n createdAt: \"desc\",\n },\n });\n\n if (!task) {\n throw new ServiceValidationError(\n `Task with identifier ${schedule.taskIdentifier} not found in project.`\n );\n }\n\n if (task.triggerSource !== \"SCHEDULED\") {\n throw new ServiceValidationError(\n `Task with identifier ${schedule.taskIdentifier} is not a scheduled task.`\n );\n }\n\n //check they're within their limit\n const project = await this._prisma.project.findFirst({\n where: {\n id: projectId,\n },\n select: {\n organizationId: true,\n environments: {\n select: {\n id: true,\n type: true,\n archivedAt: true,\n },\n },\n },\n });\n\n if (!project) {\n throw new ServiceValidationError(\"Project not found\");\n }\n\n const environments = project.environments.filter((env) => environmentIds.includes(env.id));\n if (environments.some((env) => env.archivedAt)) {\n throw new ServiceValidationError(\"Can't add or edit a schedule for an archived branch\");\n }\n\n //if creating a schedule, check they're under the limits\n if (!schedule.friendlyId) {\n const limit = await getLimit(project.organizationId, \"schedules\", 100_000_000);\n const schedulesCount = await CheckScheduleService.getUsedSchedulesCount({\n prisma: this._prisma,\n projectId,\n });\n\n if (schedulesCount >= limit) {\n throw new ServiceValidationError(\n `You have created ${schedulesCount}/${limit} schedules so you'll need to increase your limits or delete some schedules.`\n );\n }\n }\n }\n\n static async getUsedSchedulesCount({\n prisma,\n projectId,\n }: {\n prisma: PrismaClientOrTransaction;\n projectId: string;\n }) {\n return await prisma.taskScheduleInstance.count({\n where: {\n projectId,\n active: true,\n environment: {\n type: {\n not: \"DEVELOPMENT\",\n },\n archivedAt: null,\n },\n taskSchedule: {\n active: true,\n },\n },\n });\n }\n}" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "startRunAttempt" function_lines = [[142, 160]] id = "triggerdotdev-trigger.dev-28978c4024d4bf10" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "packages/core/src/v3/runEngineWorker/supervisor/http.ts" post_fix = " async startRunAttempt(\n runId: string,\n snapshotId: string,\n body: WorkerApiRunAttemptStartRequestBody,\n runnerId?: string,\n environmentId?: string\n ) {\n return wrapZodFetch(\n WorkerApiRunAttemptStartResponseBody,\n `${this.apiUrl}/engine/v1/worker-actions/runs/${runId}/snapshots/${snapshotId}/attempts/start`,\n {\n method: \"POST\",\n headers: {\n ...this.defaultHeaders,\n ...this.runnerIdHeader(runnerId),\n ...this.environmentIdHeader(environmentId),\n },\n body: JSON.stringify(body),\n }\n );\n }" pre_fix = " async startRunAttempt(\n runId: string,\n snapshotId: string,\n body: WorkerApiRunAttemptStartRequestBody,\n runnerId?: string\n ) {\n return wrapZodFetch(\n WorkerApiRunAttemptStartResponseBody,\n `${this.apiUrl}/engine/v1/worker-actions/runs/${runId}/snapshots/${snapshotId}/attempts/start`,\n {\n method: \"POST\",\n headers: {\n ...this.defaultHeaders,\n ...this.runnerIdHeader(runnerId),\n },\n body: JSON.stringify(body),\n }\n );\n }" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "loader" function_lines = [[8, 69]] id = "triggerdotdev-trigger.dev-2ad2f0a3cde32718" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/routes/sync.traces.$traceId.ts" post_fix = "export async function loader({ params, request }: LoaderFunctionArgs) {\n try {\n const userId = await getUserId(request);\n\n const parsedParams = Params.safeParse(params);\n if (!parsedParams.success) {\n // Treat a malformed traceId as not-found rather than 400 to avoid\n // signalling the validator.\n return new Response(\"Not found\", { status: 404 });\n }\n const { traceId } = parsedParams.data;\n\n logger.log(`/sync/traces/${traceId}`, { userId });\n\n if (!userId) {\n return new Response(\"No user found in cookie\", { status: 401 });\n }\n\n const trace = await $replica.taskEvent.findFirst({\n select: {\n organizationId: true,\n },\n where: {\n traceId,\n },\n });\n\n if (!trace) {\n return new Response(\"No trace found\", { status: 404 });\n }\n\n const member = await $replica.orgMember.findFirst({\n where: {\n organizationId: trace.organizationId,\n userId,\n },\n });\n\n if (!member) {\n return new Response(\"Not a member of this org\", { status: 401 });\n }\n\n const url = new URL(request.url);\n const originUrl = new URL(`${env.ELECTRIC_ORIGIN}/v1/shape/public.\"TaskEvent\"`);\n // Strip params we set ourselves so the caller can't override them.\n url.searchParams.forEach((value, key) => {\n if (RESERVED_ELECTRIC_SHAPE_PARAMS.has(key)) return;\n originUrl.searchParams.set(key, value);\n });\n\n originUrl.searchParams.set(\n \"where\",\n buildElectricTraceWhereClause({\n traceId,\n scope: { column: \"organizationId\", id: trace.organizationId },\n })\n );\n\n const finalUrl = originUrl.toString();\n\n logger.log(\"Fetching trace data\", { url: finalUrl });\n\n return longPollingFetch(finalUrl);\n } catch (error) {\n if (error instanceof Response) {\n // Error responses from longPollingFetch\n return error;\n } else if (error instanceof TypeError) {\n // Unexpected errors\n logger.error(\"Unexpected error in loader:\", { error: error.message });\n return new Response(\"An unexpected error occurred\", { status: 500 });\n } else {\n // Unknown errors\n logger.error(\"Unknown error occurred in loader, not Error\", { error: JSON.stringify(error) });\n return new Response(\"An unknown error occurred\", { status: 500 });\n }\n }\n}" pre_fix = "export async function loader({ params, request }: LoaderFunctionArgs) {\n try {\n const userId = await getUserId(request);\n\n logger.log(`/sync/traces/${params.traceId}`, { userId });\n\n if (!userId) {\n return new Response(\"No user found in cookie\", { status: 401 });\n }\n\n const trace = await $replica.taskEvent.findFirst({\n select: {\n organizationId: true,\n },\n where: {\n traceId: params.traceId,\n },\n });\n\n if (!trace) {\n return new Response(\"No trace found\", { status: 404 });\n }\n\n const member = await $replica.orgMember.findFirst({\n where: {\n organizationId: trace.organizationId,\n userId,\n },\n });\n\n if (!member) {\n return new Response(\"Not a member of this org\", { status: 401 });\n }\n\n const url = new URL(request.url);\n const originUrl = new URL(`${env.ELECTRIC_ORIGIN}/v1/shape/public.\"TaskEvent\"`);\n url.searchParams.forEach((value, key) => {\n originUrl.searchParams.set(key, value);\n });\n\n originUrl.searchParams.set(\"where\", `\"traceId\"='${params.traceId}'`);\n\n const finalUrl = originUrl.toString();\n\n logger.log(\"Fetching trace data\", { url: finalUrl });\n\n return longPollingFetch(finalUrl);\n } catch (error) {\n if (error instanceof Response) {\n // Error responses from longPollingFetch\n return error;\n } else if (error instanceof TypeError) {\n // Unexpected errors\n logger.error(\"Unexpected error in loader:\", { error: error.message });\n return new Response(\"An unexpected error occurred\", { status: 500 });\n } else {\n // Unknown errors\n logger.error(\"Unknown error occurred in loader, not Error\", { error: JSON.stringify(error) });\n return new Response(\"An unknown error occurred\", { status: 500 });\n }\n }\n}" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "mcpAuth" function_lines = [[21, 158]] id = "triggerdotdev-trigger.dev-2f8805383abee870" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "packages/cli-v3/src/mcp/auth.ts" post_fix = "export async function mcpAuth(options: McpAuthOptions): Promise {\n const opts = {\n defaultApiUrl: CLOUD_API_URL,\n ...options,\n };\n\n const accessTokenFromEnv = env.TRIGGER_ACCESS_TOKEN;\n\n if (accessTokenFromEnv) {\n const validationResult = validateAccessToken(accessTokenFromEnv);\n\n if (!validationResult.success) {\n // We deliberately don't surface the existence of organization access tokens to the user for now, as they're only used internally.\n // Once we expose them in the application, we should also communicate that option here.\n throw new NotAccessTokenError(\n \"Your TRIGGER_ACCESS_TOKEN is not a Personal Access Token, they start with 'tr_pat_'. You can generate one here: https://cloud.trigger.dev/account/tokens\"\n );\n }\n\n const auth = {\n accessToken: accessTokenFromEnv,\n apiUrl: env.TRIGGER_API_URL ?? opts.defaultApiUrl ?? CLOUD_API_URL,\n };\n\n const apiClient = new CliApiClient(auth.apiUrl, auth.accessToken);\n const userData = await apiClient.whoAmI();\n\n if (!userData.success) {\n throw new Error(userData.error);\n }\n\n return {\n ok: true as const,\n profile: options?.profile ?? \"default\",\n userId: userData.data.userId,\n email: userData.data.email,\n dashboardUrl: userData.data.dashboardUrl,\n auth: {\n accessToken: auth.accessToken,\n apiUrl: auth.apiUrl,\n tokenType: validationResult.type,\n },\n };\n }\n\n const authConfig = readAuthConfigProfile(options?.profile);\n\n if (authConfig && authConfig.accessToken) {\n const apiClient = new CliApiClient(\n authConfig.apiUrl ?? opts.defaultApiUrl,\n authConfig.accessToken\n );\n const userData = await apiClient.whoAmI();\n\n if (!userData.success) {\n throw new Error(userData.error);\n }\n\n return {\n ok: true as const,\n profile: options?.profile ?? \"default\",\n userId: userData.data.userId,\n email: userData.data.email,\n dashboardUrl: userData.data.dashboardUrl,\n auth: {\n accessToken: authConfig.accessToken,\n apiUrl: authConfig.apiUrl ?? opts.defaultApiUrl,\n tokenType: \"personal\" as const,\n },\n };\n }\n\n const apiClient = new CliApiClient(authConfig?.apiUrl ?? opts.defaultApiUrl);\n\n //generate authorization code\n const authorizationCodeResult = await createAuthorizationCode(apiClient);\n\n const url = new URL(authorizationCodeResult.url);\n\n url.searchParams.set(\"source\", \"mcp\");\n\n const clientName = options.server.server.getClientVersion()?.name;\n\n if (clientName) {\n url.searchParams.set(\"clientName\", clientName);\n }\n // Only elicitInput if the client has the elicitation capability\n\n // Elicit the user to visit the authorization code URL\n const allowLogin = await askForLoginPermission(opts.server, url.toString());\n\n if (!allowLogin) {\n return {\n ok: false as const,\n error: \"User did not allow login\",\n };\n }\n\n // Open the authorization code URL in the browser\n await open(url.toString());\n\n // Poll for the personal access token\n const indexResult = await pRetry(\n () => getPersonalAccessToken(apiClient, authorizationCodeResult.authorizationCode),\n {\n //poll at a fixed 1s interval. ~5 min window so the user has time to\n //approve the consent screen; stays within the code's 10-min validity.\n factor: 1,\n retries: 300,\n minTimeout: 1000,\n }\n );\n\n writeAuthConfigProfile(\n { accessToken: indexResult.token, apiUrl: opts.defaultApiUrl },\n options?.profile\n );\n\n const client = new CliApiClient(opts.defaultApiUrl, indexResult.token);\n const userData = await client.whoAmI();\n\n if (!userData.success) {\n throw new Error(userData.error);\n }\n\n return {\n ok: true as const,\n profile: options?.profile ?? \"default\",\n userId: userData.data.userId,\n email: userData.data.email,\n dashboardUrl: userData.data.dashboardUrl,\n auth: {\n accessToken: indexResult.token,\n apiUrl: opts.defaultApiUrl,\n tokenType: \"personal\" as const,\n },\n };\n}\n" pre_fix = "export async function mcpAuth(options: McpAuthOptions): Promise {\n const opts = {\n defaultApiUrl: CLOUD_API_URL,\n ...options,\n };\n\n const accessTokenFromEnv = env.TRIGGER_ACCESS_TOKEN;\n\n if (accessTokenFromEnv) {\n const validationResult = validateAccessToken(accessTokenFromEnv);\n\n if (!validationResult.success) {\n // We deliberately don't surface the existence of organization access tokens to the user for now, as they're only used internally.\n // Once we expose them in the application, we should also communicate that option here.\n throw new NotAccessTokenError(\n \"Your TRIGGER_ACCESS_TOKEN is not a Personal Access Token, they start with 'tr_pat_'. You can generate one here: https://cloud.trigger.dev/account/tokens\"\n );\n }\n\n const auth = {\n accessToken: accessTokenFromEnv,\n apiUrl: env.TRIGGER_API_URL ?? opts.defaultApiUrl ?? CLOUD_API_URL,\n };\n\n const apiClient = new CliApiClient(auth.apiUrl, auth.accessToken);\n const userData = await apiClient.whoAmI();\n\n if (!userData.success) {\n throw new Error(userData.error);\n }\n\n return {\n ok: true as const,\n profile: options?.profile ?? \"default\",\n userId: userData.data.userId,\n email: userData.data.email,\n dashboardUrl: userData.data.dashboardUrl,\n auth: {\n accessToken: auth.accessToken,\n apiUrl: auth.apiUrl,\n tokenType: validationResult.type,\n },\n };\n }\n\n const authConfig = readAuthConfigProfile(options?.profile);\n\n if (authConfig && authConfig.accessToken) {\n const apiClient = new CliApiClient(\n authConfig.apiUrl ?? opts.defaultApiUrl,\n authConfig.accessToken\n );\n const userData = await apiClient.whoAmI();\n\n if (!userData.success) {\n throw new Error(userData.error);\n }\n\n return {\n ok: true as const,\n profile: options?.profile ?? \"default\",\n userId: userData.data.userId,\n email: userData.data.email,\n dashboardUrl: userData.data.dashboardUrl,\n auth: {\n accessToken: authConfig.accessToken,\n apiUrl: authConfig.apiUrl ?? opts.defaultApiUrl,\n tokenType: \"personal\" as const,\n },\n };\n }\n\n const apiClient = new CliApiClient(authConfig?.apiUrl ?? opts.defaultApiUrl);\n\n //generate authorization code\n const authorizationCodeResult = await createAuthorizationCode(apiClient);\n\n const url = new URL(authorizationCodeResult.url);\n\n url.searchParams.set(\"source\", \"mcp\");\n\n const clientName = options.server.server.getClientVersion()?.name;\n\n if (clientName) {\n url.searchParams.set(\"clientName\", clientName);\n }\n // Only elicitInput if the client has the elicitation capability\n\n // Elicit the user to visit the authorization code URL\n const allowLogin = await askForLoginPermission(opts.server, url.toString());\n\n if (!allowLogin) {\n return {\n ok: false as const,\n error: \"User did not allow login\",\n };\n }\n\n // Open the authorization code URL in the browser\n await open(url.toString());\n\n // Poll for the personal access token\n const indexResult = await pRetry(\n () => getPersonalAccessToken(apiClient, authorizationCodeResult.authorizationCode),\n {\n //this means we're polling, same distance between each attempt\n factor: 1,\n retries: 60,\n minTimeout: 1000,\n }\n );\n\n writeAuthConfigProfile(\n { accessToken: indexResult.token, apiUrl: opts.defaultApiUrl },\n options?.profile\n );\n\n const client = new CliApiClient(opts.defaultApiUrl, indexResult.token);\n const userData = await client.whoAmI();\n\n if (!userData.success) {\n throw new Error(userData.error);\n }\n\n return {\n ok: true as const,\n profile: options?.profile ?? \"default\",\n userId: userData.data.userId,\n email: userData.data.email,\n dashboardUrl: userData.data.dashboardUrl,\n auth: {\n accessToken: indexResult.token,\n apiUrl: opts.defaultApiUrl,\n tokenType: \"personal\" as const,\n },\n };\n}\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "action" function_lines = [[12, 78]] id = "triggerdotdev-trigger.dev-30dec4b7031de737" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts" post_fix = "export async function action({ request, params }: ActionFunctionArgs) {\n if (request.method.toUpperCase() !== \"POST\") {\n return json({ error: \"Method Not Allowed\" }, { status: 405 });\n }\n\n const parsedParams = ParamsSchema.safeParse(params);\n\n if (!parsedParams.success) {\n return json({ error: \"Invalid params\" }, { status: 400 });\n }\n\n try {\n const authenticationResult = await authenticateRequest(request, {\n apiKey: true,\n organizationAccessToken: false,\n personalAccessToken: false,\n });\n\n if (!authenticationResult || !authenticationResult.result.ok) {\n logger.info(\"Invalid or missing api key\", { url: request.url });\n return json({ error: \"Invalid or Missing API key\" }, { status: 401 });\n }\n\n const { environment: authenticatedEnv } = authenticationResult.result;\n const { deploymentId } = parsedParams.data;\n\n const [, rawBody] = await tryCatch(request.json());\n const body = CancelDeploymentRequestBody.safeParse(rawBody ?? {});\n\n if (!body.success) {\n return json({ error: \"Invalid request body\", issues: body.error.issues }, { status: 400 });\n }\n\n const deploymentService = new DeploymentService();\n\n return await deploymentService\n .cancelDeployment({ id: authenticatedEnv.id }, deploymentId, {\n canceledReason: body.data.reason,\n })\n .match(\n () => {\n return new Response(null, { status: 204 });\n },\n (error) => {\n switch (error.type) {\n case \"deployment_not_found\":\n return json({ error: \"Deployment not found\" }, { status: 404 });\n case \"failed_to_delete_deployment_timeout\":\n return new Response(null, { status: 204 }); // not a critical error, ignore\n case \"deployment_cannot_be_cancelled\":\n return json(\n { error: \"Deployment is already in a final state and cannot be canceled\" },\n { status: 409 }\n );\n case \"other\":\n default:\n error.type satisfies \"other\";\n return json({ error: \"Internal server error\" }, { status: 500 });\n }\n }\n );\n } catch (error) {\n if (error instanceof Response) throw error;\n logger.error(\"Failed to cancel deployment\", { error });\n return json({ error: \"Internal Server Error\" }, { status: 500 });\n }\n}" pre_fix = "export async function action({ request, params }: ActionFunctionArgs) {\n if (request.method.toUpperCase() !== \"POST\") {\n return json({ error: \"Method Not Allowed\" }, { status: 405 });\n }\n\n const parsedParams = ParamsSchema.safeParse(params);\n\n if (!parsedParams.success) {\n return json({ error: \"Invalid params\" }, { status: 400 });\n }\n\n try {\n const authenticationResult = await authenticateRequest(request, {\n apiKey: true,\n organizationAccessToken: false,\n personalAccessToken: false,\n });\n\n if (!authenticationResult || !authenticationResult.result.ok) {\n logger.info(\"Invalid or missing api key\", { url: request.url });\n return json({ error: \"Invalid or Missing API key\" }, { status: 401 });\n }\n\n const { environment: authenticatedEnv } = authenticationResult.result;\n const { deploymentId } = parsedParams.data;\n\n const [, rawBody] = await tryCatch(request.json());\n const body = CancelDeploymentRequestBody.safeParse(rawBody ?? {});\n\n if (!body.success) {\n return json({ error: \"Invalid request body\", issues: body.error.issues }, { status: 400 });\n }\n\n const deploymentService = new DeploymentService();\n\n return await deploymentService\n .cancelDeployment(authenticatedEnv, deploymentId, {\n canceledReason: body.data.reason,\n })\n .match(\n () => {\n return new Response(null, { status: 204 });\n },\n (error) => {\n switch (error.type) {\n case \"deployment_not_found\":\n return json({ error: \"Deployment not found\" }, { status: 404 });\n case \"failed_to_delete_deployment_timeout\":\n return new Response(null, { status: 204 }); // not a critical error, ignore\n case \"deployment_cannot_be_cancelled\":\n return json(\n { error: \"Deployment is already in a final state and cannot be canceled\" },\n { status: 409 }\n );\n case \"other\":\n default:\n error.type satisfies \"other\";\n return json({ error: \"Internal server error\" }, { status: 500 });\n }\n }\n );\n } catch (error) {\n if (error instanceof Response) throw error;\n logger.error(\"Failed to cancel deployment\", { error });\n return json({ error: \"Internal Server Error\" }, { status: 500 });\n }\n}" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "getLatestSnapshot" function_lines = [[182, 195]] id = "triggerdotdev-trigger.dev-3309f58798af795d" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "packages/core/src/v3/runEngineWorker/supervisor/http.ts" post_fix = " async getLatestSnapshot(runId: string, runnerId?: string, environmentId?: string) {\n return wrapZodFetch(\n WorkerApiRunLatestSnapshotResponseBody,\n `${this.apiUrl}/engine/v1/worker-actions/runs/${runId}/snapshots/latest`,\n {\n method: \"GET\",\n headers: {\n ...this.defaultHeaders,\n ...this.runnerIdHeader(runnerId),\n ...this.environmentIdHeader(environmentId),\n },\n }\n );\n }\n\n async getSnapshotsSince(\n runId: string,\n snapshotId: string,\n runnerId?: string,\n environmentId?: string\n ) {\n return wrapZodFetch(\n WorkerApiRunSnapshotsSinceResponseBody,\n `${this.apiUrl}/engine/v1/worker-actions/runs/${runId}/snapshots/since/${snapshotId}`,\n {\n method: \"GET\",\n headers: {\n ...this.defaultHeaders,\n ...this.runnerIdHeader(runnerId),\n ...this.environmentIdHeader(environmentId),\n },\n }\n );\n }\n" pre_fix = " async getLatestSnapshot(runId: string, runnerId?: string) {\n return wrapZodFetch(\n WorkerApiRunLatestSnapshotResponseBody,\n `${this.apiUrl}/engine/v1/worker-actions/runs/${runId}/snapshots/latest`,\n {\n method: \"GET\",\n headers: {\n ...this.defaultHeaders,\n ...this.runnerIdHeader(runnerId),\n },\n }\n );\n }\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "create" function_lines = [[103, 312]] id = "triggerdotdev-trigger.dev-33568c3becc0c84c" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/workloadManager/kubernetes.ts" post_fix = " async create(opts: WorkloadManagerCreateOptions) {\n this.logger.verbose(\"[KubernetesWorkloadManager] Creating container\", { opts });\n\n const runnerId = getRunnerId(opts.runFriendlyId, opts.nextAttemptNumber);\n\n try {\n const basePodSpec = this.addPlacementTags(this.#defaultPodSpec, opts.placementTags);\n const podSpec = this.opts.checkpointsEnabled\n ? withBlockIoUringSeccompProfile(basePodSpec, opts.runtime)\n : basePodSpec;\n\n await this.k8s.core.createNamespacedPod({\n namespace: this.namespace,\n body: {\n metadata: {\n name: runnerId,\n namespace: this.namespace,\n labels: {\n ...this.#getSharedLabels(opts),\n app: \"task-run\",\n \"app.kubernetes.io/part-of\": \"trigger-worker\",\n \"app.kubernetes.io/component\": \"create\",\n },\n },\n spec: {\n ...podSpec,\n affinity: this.#getAffinity(opts),\n tolerations: this.#getScheduleTolerations(this.#isScheduledRun(opts)),\n terminationGracePeriodSeconds: 60 * 60,\n containers: [\n {\n name: \"run-controller\",\n image: this.stripImageDigest(opts.image),\n ports: [\n {\n containerPort: 8000,\n },\n ],\n resources: this.#getResourcesForMachine(opts.machine),\n env: [\n {\n name: \"TRIGGER_DEQUEUED_AT_MS\",\n value: opts.dequeuedAt.getTime().toString(),\n },\n {\n name: \"TRIGGER_POD_SCHEDULED_AT_MS\",\n value: Date.now().toString(),\n },\n {\n name: \"TRIGGER_RUN_ID\",\n value: opts.runFriendlyId,\n },\n {\n name: \"TRIGGER_ENV_ID\",\n value: opts.envId,\n },\n {\n name: \"TRIGGER_DEPLOYMENT_ID\",\n value: opts.deploymentToken ?? opts.deploymentFriendlyId,\n },\n {\n // Plain friendlyId for telemetry (worker.id), not the opaque token in DEPLOYMENT_ID.\n name: \"TRIGGER_DEPLOYMENT_FRIENDLY_ID\",\n value: opts.deploymentFriendlyId,\n },\n {\n name: \"TRIGGER_DEPLOYMENT_VERSION\",\n value: opts.deploymentVersion,\n },\n {\n name: \"TRIGGER_SNAPSHOT_ID\",\n value: opts.snapshotFriendlyId,\n },\n {\n name: \"TRIGGER_SUPERVISOR_API_PROTOCOL\",\n value: this.opts.workloadApiProtocol,\n },\n {\n name: \"TRIGGER_SUPERVISOR_API_PORT\",\n value: `${this.opts.workloadApiPort}`,\n },\n {\n name: \"TRIGGER_SUPERVISOR_API_DOMAIN\",\n ...(this.opts.workloadApiDomain\n ? {\n value: this.opts.workloadApiDomain,\n }\n : {\n valueFrom: {\n fieldRef: {\n fieldPath: \"status.hostIP\",\n },\n },\n }),\n },\n {\n name: \"TRIGGER_WORKER_INSTANCE_NAME\",\n valueFrom: {\n fieldRef: {\n fieldPath: \"spec.nodeName\",\n },\n },\n },\n {\n name: \"OTEL_EXPORTER_OTLP_ENDPOINT\",\n value: env.OTEL_EXPORTER_OTLP_ENDPOINT,\n },\n {\n name: \"TRIGGER_RUNNER_ID\",\n value: runnerId,\n },\n {\n name: \"TRIGGER_MACHINE_CPU\",\n value: `${opts.machine.cpu}`,\n },\n {\n name: \"TRIGGER_MACHINE_MEMORY\",\n value: `${opts.machine.memory}`,\n },\n {\n name: \"TRIGGER_SEND_RUN_DEBUG_LOGS\",\n value: `${env.SEND_RUN_DEBUG_LOGS}`,\n },\n {\n name: \"LIMITS_CPU\",\n valueFrom: {\n resourceFieldRef: {\n resource: \"limits.cpu\",\n },\n },\n },\n {\n name: \"LIMITS_MEMORY\",\n valueFrom: {\n resourceFieldRef: {\n resource: \"limits.memory\",\n },\n },\n },\n ...(this.opts.warmStartUrl\n ? [{ name: \"TRIGGER_WARM_START_URL\", value: this.opts.warmStartUrl }]\n : []),\n ...(this.opts.metadataUrl\n ? [{ name: \"TRIGGER_METADATA_URL\", value: this.opts.metadataUrl }]\n : []),\n ...(this.opts.heartbeatIntervalSeconds\n ? [\n {\n name: \"TRIGGER_HEARTBEAT_INTERVAL_SECONDS\",\n value: `${this.opts.heartbeatIntervalSeconds}`,\n },\n ]\n : []),\n ...(this.opts.snapshotPollIntervalSeconds\n ? [\n {\n name: \"TRIGGER_SNAPSHOT_POLL_INTERVAL_SECONDS\",\n value: `${this.opts.snapshotPollIntervalSeconds}`,\n },\n ]\n : []),\n ...(this.opts.additionalEnvVars\n ? Object.entries(this.opts.additionalEnvVars).map(([key, value]) => ({\n name: key,\n value: value,\n }))\n : []),\n ],\n },\n ],\n },\n },\n });\n } catch (err: unknown) {\n this.#handleK8sError(err);\n }\n }\n\n #throwUnlessRecord(candidate: unknown): asserts candidate is Record {\n if (typeof candidate !== \"object\" || candidate === null) {\n throw candidate;\n }\n }\n\n #handleK8sError(err: unknown) {\n this.#throwUnlessRecord(err);\n\n if (\"body\" in err && err.body) {\n this.logger.error(\"[KubernetesWorkloadManager] Create failed\", { rawError: err.body });\n this.#throwUnlessRecord(err.body);\n\n if (typeof err.body.message === \"string\") {\n throw new Error(err.body?.message);\n } else {\n throw err.body;\n }\n } else {\n this.logger.error(\"[KubernetesWorkloadManager] Create failed\", { rawError: err });\n throw err;\n }\n }\n\n #envTypeToLabelValue(type: EnvironmentType) {\n switch (type) {\n case \"PRODUCTION\":\n return \"prod\";\n case \"STAGING\":\n return \"stg\";\n case \"DEVELOPMENT\":\n return \"dev\";\n case \"PREVIEW\":\n return \"preview\";\n }\n }\n" pre_fix = " async create(opts: WorkloadManagerCreateOptions) {\n this.logger.verbose(\"[KubernetesWorkloadManager] Creating container\", { opts });\n\n const runnerId = getRunnerId(opts.runFriendlyId, opts.nextAttemptNumber);\n\n try {\n const basePodSpec = this.addPlacementTags(this.#defaultPodSpec, opts.placementTags);\n const podSpec = this.opts.checkpointsEnabled\n ? withBlockIoUringSeccompProfile(basePodSpec, opts.runtime)\n : basePodSpec;\n\n await this.k8s.core.createNamespacedPod({\n namespace: this.namespace,\n body: {\n metadata: {\n name: runnerId,\n namespace: this.namespace,\n labels: {\n ...this.#getSharedLabels(opts),\n app: \"task-run\",\n \"app.kubernetes.io/part-of\": \"trigger-worker\",\n \"app.kubernetes.io/component\": \"create\",\n },\n },\n spec: {\n ...podSpec,\n affinity: this.#getAffinity(opts),\n tolerations: this.#getScheduleTolerations(this.#isScheduledRun(opts)),\n terminationGracePeriodSeconds: 60 * 60,\n containers: [\n {\n name: \"run-controller\",\n image: this.stripImageDigest(opts.image),\n ports: [\n {\n containerPort: 8000,\n },\n ],\n resources: this.#getResourcesForMachine(opts.machine),\n env: [\n {\n name: \"TRIGGER_DEQUEUED_AT_MS\",\n value: opts.dequeuedAt.getTime().toString(),\n },\n {\n name: \"TRIGGER_POD_SCHEDULED_AT_MS\",\n value: Date.now().toString(),\n },\n {\n name: \"TRIGGER_RUN_ID\",\n value: opts.runFriendlyId,\n },\n {\n name: \"TRIGGER_ENV_ID\",\n value: opts.envId,\n },\n {\n name: \"TRIGGER_DEPLOYMENT_ID\",\n value: opts.deploymentFriendlyId,\n },\n {\n name: \"TRIGGER_DEPLOYMENT_VERSION\",\n value: opts.deploymentVersion,\n },\n {\n name: \"TRIGGER_SNAPSHOT_ID\",\n value: opts.snapshotFriendlyId,\n },\n {\n name: \"TRIGGER_SUPERVISOR_API_PROTOCOL\",\n value: this.opts.workloadApiProtocol,\n },\n {\n name: \"TRIGGER_SUPERVISOR_API_PORT\",\n value: `${this.opts.workloadApiPort}`,\n },\n {\n name: \"TRIGGER_SUPERVISOR_API_DOMAIN\",\n ...(this.opts.workloadApiDomain\n ? {\n value: this.opts.workloadApiDomain,\n }\n : {\n valueFrom: {\n fieldRef: {\n fieldPath: \"status.hostIP\",\n },\n },\n }),\n },\n {\n name: \"TRIGGER_WORKER_INSTANCE_NAME\",\n valueFrom: {\n fieldRef: {\n fieldPath: \"spec.nodeName\",\n },\n },\n },\n {\n name: \"OTEL_EXPORTER_OTLP_ENDPOINT\",\n value: env.OTEL_EXPORTER_OTLP_ENDPOINT,\n },\n {\n name: \"TRIGGER_RUNNER_ID\",\n value: runnerId,\n },\n {\n name: \"TRIGGER_MACHINE_CPU\",\n value: `${opts.machine.cpu}`,\n },\n {\n name: \"TRIGGER_MACHINE_MEMORY\",\n value: `${opts.machine.memory}`,\n },\n {\n name: \"TRIGGER_SEND_RUN_DEBUG_LOGS\",\n value: `${env.SEND_RUN_DEBUG_LOGS}`,\n },\n {\n name: \"LIMITS_CPU\",\n valueFrom: {\n resourceFieldRef: {\n resource: \"limits.cpu\",\n },\n },\n },\n {\n name: \"LIMITS_MEMORY\",\n valueFrom: {\n resourceFieldRef: {\n resource: \"limits.memory\",\n },\n },\n },\n ...(this.opts.warmStartUrl\n ? [{ name: \"TRIGGER_WARM_START_URL\", value: this.opts.warmStartUrl }]\n : []),\n ...(this.opts.metadataUrl\n ? [{ name: \"TRIGGER_METADATA_URL\", value: this.opts.metadataUrl }]\n : []),\n ...(this.opts.heartbeatIntervalSeconds\n ? [\n {\n name: \"TRIGGER_HEARTBEAT_INTERVAL_SECONDS\",\n value: `${this.opts.heartbeatIntervalSeconds}`,\n },\n ]\n : []),\n ...(this.opts.snapshotPollIntervalSeconds\n ? [\n {\n name: \"TRIGGER_SNAPSHOT_POLL_INTERVAL_SECONDS\",\n value: `${this.opts.snapshotPollIntervalSeconds}`,\n },\n ]\n : []),\n ...(this.opts.additionalEnvVars\n ? Object.entries(this.opts.additionalEnvVars).map(([key, value]) => ({\n name: key,\n value: value,\n }))\n : []),\n ],\n },\n ],\n },\n },\n });\n } catch (err: unknown) {\n this.#handleK8sError(err);\n }\n }\n\n #throwUnlessRecord(candidate: unknown): asserts candidate is Record {\n if (typeof candidate !== \"object\" || candidate === null) {\n throw candidate;\n }\n }\n\n #handleK8sError(err: unknown) {\n this.#throwUnlessRecord(err);\n\n if (\"body\" in err && err.body) {\n this.logger.error(\"[KubernetesWorkloadManager] Create failed\", { rawError: err.body });\n this.#throwUnlessRecord(err.body);\n\n if (typeof err.body.message === \"string\") {\n throw new Error(err.body?.message);\n } else {\n throw err.body;\n }\n } else {\n this.logger.error(\"[KubernetesWorkloadManager] Create failed\", { rawError: err });\n throw err;\n }\n }\n\n #envTypeToLabelValue(type: EnvironmentType) {\n switch (type) {\n case \"PRODUCTION\":\n return \"prod\";\n case \"STAGING\":\n return \"stg\";\n case \"DEVELOPMENT\":\n return \"dev\";\n case \"PREVIEW\":\n return \"preview\";\n }\n }\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "createPersonalAccessTokenFromAuthorizationCode" function_lines = [[292, 369]] id = "triggerdotdev-trigger.dev-34d89ac9922ed6c5" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/services/personalAccessToken.server.ts" post_fix = "export async function createPersonalAccessTokenFromAuthorizationCode(\n authorizationCode: string,\n userId: string\n) {\n // Only allow authorization codes created within the short consent window.\n const validAfter = new Date(Date.now() - AUTHORIZATION_CODE_TTL_MS);\n const code = await prisma.authorizationCode.findFirst({\n where: {\n code: authorizationCode,\n personalAccessTokenId: null,\n createdAt: {\n gte: validAfter,\n },\n },\n });\n\n if (!code) {\n throw new Error(\"Invalid authorization code, code already used, or code expired\");\n }\n\n const existingCliPersonalAccessToken = await prisma.personalAccessToken.findFirst({\n where: {\n userId,\n name: \"cli\",\n },\n });\n\n //we only allow you to have one CLI PAT at a time, so return this\n if (existingCliPersonalAccessToken) {\n //associate this authorization code with the existing personal access token\n await prisma.authorizationCode.update({\n where: {\n code: authorizationCode,\n },\n data: {\n personalAccessTokenId: existingCliPersonalAccessToken.id,\n },\n });\n\n if (existingCliPersonalAccessToken.revokedAt) {\n // re-activate revoked CLI PAT so we can use it again\n await prisma.personalAccessToken.update({\n where: {\n id: existingCliPersonalAccessToken.id,\n },\n data: {\n revokedAt: null,\n },\n });\n }\n\n //we don't return the decrypted token\n return {\n id: existingCliPersonalAccessToken.id,\n name: existingCliPersonalAccessToken.name,\n userId: existingCliPersonalAccessToken.userId,\n obfuscateToken: existingCliPersonalAccessToken.obfuscatedToken,\n };\n }\n\n const token = await createPersonalAccessToken({\n name: \"cli\",\n userId,\n });\n\n await prisma.authorizationCode.update({\n where: {\n code: authorizationCode,\n },\n data: {\n personalAccessTokenId: token.id,\n },\n });\n\n return token;\n}\n\n/** Created a new PersonalAccessToken, and return the token. We only ever return the unencrypted token once. */" pre_fix = "export async function createPersonalAccessTokenFromAuthorizationCode(\n authorizationCode: string,\n userId: string\n) {\n //only allow authorization codes that were created less than 10 mins ago\n const tenMinutesAgo = new Date(Date.now() - 10 * 60 * 1000);\n const code = await prisma.authorizationCode.findUnique({\n where: {\n code: authorizationCode,\n personalAccessTokenId: null,\n createdAt: {\n gte: tenMinutesAgo,\n },\n },\n });\n\n if (!code) {\n throw new Error(\"Invalid authorization code, code already used, or code expired\");\n }\n\n const existingCliPersonalAccessToken = await prisma.personalAccessToken.findFirst({\n where: {\n userId,\n name: \"cli\",\n },\n });\n\n //we only allow you to have one CLI PAT at a time, so return this\n if (existingCliPersonalAccessToken) {\n //associate this authorization code with the existing personal access token\n await prisma.authorizationCode.update({\n where: {\n code: authorizationCode,\n },\n data: {\n personalAccessTokenId: existingCliPersonalAccessToken.id,\n },\n });\n\n if (existingCliPersonalAccessToken.revokedAt) {\n // re-activate revoked CLI PAT so we can use it again\n await prisma.personalAccessToken.update({\n where: {\n id: existingCliPersonalAccessToken.id,\n },\n data: {\n revokedAt: null,\n },\n });\n }\n\n //we don't return the decrypted token\n return {\n id: existingCliPersonalAccessToken.id,\n name: existingCliPersonalAccessToken.name,\n userId: existingCliPersonalAccessToken.userId,\n obfuscateToken: existingCliPersonalAccessToken.obfuscatedToken,\n };\n }\n\n const token = await createPersonalAccessToken({\n name: \"cli\",\n userId,\n });\n\n await prisma.authorizationCode.update({\n where: {\n code: authorizationCode,\n },\n data: {\n personalAccessTokenId: token.id,\n },\n });\n\n return token;\n}\n\n/** Created a new PersonalAccessToken, and return the token. We only ever return the unencrypted token once. */" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "getSnapshotsSince" function_lines = [[196, 209]] id = "triggerdotdev-trigger.dev-397d55d61662dcbb" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "packages/core/src/v3/runEngineWorker/supervisor/http.ts" post_fix = " async getSnapshotsSince(\n runId: string,\n snapshotId: string,\n runnerId?: string,\n environmentId?: string\n ) {\n return wrapZodFetch(\n WorkerApiRunSnapshotsSinceResponseBody,\n `${this.apiUrl}/engine/v1/worker-actions/runs/${runId}/snapshots/since/${snapshotId}`,\n {\n method: \"GET\",\n headers: {\n ...this.defaultHeaders,\n ...this.runnerIdHeader(runnerId),\n ...this.environmentIdHeader(environmentId),\n },\n }\n );\n }" pre_fix = " async getSnapshotsSince(runId: string, snapshotId: string, runnerId?: string) {\n return wrapZodFetch(\n WorkerApiRunSnapshotsSinceResponseBody,\n `${this.apiUrl}/engine/v1/worker-actions/runs/${runId}/snapshots/since/${snapshotId}`,\n {\n method: \"GET\",\n headers: {\n ...this.defaultHeaders,\n ...this.runnerIdHeader(runnerId),\n },\n }\n );\n }\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "streamRuns" function_lines = [[162, 211]] id = "triggerdotdev-trigger.dev-3b2daa8cc067a965" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/services/realtimeClient.server.ts" post_fix = " async streamRuns(\n url: URL | string,\n environment: RealtimeEnvironment,\n params: RealtimeRunsParams,\n apiVersion: API_VERSIONS,\n requestOptions?: RealtimeRequestOptions,\n clientVersion?: string,\n signal?: AbortSignal\n ) {\n const whereClauses: string[] = [`\"runtimeEnvironmentId\"='${environment.id}'`];\n\n if (params.tags) {\n // Reject unsafe chars and escape single quotes so tag values can't\n // break out of the Electric SQL string literal.\n const safeTags = sanitizeRealtimeTagsForSql(params.tags);\n whereClauses.push(`\"runTags\" @> ARRAY[${safeTags.map((t) => `'${t}'`).join(\",\")}]`);\n }\n\n const createdAtFilter = await this.#calculateCreatedAtFilter(url, params.createdAt);\n\n if (createdAtFilter) {\n whereClauses.push(`\"createdAt\" > '${createdAtFilter.toISOString()}'`);\n }\n\n const whereClause = whereClauses.join(\" AND \");\n\n const response = await this.#streamRunsWhere(\n url,\n environment,\n whereClause,\n apiVersion,\n requestOptions,\n clientVersion,\n signal\n );\n\n if (createdAtFilter) {\n const [setCreatedAtFilterError] = await tryCatch(\n this.#setCreatedAtFilterFromResponse(response, createdAtFilter)\n );\n\n if (setCreatedAtFilterError) {\n logger.error(\"[realtimeClient] Failed to set createdAt filter\", {\n error: setCreatedAtFilterError,\n createdAtFilter,\n responseHeaders: Object.fromEntries(response.headers.entries()),\n responseStatus: response.status,\n });\n }\n }\n\n return response;\n }" pre_fix = " async streamRuns(\n url: URL | string,\n environment: RealtimeEnvironment,\n params: RealtimeRunsParams,\n apiVersion: API_VERSIONS,\n requestOptions?: RealtimeRequestOptions,\n clientVersion?: string,\n signal?: AbortSignal\n ) {\n const whereClauses: string[] = [`\"runtimeEnvironmentId\"='${environment.id}'`];\n\n if (params.tags) {\n whereClauses.push(`\"runTags\" @> ARRAY[${params.tags.map((t) => `'${t}'`).join(\",\")}]`);\n }\n\n const createdAtFilter = await this.#calculateCreatedAtFilter(url, params.createdAt);\n\n if (createdAtFilter) {\n whereClauses.push(`\"createdAt\" > '${createdAtFilter.toISOString()}'`);\n }\n\n const whereClause = whereClauses.join(\" AND \");\n\n const response = await this.#streamRunsWhere(\n url,\n environment,\n whereClause,\n apiVersion,\n requestOptions,\n clientVersion,\n signal\n );\n\n if (createdAtFilter) {\n const [setCreatedAtFilterError] = await tryCatch(\n this.#setCreatedAtFilterFromResponse(response, createdAtFilter)\n );\n\n if (setCreatedAtFilterError) {\n logger.error(\"[realtimeClient] Failed to set createdAt filter\", {\n error: setCreatedAtFilterError,\n createdAtFilter,\n responseHeaders: Object.fromEntries(response.headers.entries()),\n responseStatus: response.status,\n });\n }\n }\n\n return response;\n }" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "loader" function_lines = [[29, 121]] id = "triggerdotdev-trigger.dev-3da6ba2954fae9e2" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/routes/_app.github.callback/route.tsx" post_fix = "export async function loader({ request }: LoaderFunctionArgs) {\n const url = new URL(request.url);\n const queryParams = Object.fromEntries(url.searchParams);\n const cookieHeader = request.headers.get(\"Cookie\");\n\n const result = QuerySchema.safeParse(queryParams);\n\n if (!result.success) {\n logger.warn(\"GitHub App callback with invalid params\", {\n queryParams,\n });\n return redirectWithErrorMessage(\"/\", request, \"Failed to install GitHub app\");\n }\n\n const callbackData = result.data;\n\n const sessionResult = await validateGitHubAppInstallSession(cookieHeader, callbackData.state);\n\n if (!sessionResult.valid) {\n logger.error(\"GitHub App callback with invalid session\", {\n callbackData,\n error: sessionResult.error,\n });\n\n return redirectWithErrorMessage(\"/\", request, \"Failed to install GitHub app\");\n }\n\n const { organizationId, redirectTo: unsafeRedirectTo } = sessionResult;\n const redirectTo = sanitizeRedirectPath(unsafeRedirectTo);\n\n const user = await requireUser(request);\n const org = await $replica.organization.findFirst({\n where: { id: organizationId, members: { some: { userId: user.id } }, deletedAt: null },\n orderBy: { createdAt: \"desc\" },\n select: {\n id: true,\n },\n });\n\n if (!org) {\n // the secure cookie approach should already protect against this\n // just an additional check\n logger.error(\"GitHub app installation attempt on unauthenticated org\", {\n userId: user.id,\n organizationId,\n });\n return redirectWithErrorMessage(redirectTo, request, \"Failed to install GitHub app\");\n }\n\n // The install session is single-use: once a callback consumes an\n // installation_id, invalidate the state cookie so the same initiation\n // cannot be replayed against other installation_ids.\n const clearInstallSession = await destroyGitHubAppInstallSession(cookieHeader);" pre_fix = "export async function loader({ request }: LoaderFunctionArgs) {\n const url = new URL(request.url);\n const queryParams = Object.fromEntries(url.searchParams);\n const cookieHeader = request.headers.get(\"Cookie\");\n\n const result = QuerySchema.safeParse(queryParams);\n\n if (!result.success) {\n logger.warn(\"GitHub App callback with invalid params\", {\n queryParams,\n });\n return redirectWithErrorMessage(\"/\", request, \"Failed to install GitHub app\");\n }\n\n const callbackData = result.data;\n\n const sessionResult = await validateGitHubAppInstallSession(cookieHeader, callbackData.state);\n\n if (!sessionResult.valid) {\n logger.error(\"GitHub App callback with invalid session\", {\n callbackData,\n error: sessionResult.error,\n });\n\n return redirectWithErrorMessage(\"/\", request, \"Failed to install GitHub app\");\n }\n\n const { organizationId, redirectTo: unsafeRedirectTo } = sessionResult;\n const redirectTo = sanitizeRedirectPath(unsafeRedirectTo);\n\n const user = await requireUser(request);\n const org = await $replica.organization.findFirst({\n where: { id: organizationId, members: { some: { userId: user.id } }, deletedAt: null },\n orderBy: { createdAt: \"desc\" },\n select: {\n id: true,\n },\n });\n\n if (!org) {\n // the secure cookie approach should already protect against this\n // just an additional check\n logger.error(\"GitHub app installation attempt on unauthenticated org\", {\n userId: user.id,\n organizationId,\n });\n return redirectWithErrorMessage(redirectTo, request, \"Failed to install GitHub app\");\n }\n\n switch (callbackData.setup_action) {\n case \"install\": {\n const [error] = await tryCatch(\n linkGitHubAppInstallation(callbackData.installation_id, organizationId)\n );\n\n if (error) {\n logger.error(\"Failed to link GitHub App installation\", {\n error,\n });\n return redirectWithErrorMessage(redirectTo, request, \"Failed to install GitHub app\");\n }\n\n return redirectWithSuccessMessage(redirectTo, request, \"GitHub App installed successfully\");\n }\n\n case \"update\": {\n const [error] = await tryCatch(updateGitHubAppInstallation(callbackData.installation_id));\n\n if (error) {\n logger.error(\"Failed to update GitHub App installation\", {\n error,\n });\n return redirectWithErrorMessage(redirectTo, request, \"Failed to update GitHub App\");\n }\n\n return redirectWithSuccessMessage(redirectTo, request, \"GitHub App updated successfully\");\n }\n\n case \"request\": {\n // This happens when a non-admin user requests installation\n // The installation_id won't be available until an admin approves\n logger.info(\"GitHub App installation requested, awaiting approval\", {\n callbackData,\n });\n\n return redirectWithSuccessMessage(redirectTo, request, \"GitHub App installation requested\");\n }\n\n default:\n callbackData satisfies never;\n return redirectWithErrorMessage(redirectTo, request, \"Failed to install GitHub app\");\n }\n}" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "constructor" function_lines = [[122, 144]] id = "triggerdotdev-trigger.dev-428c7b244470b508" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/workloadServer/index.ts" post_fix = " constructor(opts: WorkloadServerOptions) {\n super();\n\n const host = opts.host ?? \"0.0.0.0\";\n const port = opts.port;\n\n this.workerClient = opts.workerClient;\n this.checkpointClient = opts.checkpointClient;\n this.wideEventOpts = opts.wideEventOpts;\n this.wideEventsNoisyRoutes = opts.wideEventsNoisyRoutes;\n\n if (opts.computeManager?.snapshotsEnabled) {\n this.snapshotService = new ComputeSnapshotService({\n computeManager: opts.computeManager,\n workerClient: opts.workerClient,\n tracing: opts.tracing,\n wideEventOpts: this.wideEventOpts,\n snapshotCallbackSecret: opts.snapshotCallbackSecret,\n });\n }\n\n this.httpServer = this.createHttpServer({ host, port });\n this.websocketServer = this.createWebsocketServer();\n }" pre_fix = " constructor(opts: WorkloadServerOptions) {\n super();\n\n const host = opts.host ?? \"0.0.0.0\";\n const port = opts.port;\n\n this.workerClient = opts.workerClient;\n this.checkpointClient = opts.checkpointClient;\n this.wideEventOpts = opts.wideEventOpts;\n this.wideEventsNoisyRoutes = opts.wideEventsNoisyRoutes;\n\n if (opts.computeManager?.snapshotsEnabled) {\n this.snapshotService = new ComputeSnapshotService({\n computeManager: opts.computeManager,\n workerClient: opts.workerClient,\n tracing: opts.tracing,\n wideEventOpts: this.wideEventOpts,\n });\n }\n\n this.httpServer = this.createHttpServer({ host, port });\n this.websocketServer = this.createWebsocketServer();\n }" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "getPersonalAccessTokenFromAuthorizationCode" function_lines = [[62, 95]] id = "triggerdotdev-trigger.dev-5224c92a3bd5124b" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/services/personalAccessToken.server.ts" post_fix = "export async function getPersonalAccessTokenFromAuthorizationCode(authorizationCode: string) {\n // Only allow authorization codes created within the short consent window.\n const validAfter = new Date(Date.now() - AUTHORIZATION_CODE_TTL_MS);\n const code = await prisma.authorizationCode.findFirst({\n select: {\n personalAccessToken: true,\n },\n where: {\n code: authorizationCode,\n createdAt: {\n gte: validAfter,\n },\n },\n });\n if (!code) {\n throw new Error(\"Invalid authorization code, or code expired\");\n }\n\n //there's no PersonalAccessToken associated with this code\n if (!code.personalAccessToken) {\n return {\n token: null,\n };\n }\n\n const decryptedToken = decryptPersonalAccessToken(code.personalAccessToken);\n return {\n token: {\n token: decryptedToken,\n obfuscatedToken: code.personalAccessToken.obfuscatedToken,\n },\n };\n}\n" pre_fix = "export async function getPersonalAccessTokenFromAuthorizationCode(authorizationCode: string) {\n //only allow authorization codes that were created less than 10 mins ago\n const tenMinutesAgo = new Date(Date.now() - 10 * 60 * 1000);\n const code = await prisma.authorizationCode.findUnique({\n select: {\n personalAccessToken: true,\n },\n where: {\n code: authorizationCode,\n createdAt: {\n gte: tenMinutesAgo,\n },\n },\n });\n if (!code) {\n throw new Error(\"Invalid authorization code, or code expired\");\n }\n\n //there's no PersonalAccessToken associated with this code\n if (!code.personalAccessToken) {\n return {\n token: null,\n };\n }\n\n const decryptedToken = decryptPersonalAccessToken(code.personalAccessToken);\n return {\n token: {\n token: decryptedToken,\n obfuscatedToken: code.personalAccessToken.obfuscatedToken,\n },\n };\n}\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "getSocketMetadata" function_lines = [[694, 724]] id = "triggerdotdev-trigger.dev-52d2cb11d78d0327" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/workloadServer/index.ts" post_fix = " const getSocketMetadata = () => {\n return {\n deploymentId: socket.data.deploymentFriendlyId ?? socket.data.deploymentId,\n runId: socket.data.runFriendlyId,\n snapshotId: socket.data.snapshotId,\n runnerId: socket.data.runnerId,\n };\n };\n\n const emitSocketLifecycle = (\n event: \"run_connected\" | \"run_disconnected\",\n friendlyId: string,\n disconnectReason?: string\n ) => {\n emitOneShot({\n ...this.wideEventOpts,\n op: event === \"run_connected\" ? \"socket.run.connected\" : \"socket.run.disconnected\",\n kind: \"event\",\n populate: (state) => {\n state.extras.event = event;\n setMeta(state, \"run_id\", friendlyId);\n const deploymentId = socket.data.deploymentFriendlyId ?? socket.data.deploymentId;\n if (deploymentId) {\n setMeta(state, \"deployment_id\", deploymentId);\n }\n if (socket.data.runnerId) setMeta(state, \"runner_id\", socket.data.runnerId);\n state.extras.socket_id = socket.id;\n if (disconnectReason) state.extras.disconnect_reason = disconnectReason;\n },\n });\n };\n" pre_fix = " const getSocketMetadata = () => {\n return {\n deploymentId: socket.data.deploymentId,\n runId: socket.data.runFriendlyId,\n snapshotId: socket.data.snapshotId,\n runnerId: socket.data.runnerId,\n };\n };\n\n const emitSocketLifecycle = (\n event: \"run_connected\" | \"run_disconnected\",\n friendlyId: string,\n disconnectReason?: string\n ) => {\n emitOneShot({\n ...this.wideEventOpts,\n op: event === \"run_connected\" ? \"socket.run.connected\" : \"socket.run.disconnected\",\n kind: \"event\",\n populate: (state) => {\n state.extras.event = event;\n setMeta(state, \"run_id\", friendlyId);\n if (socket.data.deploymentId) {\n setMeta(state, \"deployment_id\", socket.data.deploymentId);\n }\n if (socket.data.runnerId) setMeta(state, \"runner_id\", socket.data.runnerId);\n state.extras.socket_id = socket.id;\n if (disconnectReason) state.extras.disconnect_reason = disconnectReason;\n },\n });\n };\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "loader" function_lines = [[123, 153]] id = "triggerdotdev-trigger.dev-5392f925c70f8c55" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/routes/api.v1.schedules.$scheduleId.ts" post_fix = "export async function loader({ request, params }: LoaderFunctionArgs) {\n // Authenticate the request\n const authenticationResult = await authenticateApiRequest(request);\n\n if (!authenticationResult) {\n return json({ error: \"Invalid or Missing API Key\" }, { status: 401 });\n }\n\n const parsedParams = ParamsSchema.safeParse(params);\n\n if (!parsedParams.success) {\n return json(\n { error: \"Invalid request parameters\", issues: parsedParams.error.issues },\n { status: 400 }\n );\n }\n\n const visibility = await getScheduleEnvVisibility(\n prisma,\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId,\n authenticationResult.environment.id\n );\n if (visibility.status !== \"visible\") {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n const presenter = new ViewSchedulePresenter();\n\n const result = await presenter.call({\n projectId: authenticationResult.environment.projectId,\n friendlyId: parsedParams.data.scheduleId,\n environmentId: authenticationResult.environment.id,\n });\n\n if (!result) {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n return json(presenter.toJSONResponse(result), { status: 200 });\n}" pre_fix = "export async function loader({ request, params }: LoaderFunctionArgs) {\n // Authenticate the request\n const authenticationResult = await authenticateApiRequest(request);\n\n if (!authenticationResult) {\n return json({ error: \"Invalid or Missing API Key\" }, { status: 401 });\n }\n\n const parsedParams = ParamsSchema.safeParse(params);\n\n if (!parsedParams.success) {\n return json(\n { error: \"Invalid request parameters\", issues: parsedParams.error.issues },\n { status: 400 }\n );\n }\n\n const presenter = new ViewSchedulePresenter();\n\n const result = await presenter.call({\n projectId: authenticationResult.environment.projectId,\n friendlyId: parsedParams.data.scheduleId,\n environmentId: authenticationResult.environment.id,\n });\n\n if (!result) {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n return json(presenter.toJSONResponse(result), { status: 200 });\n}" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "handleCallback" function_lines = [[124, 221]] id = "triggerdotdev-trigger.dev-588437af67b5a758" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/services/computeSnapshotService.ts" post_fix = " async handleCallback(body: SnapshotCallbackPayload) {\n const snapshotId = body.status === \"completed\" ? body.snapshot_id : undefined;\n const runId = body.metadata?.runId;\n const snapshotFriendlyId = body.metadata?.snapshotFriendlyId;\n\n // Enrich the wrapping route's wide event with snapshot metadata. The\n // `/api/v1/compute/snapshot-complete` route is registered with `wideRoute`,\n // so `fromContext()` returns the State of that route and these calls\n // become extras/meta on the same wide event - no nested emission.\n const state = fromContext();\n if (state) {\n state.extras[\"snapshot.status\"] = body.status;\n if (body.instance_id) state.extras[\"snapshot.instance_id\"] = body.instance_id;\n if (body.duration_ms !== undefined) state.extras[\"snapshot.duration_ms\"] = body.duration_ms;\n if (snapshotId) state.extras[\"snapshot.id\"] = snapshotId;\n if (body.status === \"failed\" && body.error) state.extras[\"snapshot.error\"] = body.error;\n }\n if (runId) setMeta(state, \"run_id\", runId);\n if (snapshotFriendlyId) setMeta(state, \"snapshot_id\", snapshotFriendlyId);\n\n this.logger.debug(\"Snapshot callback\", {\n snapshotId,\n instanceId: body.instance_id,\n status: body.status,\n error: body.status === \"failed\" ? body.error : undefined,\n runId,\n snapshotFriendlyId,\n durationMs: body.duration_ms,\n });\n\n if (!runId || !snapshotFriendlyId) {\n this.logger.error(\"Snapshot callback missing metadata\", {\n status: body.status,\n instanceId: body.instance_id,\n metadataKeys: Object.keys(body.metadata ?? {}),\n });\n return { ok: false as const, status: 400 };\n }\n\n if (!this.#verifyCallbackToken(body.metadata, runId, snapshotFriendlyId)) {\n this.logger.error(\"Snapshot callback failed token verification\", {\n runId,\n snapshotFriendlyId,\n instanceId: body.instance_id,\n });\n return { ok: false as const, status: 401 };\n }\n\n this.#emitSnapshotSpan(runId, body.duration_ms, snapshotId);\n\n if (body.status === \"completed\") {\n const submitStart = performance.now();\n const result = await this.workerClient.submitSuspendCompletion({\n runId,\n snapshotId: snapshotFriendlyId,\n body: {\n success: true,\n checkpoint: {\n type: \"COMPUTE\",\n location: body.snapshot_id,\n },\n },\n });\n recordPhaseSince(\n \"submit_completion\",\n submitStart,\n result.success ? undefined : new Error(String(result.error))\n );\n\n if (result.success) {\n this.logger.debug(\"Suspend completion submitted\", {\n runId,\n instanceId: body.instance_id,\n snapshotId: body.snapshot_id,\n });\n } else {\n setExtra(state, \"submit_completion.error\", String(result.error));\n this.logger.error(\"Failed to submit suspend completion\", {\n runId,\n snapshotFriendlyId,\n error: result.error,\n });\n }\n } else {\n const submitStart = performance.now();\n const result = await this.workerClient.submitSuspendCompletion({\n runId,\n snapshotId: snapshotFriendlyId,\n body: {\n success: false,\n error: body.error ?? \"Snapshot failed\",\n },\n });\n recordPhaseSince(\n \"submit_completion\",\n submitStart,\n result.success ? undefined : new Error(String(result.error))\n );\n\n if (!result.success) {\n setExtra(state, \"submit_completion.error\", String(result.error));\n this.logger.error(\"Failed to submit suspend failure\", {\n runId,\n snapshotFriendlyId,\n error: result.error,\n });\n }\n }\n\n return { ok: true as const, status: 200 };\n }\n" pre_fix = " async handleCallback(body: SnapshotCallbackPayload) {\n const snapshotId = body.status === \"completed\" ? body.snapshot_id : undefined;\n const runId = body.metadata?.runId;\n const snapshotFriendlyId = body.metadata?.snapshotFriendlyId;\n\n // Enrich the wrapping route's wide event with snapshot metadata. The\n // `/api/v1/compute/snapshot-complete` route is registered with `wideRoute`,\n // so `fromContext()` returns the State of that route and these calls\n // become extras/meta on the same wide event - no nested emission.\n const state = fromContext();\n if (state) {\n state.extras[\"snapshot.status\"] = body.status;\n if (body.instance_id) state.extras[\"snapshot.instance_id\"] = body.instance_id;\n if (body.duration_ms !== undefined) state.extras[\"snapshot.duration_ms\"] = body.duration_ms;\n if (snapshotId) state.extras[\"snapshot.id\"] = snapshotId;\n if (body.status === \"failed\" && body.error) state.extras[\"snapshot.error\"] = body.error;\n }\n if (runId) setMeta(state, \"run_id\", runId);\n if (snapshotFriendlyId) setMeta(state, \"snapshot_id\", snapshotFriendlyId);\n\n this.logger.debug(\"Snapshot callback\", {\n snapshotId,\n instanceId: body.instance_id,\n status: body.status,\n error: body.status === \"failed\" ? body.error : undefined,\n metadata: body.metadata,\n durationMs: body.duration_ms,\n });\n\n if (!runId || !snapshotFriendlyId) {\n this.logger.error(\"Snapshot callback missing metadata\", { body });\n return { ok: false as const, status: 400 };\n }\n\n this.#emitSnapshotSpan(runId, body.duration_ms, snapshotId);\n\n if (body.status === \"completed\") {\n const submitStart = performance.now();\n const result = await this.workerClient.submitSuspendCompletion({\n runId,\n snapshotId: snapshotFriendlyId,\n body: {\n success: true,\n checkpoint: {\n type: \"COMPUTE\",\n location: body.snapshot_id,\n },\n },\n });\n recordPhaseSince(\n \"submit_completion\",\n submitStart,\n result.success ? undefined : new Error(String(result.error))\n );\n\n if (result.success) {\n this.logger.debug(\"Suspend completion submitted\", {\n runId,\n instanceId: body.instance_id,\n snapshotId: body.snapshot_id,\n });\n } else {\n setExtra(state, \"submit_completion.error\", String(result.error));\n this.logger.error(\"Failed to submit suspend completion\", {\n runId,\n snapshotFriendlyId,\n error: result.error,\n });\n }\n } else {\n const submitStart = performance.now();\n const result = await this.workerClient.submitSuspendCompletion({\n runId,\n snapshotId: snapshotFriendlyId,\n body: {\n success: false,\n error: body.error ?? \"Snapshot failed\",\n },\n });\n recordPhaseSince(\n \"submit_completion\",\n submitStart,\n result.success ? undefined : new Error(String(result.error))\n );\n\n if (!result.success) {\n setExtra(state, \"submit_completion.error\", String(result.error));\n this.logger.error(\"Failed to submit suspend failure\", {\n runId,\n snapshotFriendlyId,\n error: result.error,\n });\n }\n }\n\n return { ok: true as const, status: 200 };\n }\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "generateRegistryCredentials" function_lines = [[280, 333]] id = "triggerdotdev-trigger.dev-5b0c0ef74fdf5bc3" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/v3/services/deployment.server.ts" post_fix = " public generateRegistryCredentials(\n authenticatedEnv: Pick,\n friendlyId: string\n ) {\n const validateDeployment = (\n deployment: Pick\n ) => {\n if (FINAL_DEPLOYMENT_STATUSES.includes(deployment.status)) {\n return errAsync({ type: \"deployment_is_already_final\" as const });\n }\n return okAsync(deployment);\n };\n\n const getDeploymentRegion = (deployment: Pick) => {\n if (!deployment.imageReference) {\n return errAsync({ type: \"deployment_has_no_image_reference\" as const });\n }\n if (!deployment.imageReference.includes(\"amazonaws.com\")) {\n return errAsync({ type: \"registry_not_supported\" as const });\n }\n\n // we should connect the deployment to a region more explicitly in the future\n // for now we just use the image reference to determine the region\n if (deployment.imageReference.includes(\"us-east-1\")) {\n return okAsync({ region: \"us-east-1\" as const });\n }\n if (deployment.imageReference.includes(\"eu-central-1\")) {\n return okAsync({ region: \"eu-central-1\" as const });\n }\n\n return errAsync({ type: \"registry_region_not_supported\" as const });\n };\n\n const generateCredentials = ({ region }: { region: \"us-east-1\" | \"eu-central-1\" }) =>\n fromPromise(generateRegistryCredentials(authenticatedEnv.projectId, region), (error) => ({\n type: \"other\" as const,\n cause: error,\n })).andThen((result) => {\n if (!result || !result.success) {\n return errAsync({ type: \"missing_registry_credentials\" as const });\n }\n return okAsync({\n username: result.username,\n password: result.password,\n expiresAt: new Date(result.expiresAt),\n repositoryUri: result.repositoryUri,\n });\n });\n\n return this.getDeployment(authenticatedEnv.id, friendlyId)\n .andThen(validateDeployment)\n .andThen(getDeploymentRegion)\n .andThen(generateCredentials);\n }" pre_fix = " public generateRegistryCredentials(\n authenticatedEnv: Pick,\n friendlyId: string\n ) {\n const validateDeployment = (\n deployment: Pick\n ) => {\n if (FINAL_DEPLOYMENT_STATUSES.includes(deployment.status)) {\n return errAsync({ type: \"deployment_is_already_final\" as const });\n }\n return okAsync(deployment);\n };\n\n const getDeploymentRegion = (deployment: Pick) => {\n if (!deployment.imageReference) {\n return errAsync({ type: \"deployment_has_no_image_reference\" as const });\n }\n if (!deployment.imageReference.includes(\"amazonaws.com\")) {\n return errAsync({ type: \"registry_not_supported\" as const });\n }\n\n // we should connect the deployment to a region more explicitly in the future\n // for now we just use the image reference to determine the region\n if (deployment.imageReference.includes(\"us-east-1\")) {\n return okAsync({ region: \"us-east-1\" as const });\n }\n if (deployment.imageReference.includes(\"eu-central-1\")) {\n return okAsync({ region: \"eu-central-1\" as const });\n }\n\n return errAsync({ type: \"registry_region_not_supported\" as const });\n };\n\n const generateCredentials = ({ region }: { region: \"us-east-1\" | \"eu-central-1\" }) =>\n fromPromise(generateRegistryCredentials(authenticatedEnv.projectId, region), (error) => ({\n type: \"other\" as const,\n cause: error,\n })).andThen((result) => {\n if (!result || !result.success) {\n return errAsync({ type: \"missing_registry_credentials\" as const });\n }\n return okAsync({\n username: result.username,\n password: result.password,\n expiresAt: new Date(result.expiresAt),\n repositoryUri: result.repositoryUri,\n });\n });\n\n return this.getDeployment(authenticatedEnv.projectId, friendlyId)\n .andThen(validateDeployment)\n .andThen(getDeploymentRegion)\n .andThen(generateCredentials);\n }" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "login" function_lines = [[101, 400]] id = "triggerdotdev-trigger.dev-5c1e8b013b50f48d" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "packages/cli-v3/src/commands/login.ts" post_fix = "export async function login(options?: LoginOptions): Promise {\n return await tracer.startActiveSpan(\"login\", async (span) => {\n try {\n const opts = {\n defaultApiUrl: CLOUD_API_URL,\n embedded: false,\n silent: false,\n ...options,\n };\n\n span.setAttributes({\n \"cli.config.apiUrl\": opts.defaultApiUrl,\n \"cli.options.profile\": opts.profile,\n });\n\n if (!opts.embedded) {\n intro(\"Logging in to Trigger.dev\");\n }\n\n const accessTokenFromEnv = env.TRIGGER_ACCESS_TOKEN;\n\n if (accessTokenFromEnv) {\n const validationResult = validateAccessToken(accessTokenFromEnv);\n\n if (!validationResult.success) {\n // We deliberately don't surface the existence of organization access tokens to the user for now, as they're only used internally.\n // Once we expose them in the application, we should also communicate that option here.\n throw new NotAccessTokenError(\n \"Your TRIGGER_ACCESS_TOKEN is not a Personal Access Token, they start with 'tr_pat_'. You can generate one here: https://cloud.trigger.dev/account/tokens\"\n );\n }\n\n const auth = {\n accessToken: accessTokenFromEnv,\n apiUrl: env.TRIGGER_API_URL ?? opts.defaultApiUrl ?? CLOUD_API_URL,\n };\n const apiClient = new CliApiClient(auth.apiUrl, auth.accessToken);\n const userData = await apiClient.whoAmI();\n\n if (!userData.success) {\n throw new Error(userData.error);\n }\n\n return {\n ok: true as const,\n profile: options?.profile ?? \"default\",\n userId: userData.data.userId,\n email: userData.data.email,\n dashboardUrl: userData.data.dashboardUrl,\n auth: {\n accessToken: auth.accessToken,\n tokenType: validationResult.type,\n apiUrl: auth.apiUrl,\n },\n };\n }\n\n const authConfig = readAuthConfigProfile(options?.profile);\n\n if (authConfig && authConfig.accessToken) {\n const whoAmIResult = await whoAmI(\n {\n profile: options?.profile ?? \"default\",\n skipTelemetry: !span.isRecording(),\n logLevel: logger.loggerLevel,\n },\n true,\n opts.silent\n );\n\n if (!whoAmIResult.success) {\n prettyError(\"Unable to validate existing personal access token\", whoAmIResult.error);\n\n if (!opts.embedded) {\n outro(\n `Login failed using stored token. To fix, first logout using \\`trigger.dev logout${\n options?.profile ? ` --profile ${options.profile}` : \"\"\n }\\` and then try again.`\n );\n\n throw new SkipLoggingError(whoAmIResult.error);\n } else {\n throw new Error(whoAmIResult.error);\n }\n } else {\n if (!opts.embedded) {\n const continueOption = await select({\n message: \"You are already logged in.\",\n options: [\n {\n value: false,\n label: \"Exit\",\n },\n {\n value: true,\n label: \"Login with a different account\",\n },\n ],\n initialValue: false,\n });\n\n if (continueOption !== true) {\n outro(\"Already logged in\");\n\n span.setAttributes({\n \"cli.userId\": whoAmIResult.data.userId,\n \"cli.email\": whoAmIResult.data.email,\n \"cli.config.apiUrl\": authConfig.apiUrl ?? opts.defaultApiUrl,\n });\n\n span.end();\n\n return {\n ok: true as const,\n profile: options?.profile ?? \"default\",\n userId: whoAmIResult.data.userId,\n email: whoAmIResult.data.email,\n dashboardUrl: whoAmIResult.data.dashboardUrl,\n auth: {\n accessToken: authConfig.accessToken,\n apiUrl: authConfig.apiUrl ?? opts.defaultApiUrl,\n tokenType: \"personal\" as const,\n },\n };\n }\n } else {\n span.setAttributes({\n \"cli.userId\": whoAmIResult.data.userId,\n \"cli.email\": whoAmIResult.data.email,\n \"cli.config.apiUrl\": authConfig.apiUrl ?? opts.defaultApiUrl,\n });\n\n span.end();\n\n return {\n ok: true as const,\n profile: options?.profile ?? \"default\",\n userId: whoAmIResult.data.userId,\n email: whoAmIResult.data.email,\n dashboardUrl: whoAmIResult.data.dashboardUrl,\n auth: {\n accessToken: authConfig.accessToken,\n apiUrl: authConfig.apiUrl ?? opts.defaultApiUrl,\n tokenType: \"personal\" as const,\n },\n };\n }\n }\n }\n\n if (isCI) {\n const apiUrl =\n env.TRIGGER_API_URL ?? authConfig?.apiUrl ?? opts.defaultApiUrl ?? CLOUD_API_URL;\n\n const isSelfHosted = apiUrl !== CLOUD_API_URL;\n\n // This is fine, as the api URL will generally be the same as the dashboard URL for self-hosted instances\n const dashboardUrl = isSelfHosted ? apiUrl : \"https://cloud.trigger.dev\";\n\n throw new Error(\n `Authentication required in CI environment. Please set the TRIGGER_ACCESS_TOKEN environment variable with a Personal Access Token.\n\n- You can generate one here: ${dashboardUrl}/account/tokens\n\n- For more information, see: ${links.docs.gitHubActions.personalAccessToken}`\n );\n }\n\n if (opts.embedded) {\n log.step(\"You must login to continue.\");\n }\n\n const apiClient = new CliApiClient(authConfig?.apiUrl ?? opts.defaultApiUrl);\n\n //generate authorization code\n const authorizationCodeResult = await createAuthorizationCode(apiClient);\n\n //Link the user to the authorization code\n log.step(\n `Please visit the following URL to login:\\n${chalkLink(authorizationCodeResult.url)}`\n );\n\n if (opts.browser === false) {\n log.message(\"Browser auto-open disabled. Visit the URL above to login.\");\n } else if (await isLinuxServer()) {\n log.message(\"Please install `xdg-utils` to automatically open the login URL.\");\n } else {\n await open(authorizationCodeResult.url);\n }\n\n //poll for personal access token (we need to poll for it)\n const getPersonalAccessTokenSpinner = spinner();\n getPersonalAccessTokenSpinner.start(\"Waiting for you to login\");\n try {\n const indexResult = await pRetry(\n () => getPersonalAccessToken(apiClient, authorizationCodeResult.authorizationCode),\n {\n //poll at a fixed 1s interval. ~5 min window so the user has time to\n //approve the consent screen; stays within the code's 10-min validity.\n factor: 1,\n retries: 300,\n minTimeout: 1000,\n }\n );\n\n getPersonalAccessTokenSpinner.stop(`Logged in with token ${indexResult.obfuscatedToken}`);\n\n writeAuthConfigProfile(\n {\n accessToken: indexResult.token,\n apiUrl: opts.defaultApiUrl,\n },\n options?.profile\n );\n\n // Only fetch notifications for standalone login, not when embedded in dev\n // (dev.ts handles its own notification fetch to avoid double counting)\n const notificationPromise = opts.embedded\n ? undefined\n : fetchPlatformNotification({\n apiClient: new CliApiClient(\n authConfig?.apiUrl ?? opts.defaultApiUrl,\n indexResult.token\n ),\n });\n\n const whoAmIResult = await whoAmI(\n {\n profile: options?.profile ?? \"default\",\n skipTelemetry: !span.isRecording(),\n logLevel: logger.loggerLevel,\n },\n opts.embedded\n );\n\n if (!whoAmIResult.success) {\n throw new Error(whoAmIResult.error);\n }\n\n const profileName = options?.profile ?? \"default\";\n\n // Set this profile as the current default\n writeAuthConfigCurrentProfileName(profileName);\n\n if (opts.embedded) {\n log.step(\"Logged in successfully\");\n } else {\n outro(\"Logged in successfully\");\n }\n\n await awaitAndDisplayPlatformNotification(notificationPromise);\n\n span.end();\n\n return {\n ok: true as const,\n profile: profileName,\n userId: whoAmIResult.data.userId,\n email: whoAmIResult.data.email,\n dashboardUrl: whoAmIResult.data.dashboardUrl,\n auth: {\n accessToken: indexResult.token,\n apiUrl: authConfig?.apiUrl ?? opts.defaultApiUrl,\n tokenType: \"personal\" as const,\n },\n };\n } catch (e) {\n getPersonalAccessTokenSpinner.stop(`Failed to get access token`);\n\n if (e instanceof AbortError) {\n log.error(e.message);\n }\n\n recordSpanException(span, e);\n span.end();\n\n return {\n ok: false as const,\n error: e instanceof Error ? e.message : String(e),\n };\n }\n } catch (e) {\n recordSpanException(span, e);\n span.end();\n\n if (options?.embedded) {\n if (e instanceof NotPersonalAccessTokenError) {\n throw e;\n }\n\n return {\n ok: false as const,\n error: e instanceof Error ? e.message : String(e),\n };\n }\n\n throw e;\n }\n });\n}\n" pre_fix = "export async function login(options?: LoginOptions): Promise {\n return await tracer.startActiveSpan(\"login\", async (span) => {\n try {\n const opts = {\n defaultApiUrl: CLOUD_API_URL,\n embedded: false,\n silent: false,\n ...options,\n };\n\n span.setAttributes({\n \"cli.config.apiUrl\": opts.defaultApiUrl,\n \"cli.options.profile\": opts.profile,\n });\n\n if (!opts.embedded) {\n intro(\"Logging in to Trigger.dev\");\n }\n\n const accessTokenFromEnv = env.TRIGGER_ACCESS_TOKEN;\n\n if (accessTokenFromEnv) {\n const validationResult = validateAccessToken(accessTokenFromEnv);\n\n if (!validationResult.success) {\n // We deliberately don't surface the existence of organization access tokens to the user for now, as they're only used internally.\n // Once we expose them in the application, we should also communicate that option here.\n throw new NotAccessTokenError(\n \"Your TRIGGER_ACCESS_TOKEN is not a Personal Access Token, they start with 'tr_pat_'. You can generate one here: https://cloud.trigger.dev/account/tokens\"\n );\n }\n\n const auth = {\n accessToken: accessTokenFromEnv,\n apiUrl: env.TRIGGER_API_URL ?? opts.defaultApiUrl ?? CLOUD_API_URL,\n };\n const apiClient = new CliApiClient(auth.apiUrl, auth.accessToken);\n const userData = await apiClient.whoAmI();\n\n if (!userData.success) {\n throw new Error(userData.error);\n }\n\n return {\n ok: true as const,\n profile: options?.profile ?? \"default\",\n userId: userData.data.userId,\n email: userData.data.email,\n dashboardUrl: userData.data.dashboardUrl,\n auth: {\n accessToken: auth.accessToken,\n tokenType: validationResult.type,\n apiUrl: auth.apiUrl,\n },\n };\n }\n\n const authConfig = readAuthConfigProfile(options?.profile);\n\n if (authConfig && authConfig.accessToken) {\n const whoAmIResult = await whoAmI(\n {\n profile: options?.profile ?? \"default\",\n skipTelemetry: !span.isRecording(),\n logLevel: logger.loggerLevel,\n },\n true,\n opts.silent\n );\n\n if (!whoAmIResult.success) {\n prettyError(\"Unable to validate existing personal access token\", whoAmIResult.error);\n\n if (!opts.embedded) {\n outro(\n `Login failed using stored token. To fix, first logout using \\`trigger.dev logout${\n options?.profile ? ` --profile ${options.profile}` : \"\"\n }\\` and then try again.`\n );\n\n throw new SkipLoggingError(whoAmIResult.error);\n } else {\n throw new Error(whoAmIResult.error);\n }\n } else {\n if (!opts.embedded) {\n const continueOption = await select({\n message: \"You are already logged in.\",\n options: [\n {\n value: false,\n label: \"Exit\",\n },\n {\n value: true,\n label: \"Login with a different account\",\n },\n ],\n initialValue: false,\n });\n\n if (continueOption !== true) {\n outro(\"Already logged in\");\n\n span.setAttributes({\n \"cli.userId\": whoAmIResult.data.userId,\n \"cli.email\": whoAmIResult.data.email,\n \"cli.config.apiUrl\": authConfig.apiUrl ?? opts.defaultApiUrl,\n });\n\n span.end();\n\n return {\n ok: true as const,\n profile: options?.profile ?? \"default\",\n userId: whoAmIResult.data.userId,\n email: whoAmIResult.data.email,\n dashboardUrl: whoAmIResult.data.dashboardUrl,\n auth: {\n accessToken: authConfig.accessToken,\n apiUrl: authConfig.apiUrl ?? opts.defaultApiUrl,\n tokenType: \"personal\" as const,\n },\n };\n }\n } else {\n span.setAttributes({\n \"cli.userId\": whoAmIResult.data.userId,\n \"cli.email\": whoAmIResult.data.email,\n \"cli.config.apiUrl\": authConfig.apiUrl ?? opts.defaultApiUrl,\n });\n\n span.end();\n\n return {\n ok: true as const,\n profile: options?.profile ?? \"default\",\n userId: whoAmIResult.data.userId,\n email: whoAmIResult.data.email,\n dashboardUrl: whoAmIResult.data.dashboardUrl,\n auth: {\n accessToken: authConfig.accessToken,\n apiUrl: authConfig.apiUrl ?? opts.defaultApiUrl,\n tokenType: \"personal\" as const,\n },\n };\n }\n }\n }\n\n if (isCI) {\n const apiUrl =\n env.TRIGGER_API_URL ?? authConfig?.apiUrl ?? opts.defaultApiUrl ?? CLOUD_API_URL;\n\n const isSelfHosted = apiUrl !== CLOUD_API_URL;\n\n // This is fine, as the api URL will generally be the same as the dashboard URL for self-hosted instances\n const dashboardUrl = isSelfHosted ? apiUrl : \"https://cloud.trigger.dev\";\n\n throw new Error(\n `Authentication required in CI environment. Please set the TRIGGER_ACCESS_TOKEN environment variable with a Personal Access Token.\n\n- You can generate one here: ${dashboardUrl}/account/tokens\n\n- For more information, see: ${links.docs.gitHubActions.personalAccessToken}`\n );\n }\n\n if (opts.embedded) {\n log.step(\"You must login to continue.\");\n }\n\n const apiClient = new CliApiClient(authConfig?.apiUrl ?? opts.defaultApiUrl);\n\n //generate authorization code\n const authorizationCodeResult = await createAuthorizationCode(apiClient);\n\n //Link the user to the authorization code\n log.step(\n `Please visit the following URL to login:\\n${chalkLink(authorizationCodeResult.url)}`\n );\n\n if (opts.browser === false) {\n log.message(\"Browser auto-open disabled. Visit the URL above to login.\");\n } else if (await isLinuxServer()) {\n log.message(\"Please install `xdg-utils` to automatically open the login URL.\");\n } else {\n await open(authorizationCodeResult.url);\n }\n\n //poll for personal access token (we need to poll for it)\n const getPersonalAccessTokenSpinner = spinner();\n getPersonalAccessTokenSpinner.start(\"Waiting for you to login\");\n try {\n const indexResult = await pRetry(\n () => getPersonalAccessToken(apiClient, authorizationCodeResult.authorizationCode),\n {\n //this means we're polling, same distance between each attempt\n factor: 1,\n retries: 60,\n minTimeout: 1000,\n }\n );\n\n getPersonalAccessTokenSpinner.stop(`Logged in with token ${indexResult.obfuscatedToken}`);\n\n writeAuthConfigProfile(\n {\n accessToken: indexResult.token,\n apiUrl: opts.defaultApiUrl,\n },\n options?.profile\n );\n\n // Only fetch notifications for standalone login, not when embedded in dev\n // (dev.ts handles its own notification fetch to avoid double counting)\n const notificationPromise = opts.embedded\n ? undefined\n : fetchPlatformNotification({\n apiClient: new CliApiClient(\n authConfig?.apiUrl ?? opts.defaultApiUrl,\n indexResult.token\n ),\n });\n\n const whoAmIResult = await whoAmI(\n {\n profile: options?.profile ?? \"default\",\n skipTelemetry: !span.isRecording(),\n logLevel: logger.loggerLevel,\n },\n opts.embedded\n );\n\n if (!whoAmIResult.success) {\n throw new Error(whoAmIResult.error);\n }\n\n const profileName = options?.profile ?? \"default\";\n\n // Set this profile as the current default\n writeAuthConfigCurrentProfileName(profileName);\n\n if (opts.embedded) {\n log.step(\"Logged in successfully\");\n } else {\n outro(\"Logged in successfully\");\n }\n\n await awaitAndDisplayPlatformNotification(notificationPromise);\n\n span.end();\n\n return {\n ok: true as const,\n profile: profileName,\n userId: whoAmIResult.data.userId,\n email: whoAmIResult.data.email,\n dashboardUrl: whoAmIResult.data.dashboardUrl,\n auth: {\n accessToken: indexResult.token,\n apiUrl: authConfig?.apiUrl ?? opts.defaultApiUrl,\n tokenType: \"personal\" as const,\n },\n };\n } catch (e) {\n getPersonalAccessTokenSpinner.stop(`Failed to get access token`);\n\n if (e instanceof AbortError) {\n log.error(e.message);\n }\n\n recordSpanException(span, e);\n span.end();\n\n return {\n ok: false as const,\n error: e instanceof Error ? e.message : String(e),\n };\n }\n } catch (e) {\n recordSpanException(span, e);\n span.end();\n\n if (options?.embedded) {\n if (e instanceof NotPersonalAccessTokenError) {\n throw e;\n }\n\n return {\n ok: false as const,\n error: e instanceof Error ? e.message : String(e),\n };\n }\n\n throw e;\n }\n });\n}\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "getDeployment" function_lines = [[475, 515]] id = "triggerdotdev-trigger.dev-5f1cf28e3ac84980" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/v3/services/deployment.server.ts" post_fix = " private getDeployment(environmentId: string, friendlyId: string) {\n return fromPromise(\n this._prisma.workerDeployment.findFirst({\n where: {\n friendlyId,\n environmentId,\n },\n select: {\n status: true,\n id: true,\n buildServerMetadata: true,\n imageReference: true,\n shortCode: true,\n environment: {\n include: {\n project: {\n select: {\n externalRef: true,\n },\n },\n },\n },\n },\n }),\n (error) => ({\n type: \"other\" as const,\n cause: error,\n })\n )\n .andThen((deployment) => {\n if (!deployment) {\n return errAsync({ type: \"deployment_not_found\" as const });\n }\n return okAsync(deployment);\n })\n .map((deployment) => ({\n ...deployment,\n buildServerMetadata: BuildServerMetadata.safeParse(deployment.buildServerMetadata).data,\n }));\n }\n}" pre_fix = " private getDeployment(projectId: string, friendlyId: string) {\n return fromPromise(\n this._prisma.workerDeployment.findFirst({\n where: {\n friendlyId,\n projectId,\n },\n select: {\n status: true,\n id: true,\n buildServerMetadata: true,\n imageReference: true,\n shortCode: true,\n environment: {\n include: {\n project: {\n select: {\n externalRef: true,\n },\n },\n },\n },\n },\n }),\n (error) => ({\n type: \"other\" as const,\n cause: error,\n })\n )\n .andThen((deployment) => {\n if (!deployment) {\n return errAsync({ type: \"deployment_not_found\" as const });\n }\n return okAsync(deployment);\n })\n .map((deployment) => ({\n ...deployment,\n buildServerMetadata: BuildServerMetadata.safeParse(deployment.buildServerMetadata).data,\n }));\n }\n}" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "constructor" function_lines = [[90, 578]] id = "triggerdotdev-trigger.dev-69e5a79ca434a31b" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/index.ts" post_fix = " constructor() {\n // Strip secret-like env vars before debug-logging the rest. Add any new\n // secret env var here so it never lands in the DEBUG \"Starting up\" log.\n const {\n TRIGGER_WORKER_TOKEN,\n MANAGED_WORKER_SECRET,\n COMPUTE_GATEWAY_AUTH_TOKEN,\n DOCKER_REGISTRY_PASSWORD,\n TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_PASSWORD,\n WORKLOAD_TOKEN_SECRET,\n ...envWithoutSecrets\n } = env;\n\n if (env.DEBUG) {\n this.logger.debug(\"Starting up\", { envWithoutSecrets });\n }\n\n if (this.warmStartUrl) {\n this.logger.log(\"🔥 Warm starts enabled\", {\n warmStartUrl: this.warmStartUrl,\n });\n }\n\n const workloadManagerOptions = {\n workloadApiProtocol: env.TRIGGER_WORKLOAD_API_PROTOCOL,\n workloadApiDomain: env.TRIGGER_WORKLOAD_API_DOMAIN,\n workloadApiPort: env.TRIGGER_WORKLOAD_API_PORT_EXTERNAL,\n warmStartUrl: this.warmStartUrl,\n metadataUrl: env.TRIGGER_METADATA_URL,\n imagePullSecrets: env.KUBERNETES_IMAGE_PULL_SECRETS?.split(\",\"),\n heartbeatIntervalSeconds: env.RUNNER_HEARTBEAT_INTERVAL_SECONDS,\n snapshotPollIntervalSeconds: env.RUNNER_SNAPSHOT_POLL_INTERVAL_SECONDS,\n additionalEnvVars: env.RUNNER_ADDITIONAL_ENV_VARS,\n dockerAutoremove: env.DOCKER_AUTOREMOVE_EXITED_CONTAINERS,\n checkpointsEnabled: !!env.TRIGGER_CHECKPOINT_URL,\n } satisfies WorkloadManagerOptions;\n\n this.resourceMonitor = env.RESOURCE_MONITOR_ENABLED\n ? this.isKubernetes\n ? new KubernetesResourceMonitor(createK8sApi(), env.TRIGGER_WORKER_INSTANCE_NAME)\n : new DockerResourceMonitor(new Docker())\n : new NoopResourceMonitor();\n\n if (env.COMPUTE_GATEWAY_URL) {\n if (!env.TRIGGER_WORKLOAD_API_DOMAIN) {\n throw new Error(\"TRIGGER_WORKLOAD_API_DOMAIN is not set, cannot create compute manager\");\n }\n\n const callbackUrl = `${env.TRIGGER_WORKLOAD_API_PROTOCOL}://${env.TRIGGER_WORKLOAD_API_DOMAIN}:${env.TRIGGER_WORKLOAD_API_PORT_EXTERNAL}/api/v1/compute/snapshot-complete`;\n\n if (env.COMPUTE_TRACE_SPANS_ENABLED) {\n this.tracing = new OtlpTraceService({\n endpointUrl: env.COMPUTE_TRACE_OTLP_ENDPOINT,\n });\n }\n\n const computeManager = new ComputeWorkloadManager({\n ...workloadManagerOptions,\n gateway: {\n url: env.COMPUTE_GATEWAY_URL,\n authToken: env.COMPUTE_GATEWAY_AUTH_TOKEN,\n timeoutMs: env.COMPUTE_GATEWAY_TIMEOUT_MS,\n },\n snapshots: {\n enabled: env.COMPUTE_SNAPSHOTS_ENABLED,\n delayMs: env.COMPUTE_SNAPSHOT_DELAY_MS,\n dispatchLimit: env.COMPUTE_SNAPSHOT_DISPATCH_LIMIT,\n callbackUrl,\n },\n tracing: this.tracing,\n runner: {\n instanceName: env.TRIGGER_WORKER_INSTANCE_NAME,\n otelEndpoint: env.OTEL_EXPORTER_OTLP_ENDPOINT,\n prettyLogs: env.RUNNER_PRETTY_LOGS,\n sendRunDebugLogs: env.SEND_RUN_DEBUG_LOGS,\n },\n createRetry: {\n maxAttempts: env.COMPUTE_INSTANCE_CREATE_MAX_ATTEMPTS,\n baseDelayMs: env.COMPUTE_INSTANCE_CREATE_RETRY_BASE_DELAY_MS,\n },\n });\n this.computeManager = computeManager;\n this.workloadManager = computeManager;\n this.workloadManagerBackend = \"compute\";\n } else if (this.isKubernetes) {\n this.workloadManager = new KubernetesWorkloadManager(workloadManagerOptions);\n this.workloadManagerBackend = \"kubernetes\";\n } else {\n this.workloadManager = new DockerWorkloadManager(workloadManagerOptions);\n this.workloadManagerBackend = \"docker\";\n }\n\n if (this.isKubernetes) {\n if (env.POD_CLEANER_ENABLED) {\n this.logger.log(\"🧹 Pod cleaner enabled\", {\n namespace: env.KUBERNETES_NAMESPACE,\n batchSize: env.POD_CLEANER_BATCH_SIZE,\n intervalMs: env.POD_CLEANER_INTERVAL_MS,\n });\n this.podCleaner = new PodCleaner({\n register,\n namespace: env.KUBERNETES_NAMESPACE,\n batchSize: env.POD_CLEANER_BATCH_SIZE,\n intervalMs: env.POD_CLEANER_INTERVAL_MS,\n });\n } else {\n this.logger.warn(\"Pod cleaner disabled\");\n }\n\n if (env.FAILED_POD_HANDLER_ENABLED) {\n this.logger.log(\"🔁 Failed pod handler enabled\", {\n namespace: env.KUBERNETES_NAMESPACE,\n reconnectIntervalMs: env.FAILED_POD_HANDLER_RECONNECT_INTERVAL_MS,\n });\n this.failedPodHandler = new FailedPodHandler({\n register,\n namespace: env.KUBERNETES_NAMESPACE,\n reconnectIntervalMs: env.FAILED_POD_HANDLER_RECONNECT_INTERVAL_MS,\n });\n } else {\n this.logger.warn(\"Failed pod handler disabled\");\n }\n }\n\n if (env.TRIGGER_DEQUEUE_INTERVAL_MS > env.TRIGGER_DEQUEUE_IDLE_INTERVAL_MS) {\n this.logger.warn(\n `⚠️ TRIGGER_DEQUEUE_INTERVAL_MS (${env.TRIGGER_DEQUEUE_INTERVAL_MS}) is greater than TRIGGER_DEQUEUE_IDLE_INTERVAL_MS (${env.TRIGGER_DEQUEUE_IDLE_INTERVAL_MS}) - did you mix them up?`\n );\n }\n\n // Redis-verdict source (external aggregator). Keeps existing metric names.\n if (env.TRIGGER_DEQUEUE_BACKPRESSURE_ENABLED) {\n this.backpressureRedis = new Redis({\n host: env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_HOST,\n port: env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_PORT,\n username: env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_USERNAME,\n password: env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_PASSWORD,\n ...(env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_TLS_DISABLED ? {} : { tls: {} }),\n maxRetriesPerRequest: null,\n });\n this.backpressureRedis.on(\"error\", (error) =>\n this.logger.error(\"Backpressure redis error\", { error: error.message })\n );\n this.backpressureMonitors.push(\n new BackpressureMonitor({\n enabled: true,\n source: new RedisBackpressureSignalSource(\n this.backpressureRedis,\n env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_KEY\n ),\n refreshIntervalMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_REFRESH_MS,\n maxVerdictAgeMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_MAX_VERDICT_AGE_MS,\n rampMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_RAMP_MS,\n dryRun: env.TRIGGER_DEQUEUE_BACKPRESSURE_DRY_RUN,\n logger: this.logger,\n metrics: new BackpressureMetrics({ register }),\n })\n );\n this.logger.log(\"🛑 Dequeue backpressure enabled (redis source)\", {\n key: env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_KEY,\n refreshIntervalMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_REFRESH_MS,\n dryRun: env.TRIGGER_DEQUEUE_BACKPRESSURE_DRY_RUN,\n });\n }\n\n // Pod-count source (in-process apiserver scrape). Namespaced metrics so the\n // redis source's metric names are preserved.\n if (env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_ENABLED) {\n // RELEASE < ENGAGE is enforced in env.ts (superRefine), so it's valid here.\n const podCountGauge = new Gauge({\n name: \"supervisor_cluster_pod_count\",\n help: \"Total pod objects stored in the cluster, scraped for backpressure\",\n registers: [register],\n });\n this.backpressureMonitors.push(\n new BackpressureMonitor({\n enabled: true,\n source: new K8sPodCountSignalSource({\n fetchMetrics: createApiserverMetricsFetcher(\n env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_SCRAPE_TIMEOUT_MS\n ),\n engageThreshold: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_ENGAGE,\n releaseThreshold: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_RELEASE,\n reportPodCount: (count) => podCountGauge.set(count),\n }),\n refreshIntervalMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_REFRESH_MS,\n maxVerdictAgeMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_MAX_VERDICT_AGE_MS,\n rampMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_RAMP_MS,\n dryRun: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_DRY_RUN,\n logger: this.logger,\n metrics: new BackpressureMetrics({\n register,\n prefix: \"supervisor_backpressure_pod_count\",\n }),\n })\n );\n this.logger.log(\"🛑 Dequeue backpressure enabled (pod-count source)\", {\n engage: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_ENGAGE,\n release: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_RELEASE,\n refreshIntervalMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_REFRESH_MS,\n dryRun: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_DRY_RUN,\n });\n }\n\n const workerToken = getWorkerToken();\n\n this.workerSession = new SupervisorSession({\n workerToken,\n apiUrl: env.TRIGGER_API_URL,\n instanceName: env.TRIGGER_WORKER_INSTANCE_NAME,\n managedWorkerSecret: env.MANAGED_WORKER_SECRET,\n dequeueIntervalMs: env.TRIGGER_DEQUEUE_INTERVAL_MS,\n dequeueIdleIntervalMs: env.TRIGGER_DEQUEUE_IDLE_INTERVAL_MS,\n queueConsumerEnabled: env.TRIGGER_DEQUEUE_ENABLED,\n maxRunCount: env.TRIGGER_DEQUEUE_MAX_RUN_COUNT,\n queueClass: env.TRIGGER_WORKER_QUEUE_CLASS,\n metricsRegistry: register,\n scaling: {\n strategy: env.TRIGGER_DEQUEUE_SCALING_STRATEGY,\n minConsumerCount: env.TRIGGER_DEQUEUE_MIN_CONSUMER_COUNT,\n maxConsumerCount: env.TRIGGER_DEQUEUE_MAX_CONSUMER_COUNT,\n scaleUpCooldownMs: env.TRIGGER_DEQUEUE_SCALING_UP_COOLDOWN_MS,\n scaleDownCooldownMs: env.TRIGGER_DEQUEUE_SCALING_DOWN_COOLDOWN_MS,\n targetRatio: env.TRIGGER_DEQUEUE_SCALING_TARGET_RATIO,\n ewmaAlpha: env.TRIGGER_DEQUEUE_SCALING_EWMA_ALPHA,\n batchWindowMs: env.TRIGGER_DEQUEUE_SCALING_BATCH_WINDOW_MS,\n dampingFactor: env.TRIGGER_DEQUEUE_SCALING_DAMPING_FACTOR,\n // Freeze scale-up while backpressure is hard-engaged (not during the resume\n // ramp). Undefined when backpressure is disabled → no effect on scaling.\n shouldPauseScaling: () => this.backpressureMonitors.some((m) => m.isEngaged()),\n },\n runNotificationsEnabled: env.TRIGGER_WORKLOAD_API_ENABLED,\n heartbeatIntervalSeconds: env.TRIGGER_WORKER_HEARTBEAT_INTERVAL_SECONDS,\n sendRunDebugLogs: env.SEND_RUN_DEBUG_LOGS,\n preDequeue: async () => {\n // Synchronous, hot-path-safe cached read; false when no monitors are active.\n const skipForBackpressure = this.backpressureMonitors.some((m) => m.shouldSkipDequeue());\n\n if (!env.RESOURCE_MONITOR_ENABLED || this.isKubernetes) {\n // Resource monitor is not used in k8s; backpressure is the only gate there.\n return { skipDequeue: skipForBackpressure };\n }\n\n const resources = await this.resourceMonitor.getNodeResources();\n\n return {\n maxResources: {\n cpu: resources.cpuAvailable,\n memory: resources.memoryAvailable,\n },\n skipDequeue:\n skipForBackpressure ||\n resources.cpuAvailable < 0.25 ||\n resources.memoryAvailable < 0.25,\n };\n },\n preSkip: async () => {\n // When the node is full, it should still try to warm start runs\n // await this.tryWarmStartAllThisNode();\n },\n });\n\n if (env.TRIGGER_CHECKPOINT_URL) {\n this.logger.log(\"🥶 Checkpoints enabled\", {\n checkpointUrl: env.TRIGGER_CHECKPOINT_URL,\n });\n\n this.checkpointClient = new CheckpointClient({\n apiUrl: new URL(env.TRIGGER_CHECKPOINT_URL),\n workerClient: this.workerSession.httpClient,\n orchestrator: this.isKubernetes ? \"KUBERNETES\" : \"DOCKER\",\n });\n }\n\n if (env.TRIGGER_WARM_START_VERIFY_ENABLED && this.warmStartUrl) {\n this.logger.log(\"Warm-start delivery verification enabled\", {\n delayMs: env.TRIGGER_WARM_START_VERIFY_DELAY_MS,\n });\n\n this.warmStartVerifier = new WarmStartVerificationService({\n workerClient: this.workerSession.httpClient,\n delayMs: env.TRIGGER_WARM_START_VERIFY_DELAY_MS,\n createWorkload: (message, timings) => this.createWorkload(message, timings),\n wideEventOpts: this.wideEventOpts,\n });\n }\n\n this.workerSession.on(\"runNotification\", async ({ time, run }) => {\n this.logger.verbose(\"runNotification\", { time, run });\n\n this.workloadServer.notifyRun({ run });\n });\n\n this.workerSession.on(\n \"runQueueMessage\",\n async ({ time, message, dequeueResponseMs, pollingIntervalMs }) => {\n this.logger.verbose(`Received message with timestamp ${time.toLocaleString()}`, message);\n\n const traceparent = extractTraceparent(message.run.traceContext);\n\n await runWideEvent(\n {\n ...this.wideEventOpts,\n op: \"dequeue\",\n kind: \"inbound\",\n traceparent,\n setup: (state) => {\n setMeta(state, \"run_id\", message.run.friendlyId);\n setMeta(state, \"env_id\", message.environment.id);\n setMeta(state, \"org_id\", message.organization.id);\n setMeta(state, \"project_id\", message.project.id);\n if (message.deployment.friendlyId) {\n setMeta(state, \"deployment_id\", message.deployment.friendlyId);\n }\n setMeta(state, \"machine_preset\", message.run.machine.name);\n state.extras.iteration = \"dequeue\";\n state.extras.dequeue_response_ms = dequeueResponseMs;\n state.extras.polling_interval_ms = pollingIntervalMs;\n state.extras.completed_waitpoints = message.completedWaitpoints.length;\n },\n },\n async () => {\n if (message.completedWaitpoints.length > 0) {\n this.logger.debug(\"Run has completed waitpoints\", {\n runId: message.run.id,\n completedWaitpoints: message.completedWaitpoints.length,\n });\n }\n\n if (!message.image) {\n setExtra(fromContext(), \"path_taken\", \"skipped_no_image\");\n this.logger.error(\"Run has no image\", { runId: message.run.id });\n return;\n }\n\n const { checkpoint, ...rest } = message;\n\n // Register trace context early so snapshot spans work for all paths\n // (cold create, restore, warm start). Re-registration on restore is safe\n // since dequeue always provides fresh context.\n if (this.computeManager?.traceSpansEnabled && traceparent) {\n this.workloadServer.registerRunTraceContext(message.run.friendlyId, {\n traceparent,\n envId: message.environment.id,\n orgId: message.organization.id,\n projectId: message.project.id,\n });\n }\n\n if (checkpoint) {\n setExtra(fromContext(), \"path_taken\", \"restore\");\n this.logger.debug(\"Restoring run\", { runId: message.run.id });\n\n if (this.computeManager) {\n const restoreStart = performance.now();\n try {\n const runnerId = getRestoreRunnerId(message.run.friendlyId, checkpoint.id);\n\n const didRestore = await this.computeManager.restore({\n snapshotId: checkpoint.location,\n runnerId,\n runFriendlyId: message.run.friendlyId,\n snapshotFriendlyId: message.snapshot.friendlyId,\n machine: message.run.machine,\n traceContext: message.run.traceContext,\n envId: message.environment.id,\n orgId: message.organization.id,\n projectId: message.project.id,\n hasPrivateLink: message.organization.hasPrivateLink,\n dequeuedAt: message.dequeuedAt,\n });\n recordPhaseSince(\"restore\", restoreStart, undefined);\n setExtra(fromContext(), \"did_restore\", didRestore);\n\n if (didRestore) {\n this.logger.debug(\"Compute restore successful\", {\n runId: message.run.id,\n runnerId,\n });\n } else {\n this.logger.error(\"Compute restore failed\", {\n runId: message.run.id,\n runnerId,\n });\n }\n } catch (error) {\n recordPhaseSince(\n \"restore\",\n restoreStart,\n error instanceof Error ? error : new Error(String(error))\n );\n this.logger.error(\"Failed to restore run (compute)\", { error });\n }\n\n return;\n }\n\n if (!this.checkpointClient) {\n this.logger.error(\"No checkpoint client\", { runId: message.run.id });\n return;\n }\n\n const restoreStart = performance.now();\n try {\n const didRestore = await this.checkpointClient.restoreRun({\n runFriendlyId: message.run.friendlyId,\n snapshotFriendlyId: message.snapshot.friendlyId,\n body: {\n ...rest,\n checkpoint,\n },\n });\n recordPhaseSince(\"restore\", restoreStart, undefined);\n setExtra(fromContext(), \"did_restore\", didRestore);\n\n if (didRestore) {\n this.logger.debug(\"Restore successful\", { runId: message.run.id });\n } else {\n this.logger.error(\"Restore failed\", { runId: message.run.id });\n }\n } catch (error) {\n recordPhaseSince(\n \"restore\",\n restoreStart,\n error instanceof Error ? error : new Error(String(error))\n );\n this.logger.error(\"Failed to restore run\", { error });\n }\n\n return;\n }\n\n this.logger.debug(\"Scheduling run\", { runId: message.run.id });\n\n const warmStartStart = performance.now();\n const didWarmStart = await this.tryWarmStart(message, traceparent);\n const warmStartCheckMs = Math.round(performance.now() - warmStartStart);\n recordPhaseSince(\"warm_start\", warmStartStart, undefined);\n setExtra(fromContext(), \"did_warm_start\", didWarmStart);\n\n if (didWarmStart) {\n setExtra(fromContext(), \"path_taken\", \"warm_start\");\n this.logger.debug(\"Warm start successful\", { runId: message.run.id });\n // A hit only means the response was written to the long-poll\n // socket, not that the runner received it. Schedule a delivery\n // verification that cold-starts the run if nobody acts on it.\n this.warmStartVerifier?.schedule(message, {\n dequeueResponseMs,\n pollingIntervalMs,\n warmStartCheckMs,\n });\n return;\n }\n\n setExtra(fromContext(), \"path_taken\", \"cold_create\");\n\n await this.createWorkload(message, {\n dequeueResponseMs,\n pollingIntervalMs,\n warmStartCheckMs,\n });\n }\n );\n }\n );\n\n if (env.METRICS_ENABLED) {\n this.metricsServer = new HttpServer({\n port: env.METRICS_PORT,\n host: env.METRICS_HOST,\n metrics: {\n register,\n expose: true,\n },\n });\n }\n\n // Responds to workload requests only\n this.workloadServer = new WorkloadServer({\n port: env.TRIGGER_WORKLOAD_API_PORT_INTERNAL,\n host: env.TRIGGER_WORKLOAD_API_HOST_INTERNAL,\n workerClient: this.workerSession.httpClient,\n checkpointClient: this.checkpointClient,\n computeManager: this.computeManager,\n tracing: this.tracing,\n snapshotCallbackSecret: workerToken,\n wideEventOpts: this.wideEventOpts,\n wideEventsNoisyRoutes: this.wideEventsNoisyRoutes,\n });\n\n this.workloadServer.on(\"runConnected\", this.onRunConnected.bind(this));\n this.workloadServer.on(\"runDisconnected\", this.onRunDisconnected.bind(this));\n }" pre_fix = " constructor() {\n // Strip secret-like env vars before debug-logging the rest. Add any new\n // secret env var here so it never lands in the DEBUG \"Starting up\" log.\n const {\n TRIGGER_WORKER_TOKEN,\n MANAGED_WORKER_SECRET,\n COMPUTE_GATEWAY_AUTH_TOKEN,\n DOCKER_REGISTRY_PASSWORD,\n TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_PASSWORD,\n ...envWithoutSecrets\n } = env;\n\n if (env.DEBUG) {\n this.logger.debug(\"Starting up\", { envWithoutSecrets });\n }\n\n if (this.warmStartUrl) {\n this.logger.log(\"🔥 Warm starts enabled\", {\n warmStartUrl: this.warmStartUrl,\n });\n }\n\n const workloadManagerOptions = {\n workloadApiProtocol: env.TRIGGER_WORKLOAD_API_PROTOCOL,\n workloadApiDomain: env.TRIGGER_WORKLOAD_API_DOMAIN,\n workloadApiPort: env.TRIGGER_WORKLOAD_API_PORT_EXTERNAL,\n warmStartUrl: this.warmStartUrl,\n metadataUrl: env.TRIGGER_METADATA_URL,\n imagePullSecrets: env.KUBERNETES_IMAGE_PULL_SECRETS?.split(\",\"),\n heartbeatIntervalSeconds: env.RUNNER_HEARTBEAT_INTERVAL_SECONDS,\n snapshotPollIntervalSeconds: env.RUNNER_SNAPSHOT_POLL_INTERVAL_SECONDS,\n additionalEnvVars: env.RUNNER_ADDITIONAL_ENV_VARS,\n dockerAutoremove: env.DOCKER_AUTOREMOVE_EXITED_CONTAINERS,\n checkpointsEnabled: !!env.TRIGGER_CHECKPOINT_URL,\n } satisfies WorkloadManagerOptions;\n\n this.resourceMonitor = env.RESOURCE_MONITOR_ENABLED\n ? this.isKubernetes\n ? new KubernetesResourceMonitor(createK8sApi(), env.TRIGGER_WORKER_INSTANCE_NAME)\n : new DockerResourceMonitor(new Docker())\n : new NoopResourceMonitor();\n\n if (env.COMPUTE_GATEWAY_URL) {\n if (!env.TRIGGER_WORKLOAD_API_DOMAIN) {\n throw new Error(\"TRIGGER_WORKLOAD_API_DOMAIN is not set, cannot create compute manager\");\n }\n\n const callbackUrl = `${env.TRIGGER_WORKLOAD_API_PROTOCOL}://${env.TRIGGER_WORKLOAD_API_DOMAIN}:${env.TRIGGER_WORKLOAD_API_PORT_EXTERNAL}/api/v1/compute/snapshot-complete`;\n\n if (env.COMPUTE_TRACE_SPANS_ENABLED) {\n this.tracing = new OtlpTraceService({\n endpointUrl: env.COMPUTE_TRACE_OTLP_ENDPOINT,\n });\n }\n\n const computeManager = new ComputeWorkloadManager({\n ...workloadManagerOptions,\n gateway: {\n url: env.COMPUTE_GATEWAY_URL,\n authToken: env.COMPUTE_GATEWAY_AUTH_TOKEN,\n timeoutMs: env.COMPUTE_GATEWAY_TIMEOUT_MS,\n },\n snapshots: {\n enabled: env.COMPUTE_SNAPSHOTS_ENABLED,\n delayMs: env.COMPUTE_SNAPSHOT_DELAY_MS,\n dispatchLimit: env.COMPUTE_SNAPSHOT_DISPATCH_LIMIT,\n callbackUrl,\n },\n tracing: this.tracing,\n runner: {\n instanceName: env.TRIGGER_WORKER_INSTANCE_NAME,\n otelEndpoint: env.OTEL_EXPORTER_OTLP_ENDPOINT,\n prettyLogs: env.RUNNER_PRETTY_LOGS,\n sendRunDebugLogs: env.SEND_RUN_DEBUG_LOGS,\n },\n createRetry: {\n maxAttempts: env.COMPUTE_INSTANCE_CREATE_MAX_ATTEMPTS,\n baseDelayMs: env.COMPUTE_INSTANCE_CREATE_RETRY_BASE_DELAY_MS,\n },\n });\n this.computeManager = computeManager;\n this.workloadManager = computeManager;\n this.workloadManagerBackend = \"compute\";\n } else if (this.isKubernetes) {\n this.workloadManager = new KubernetesWorkloadManager(workloadManagerOptions);\n this.workloadManagerBackend = \"kubernetes\";\n } else {\n this.workloadManager = new DockerWorkloadManager(workloadManagerOptions);\n this.workloadManagerBackend = \"docker\";\n }\n\n if (this.isKubernetes) {\n if (env.POD_CLEANER_ENABLED) {\n this.logger.log(\"🧹 Pod cleaner enabled\", {\n namespace: env.KUBERNETES_NAMESPACE,\n batchSize: env.POD_CLEANER_BATCH_SIZE,\n intervalMs: env.POD_CLEANER_INTERVAL_MS,\n });\n this.podCleaner = new PodCleaner({\n register,\n namespace: env.KUBERNETES_NAMESPACE,\n batchSize: env.POD_CLEANER_BATCH_SIZE,\n intervalMs: env.POD_CLEANER_INTERVAL_MS,\n });\n } else {\n this.logger.warn(\"Pod cleaner disabled\");\n }\n\n if (env.FAILED_POD_HANDLER_ENABLED) {\n this.logger.log(\"🔁 Failed pod handler enabled\", {\n namespace: env.KUBERNETES_NAMESPACE,\n reconnectIntervalMs: env.FAILED_POD_HANDLER_RECONNECT_INTERVAL_MS,\n });\n this.failedPodHandler = new FailedPodHandler({\n register,\n namespace: env.KUBERNETES_NAMESPACE,\n reconnectIntervalMs: env.FAILED_POD_HANDLER_RECONNECT_INTERVAL_MS,\n });\n } else {\n this.logger.warn(\"Failed pod handler disabled\");\n }\n }\n\n if (env.TRIGGER_DEQUEUE_INTERVAL_MS > env.TRIGGER_DEQUEUE_IDLE_INTERVAL_MS) {\n this.logger.warn(\n `⚠️ TRIGGER_DEQUEUE_INTERVAL_MS (${env.TRIGGER_DEQUEUE_INTERVAL_MS}) is greater than TRIGGER_DEQUEUE_IDLE_INTERVAL_MS (${env.TRIGGER_DEQUEUE_IDLE_INTERVAL_MS}) - did you mix them up?`\n );\n }\n\n // Redis-verdict source (external aggregator). Keeps existing metric names.\n if (env.TRIGGER_DEQUEUE_BACKPRESSURE_ENABLED) {\n this.backpressureRedis = new Redis({\n host: env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_HOST,\n port: env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_PORT,\n username: env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_USERNAME,\n password: env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_PASSWORD,\n ...(env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_TLS_DISABLED ? {} : { tls: {} }),\n maxRetriesPerRequest: null,\n });\n this.backpressureRedis.on(\"error\", (error) =>\n this.logger.error(\"Backpressure redis error\", { error: error.message })\n );\n this.backpressureMonitors.push(\n new BackpressureMonitor({\n enabled: true,\n source: new RedisBackpressureSignalSource(\n this.backpressureRedis,\n env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_KEY\n ),\n refreshIntervalMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_REFRESH_MS,\n maxVerdictAgeMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_MAX_VERDICT_AGE_MS,\n rampMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_RAMP_MS,\n dryRun: env.TRIGGER_DEQUEUE_BACKPRESSURE_DRY_RUN,\n logger: this.logger,\n metrics: new BackpressureMetrics({ register }),\n })\n );\n this.logger.log(\"🛑 Dequeue backpressure enabled (redis source)\", {\n key: env.TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_KEY,\n refreshIntervalMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_REFRESH_MS,\n dryRun: env.TRIGGER_DEQUEUE_BACKPRESSURE_DRY_RUN,\n });\n }\n\n // Pod-count source (in-process apiserver scrape). Namespaced metrics so the\n // redis source's metric names are preserved.\n if (env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_ENABLED) {\n // RELEASE < ENGAGE is enforced in env.ts (superRefine), so it's valid here.\n const podCountGauge = new Gauge({\n name: \"supervisor_cluster_pod_count\",\n help: \"Total pod objects stored in the cluster, scraped for backpressure\",\n registers: [register],\n });\n this.backpressureMonitors.push(\n new BackpressureMonitor({\n enabled: true,\n source: new K8sPodCountSignalSource({\n fetchMetrics: createApiserverMetricsFetcher(\n env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_SCRAPE_TIMEOUT_MS\n ),\n engageThreshold: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_ENGAGE,\n releaseThreshold: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_RELEASE,\n reportPodCount: (count) => podCountGauge.set(count),\n }),\n refreshIntervalMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_REFRESH_MS,\n maxVerdictAgeMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_MAX_VERDICT_AGE_MS,\n rampMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_RAMP_MS,\n dryRun: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_DRY_RUN,\n logger: this.logger,\n metrics: new BackpressureMetrics({\n register,\n prefix: \"supervisor_backpressure_pod_count\",\n }),\n })\n );\n this.logger.log(\"🛑 Dequeue backpressure enabled (pod-count source)\", {\n engage: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_ENGAGE,\n release: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_RELEASE,\n refreshIntervalMs: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_REFRESH_MS,\n dryRun: env.TRIGGER_DEQUEUE_BACKPRESSURE_POD_COUNT_DRY_RUN,\n });\n }\n\n this.workerSession = new SupervisorSession({\n workerToken: getWorkerToken(),\n apiUrl: env.TRIGGER_API_URL,\n instanceName: env.TRIGGER_WORKER_INSTANCE_NAME,\n managedWorkerSecret: env.MANAGED_WORKER_SECRET,\n dequeueIntervalMs: env.TRIGGER_DEQUEUE_INTERVAL_MS,\n dequeueIdleIntervalMs: env.TRIGGER_DEQUEUE_IDLE_INTERVAL_MS,\n queueConsumerEnabled: env.TRIGGER_DEQUEUE_ENABLED,\n maxRunCount: env.TRIGGER_DEQUEUE_MAX_RUN_COUNT,\n queueClass: env.TRIGGER_WORKER_QUEUE_CLASS,\n metricsRegistry: register,\n scaling: {\n strategy: env.TRIGGER_DEQUEUE_SCALING_STRATEGY,\n minConsumerCount: env.TRIGGER_DEQUEUE_MIN_CONSUMER_COUNT,\n maxConsumerCount: env.TRIGGER_DEQUEUE_MAX_CONSUMER_COUNT,\n scaleUpCooldownMs: env.TRIGGER_DEQUEUE_SCALING_UP_COOLDOWN_MS,\n scaleDownCooldownMs: env.TRIGGER_DEQUEUE_SCALING_DOWN_COOLDOWN_MS,\n targetRatio: env.TRIGGER_DEQUEUE_SCALING_TARGET_RATIO,\n ewmaAlpha: env.TRIGGER_DEQUEUE_SCALING_EWMA_ALPHA,\n batchWindowMs: env.TRIGGER_DEQUEUE_SCALING_BATCH_WINDOW_MS,\n dampingFactor: env.TRIGGER_DEQUEUE_SCALING_DAMPING_FACTOR,\n // Freeze scale-up while backpressure is hard-engaged (not during the resume\n // ramp). Undefined when backpressure is disabled → no effect on scaling.\n shouldPauseScaling: () => this.backpressureMonitors.some((m) => m.isEngaged()),\n },\n runNotificationsEnabled: env.TRIGGER_WORKLOAD_API_ENABLED,\n heartbeatIntervalSeconds: env.TRIGGER_WORKER_HEARTBEAT_INTERVAL_SECONDS,\n sendRunDebugLogs: env.SEND_RUN_DEBUG_LOGS,\n preDequeue: async () => {\n // Synchronous, hot-path-safe cached read; false when no monitors are active.\n const skipForBackpressure = this.backpressureMonitors.some((m) => m.shouldSkipDequeue());\n\n if (!env.RESOURCE_MONITOR_ENABLED || this.isKubernetes) {\n // Resource monitor is not used in k8s; backpressure is the only gate there.\n return { skipDequeue: skipForBackpressure };\n }\n\n const resources = await this.resourceMonitor.getNodeResources();\n\n return {\n maxResources: {\n cpu: resources.cpuAvailable,\n memory: resources.memoryAvailable,\n },\n skipDequeue:\n skipForBackpressure ||\n resources.cpuAvailable < 0.25 ||\n resources.memoryAvailable < 0.25,\n };\n },\n preSkip: async () => {\n // When the node is full, it should still try to warm start runs\n // await this.tryWarmStartAllThisNode();\n },\n });\n\n if (env.TRIGGER_CHECKPOINT_URL) {\n this.logger.log(\"🥶 Checkpoints enabled\", {\n checkpointUrl: env.TRIGGER_CHECKPOINT_URL,\n });\n\n this.checkpointClient = new CheckpointClient({\n apiUrl: new URL(env.TRIGGER_CHECKPOINT_URL),\n workerClient: this.workerSession.httpClient,\n orchestrator: this.isKubernetes ? \"KUBERNETES\" : \"DOCKER\",\n });\n }\n\n if (env.TRIGGER_WARM_START_VERIFY_ENABLED && this.warmStartUrl) {\n this.logger.log(\"Warm-start delivery verification enabled\", {\n delayMs: env.TRIGGER_WARM_START_VERIFY_DELAY_MS,\n });\n\n this.warmStartVerifier = new WarmStartVerificationService({\n workerClient: this.workerSession.httpClient,\n delayMs: env.TRIGGER_WARM_START_VERIFY_DELAY_MS,\n createWorkload: (message, timings) => this.createWorkload(message, timings),\n wideEventOpts: this.wideEventOpts,\n });\n }\n\n this.workerSession.on(\"runNotification\", async ({ time, run }) => {\n this.logger.verbose(\"runNotification\", { time, run });\n\n this.workloadServer.notifyRun({ run });\n });\n\n this.workerSession.on(\n \"runQueueMessage\",\n async ({ time, message, dequeueResponseMs, pollingIntervalMs }) => {\n this.logger.verbose(`Received message with timestamp ${time.toLocaleString()}`, message);\n\n const traceparent = extractTraceparent(message.run.traceContext);\n\n await runWideEvent(\n {\n ...this.wideEventOpts,\n op: \"dequeue\",\n kind: \"inbound\",\n traceparent,\n setup: (state) => {\n setMeta(state, \"run_id\", message.run.friendlyId);\n setMeta(state, \"env_id\", message.environment.id);\n setMeta(state, \"org_id\", message.organization.id);\n setMeta(state, \"project_id\", message.project.id);\n if (message.deployment.friendlyId) {\n setMeta(state, \"deployment_id\", message.deployment.friendlyId);\n }\n setMeta(state, \"machine_preset\", message.run.machine.name);\n state.extras.iteration = \"dequeue\";\n state.extras.dequeue_response_ms = dequeueResponseMs;\n state.extras.polling_interval_ms = pollingIntervalMs;\n state.extras.completed_waitpoints = message.completedWaitpoints.length;\n },\n },\n async () => {\n if (message.completedWaitpoints.length > 0) {\n this.logger.debug(\"Run has completed waitpoints\", {\n runId: message.run.id,\n completedWaitpoints: message.completedWaitpoints.length,\n });\n }\n\n if (!message.image) {\n setExtra(fromContext(), \"path_taken\", \"skipped_no_image\");\n this.logger.error(\"Run has no image\", { runId: message.run.id });\n return;\n }\n\n const { checkpoint, ...rest } = message;\n\n // Register trace context early so snapshot spans work for all paths\n // (cold create, restore, warm start). Re-registration on restore is safe\n // since dequeue always provides fresh context.\n if (this.computeManager?.traceSpansEnabled && traceparent) {\n this.workloadServer.registerRunTraceContext(message.run.friendlyId, {\n traceparent,\n envId: message.environment.id,\n orgId: message.organization.id,\n projectId: message.project.id,\n });\n }\n\n if (checkpoint) {\n setExtra(fromContext(), \"path_taken\", \"restore\");\n this.logger.debug(\"Restoring run\", { runId: message.run.id });\n\n if (this.computeManager) {\n const restoreStart = performance.now();\n try {\n const runnerId = getRestoreRunnerId(message.run.friendlyId, checkpoint.id);\n\n const didRestore = await this.computeManager.restore({\n snapshotId: checkpoint.location,\n runnerId,\n runFriendlyId: message.run.friendlyId,\n snapshotFriendlyId: message.snapshot.friendlyId,\n machine: message.run.machine,\n traceContext: message.run.traceContext,\n envId: message.environment.id,\n orgId: message.organization.id,\n projectId: message.project.id,\n hasPrivateLink: message.organization.hasPrivateLink,\n dequeuedAt: message.dequeuedAt,\n });\n recordPhaseSince(\"restore\", restoreStart, undefined);\n setExtra(fromContext(), \"did_restore\", didRestore);\n\n if (didRestore) {\n this.logger.debug(\"Compute restore successful\", {\n runId: message.run.id,\n runnerId,\n });\n } else {\n this.logger.error(\"Compute restore failed\", {\n runId: message.run.id,\n runnerId,\n });\n }\n } catch (error) {\n recordPhaseSince(\n \"restore\",\n restoreStart,\n error instanceof Error ? error : new Error(String(error))\n );\n this.logger.error(\"Failed to restore run (compute)\", { error });\n }\n\n return;\n }\n\n if (!this.checkpointClient) {\n this.logger.error(\"No checkpoint client\", { runId: message.run.id });\n return;\n }\n\n const restoreStart = performance.now();\n try {\n const didRestore = await this.checkpointClient.restoreRun({\n runFriendlyId: message.run.friendlyId,\n snapshotFriendlyId: message.snapshot.friendlyId,\n body: {\n ...rest,\n checkpoint,\n },\n });\n recordPhaseSince(\"restore\", restoreStart, undefined);\n setExtra(fromContext(), \"did_restore\", didRestore);\n\n if (didRestore) {\n this.logger.debug(\"Restore successful\", { runId: message.run.id });\n } else {\n this.logger.error(\"Restore failed\", { runId: message.run.id });\n }\n } catch (error) {\n recordPhaseSince(\n \"restore\",\n restoreStart,\n error instanceof Error ? error : new Error(String(error))\n );\n this.logger.error(\"Failed to restore run\", { error });\n }\n\n return;\n }\n\n this.logger.debug(\"Scheduling run\", { runId: message.run.id });\n\n const warmStartStart = performance.now();\n const didWarmStart = await this.tryWarmStart(message, traceparent);\n const warmStartCheckMs = Math.round(performance.now() - warmStartStart);\n recordPhaseSince(\"warm_start\", warmStartStart, undefined);\n setExtra(fromContext(), \"did_warm_start\", didWarmStart);\n\n if (didWarmStart) {\n setExtra(fromContext(), \"path_taken\", \"warm_start\");\n this.logger.debug(\"Warm start successful\", { runId: message.run.id });\n // A hit only means the response was written to the long-poll\n // socket, not that the runner received it. Schedule a delivery\n // verification that cold-starts the run if nobody acts on it.\n this.warmStartVerifier?.schedule(message, {\n dequeueResponseMs,\n pollingIntervalMs,\n warmStartCheckMs,\n });\n return;\n }\n\n setExtra(fromContext(), \"path_taken\", \"cold_create\");\n\n await this.createWorkload(message, {\n dequeueResponseMs,\n pollingIntervalMs,\n warmStartCheckMs,\n });\n }\n );\n }\n );\n\n if (env.METRICS_ENABLED) {\n this.metricsServer = new HttpServer({\n port: env.METRICS_PORT,\n host: env.METRICS_HOST,\n metrics: {\n register,\n expose: true,\n },\n });\n }\n\n // Responds to workload requests only\n this.workloadServer = new WorkloadServer({\n port: env.TRIGGER_WORKLOAD_API_PORT_INTERNAL,\n host: env.TRIGGER_WORKLOAD_API_HOST_INTERNAL,\n workerClient: this.workerSession.httpClient,\n checkpointClient: this.checkpointClient,\n computeManager: this.computeManager,\n tracing: this.tracing,\n wideEventOpts: this.wideEventOpts,\n wideEventsNoisyRoutes: this.wideEventsNoisyRoutes,\n });\n\n this.workloadServer.on(\"runConnected\", this.onRunConnected.bind(this));\n this.workloadServer.on(\"runDisconnected\", this.onRunDisconnected.bind(this));\n }" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "constructor" function_lines = [[47, 123]] id = "triggerdotdev-trigger.dev-72c9f380f92bd8f2" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "packages/cli-v3/src/entryPoints/managed/controller.ts" post_fix = " constructor(opts: ManagedRunControllerOptions) {\n const env = new RunnerEnv(opts.env);\n this.env = env;\n\n this.workerManifest = opts.workerManifest;\n this.processKeepAliveEnabled = opts.workerManifest.processKeepAlive?.enabled ?? false;\n this.processKeepAliveMaxExecutionCount =\n opts.workerManifest.processKeepAlive?.maxExecutionsPerProcess ?? 100;\n\n this.httpClient = new WorkloadHttpClient({\n workerApiUrl: this.workerApiUrl,\n runnerId: this.runnerId,\n deploymentId: env.TRIGGER_DEPLOYMENT_ID,\n deploymentVersion: env.TRIGGER_DEPLOYMENT_VERSION,\n projectRef: env.TRIGGER_PROJECT_REF,\n });\n\n this.logger = new ManagedRunLogger({\n httpClient: this.httpClient,\n env,\n });\n\n // Create the TaskRunProcessProvider\n this.taskRunProcessProvider = new TaskRunProcessProvider({\n workerManifest: this.workerManifest,\n env: this.env,\n logger: this.logger,\n processKeepAliveEnabled: this.processKeepAliveEnabled,\n processKeepAliveMaxExecutionCount: this.processKeepAliveMaxExecutionCount,\n });\n\n const properties = {\n ...env.rawForLogging,\n TRIGGER_POD_SCHEDULED_AT_MS: env.TRIGGER_POD_SCHEDULED_AT_MS.toISOString(),\n TRIGGER_DEQUEUED_AT_MS: env.TRIGGER_DEQUEUED_AT_MS.toISOString(),\n };\n\n this.sendDebugLog({\n runId: env.TRIGGER_RUN_ID,\n message: \"Creating run controller\",\n properties,\n });\n\n if (env.TRIGGER_WARM_START_URL) {\n this.warmStartClient = new WarmStartClient({\n apiUrl: new URL(env.TRIGGER_WARM_START_URL),\n controllerId: env.TRIGGER_WORKLOAD_CONTROLLER_ID,\n deploymentId: env.TRIGGER_DEPLOYMENT_ID,\n deploymentVersion: env.TRIGGER_DEPLOYMENT_VERSION,\n machineCpu: env.TRIGGER_MACHINE_CPU,\n machineMemory: env.TRIGGER_MACHINE_MEMORY,\n });\n }\n\n // Websocket notifications are only an optimisation so we don't need to wait for a successful connection\n this.socket = this.createSupervisorSocket();\n\n process.on(\"SIGTERM\", async () => {\n this.sendDebugLog({\n runId: this.runFriendlyId,\n message: \"Received SIGTERM, stopping worker\",\n });\n\n // Disable warm starts - prevents new warm start requests\n this.warmStartEnabled = false;\n\n // Abort any ongoing warm start long poll - immediately stops waiting for next run\n // This prevents the scenario where:\n // 1. SIGTERM kills a prepared child process\n // 2. Warm start poll returns a new run\n // 3. Controller tries to use the dead child process\n this.warmStartClient?.abort();\n\n // Now we wait for any active runs to finish gracefully\n // SIGKILL will handle forced termination after termination grace period\n });\n }" pre_fix = " constructor(opts: ManagedRunControllerOptions) {\n const env = new RunnerEnv(opts.env);\n this.env = env;\n\n this.workerManifest = opts.workerManifest;\n this.processKeepAliveEnabled = opts.workerManifest.processKeepAlive?.enabled ?? false;\n this.processKeepAliveMaxExecutionCount =\n opts.workerManifest.processKeepAlive?.maxExecutionsPerProcess ?? 100;\n\n this.httpClient = new WorkloadHttpClient({\n workerApiUrl: this.workerApiUrl,\n runnerId: this.runnerId,\n deploymentId: env.TRIGGER_DEPLOYMENT_ID,\n deploymentVersion: env.TRIGGER_DEPLOYMENT_VERSION,\n projectRef: env.TRIGGER_PROJECT_REF,\n });\n\n this.logger = new ManagedRunLogger({\n httpClient: this.httpClient,\n env,\n });\n\n // Create the TaskRunProcessProvider\n this.taskRunProcessProvider = new TaskRunProcessProvider({\n workerManifest: this.workerManifest,\n env: this.env,\n logger: this.logger,\n processKeepAliveEnabled: this.processKeepAliveEnabled,\n processKeepAliveMaxExecutionCount: this.processKeepAliveMaxExecutionCount,\n });\n\n const properties = {\n ...env.raw,\n TRIGGER_POD_SCHEDULED_AT_MS: env.TRIGGER_POD_SCHEDULED_AT_MS.toISOString(),\n TRIGGER_DEQUEUED_AT_MS: env.TRIGGER_DEQUEUED_AT_MS.toISOString(),\n };\n\n this.sendDebugLog({\n runId: env.TRIGGER_RUN_ID,\n message: \"Creating run controller\",\n properties,\n });\n\n if (env.TRIGGER_WARM_START_URL) {\n this.warmStartClient = new WarmStartClient({\n apiUrl: new URL(env.TRIGGER_WARM_START_URL),\n controllerId: env.TRIGGER_WORKLOAD_CONTROLLER_ID,\n deploymentId: env.TRIGGER_DEPLOYMENT_ID,\n deploymentVersion: env.TRIGGER_DEPLOYMENT_VERSION,\n machineCpu: env.TRIGGER_MACHINE_CPU,\n machineMemory: env.TRIGGER_MACHINE_MEMORY,\n });\n }\n\n // Websocket notifications are only an optimisation so we don't need to wait for a successful connection\n this.socket = this.createSupervisorSocket();\n\n process.on(\"SIGTERM\", async () => {\n this.sendDebugLog({\n runId: this.runFriendlyId,\n message: \"Received SIGTERM, stopping worker\",\n });\n\n // Disable warm starts - prevents new warm start requests\n this.warmStartEnabled = false;\n\n // Abort any ongoing warm start long poll - immediately stops waiting for next run\n // This prevents the scenario where:\n // 1. SIGTERM kills a prepared child process\n // 2. Warm start poll returns a new run\n // 3. Controller tries to use the dead child process\n this.warmStartClient?.abort();\n\n // Now we wait for any active runs to finish gracefully\n // SIGKILL will handle forced termination after termination grace period\n });\n }" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "generateJWT" function_lines = [[13, 37]] id = "triggerdotdev-trigger.dev-7323929a73b6be76" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "packages/core/src/v3/jwt.ts" post_fix = "export async function generateJWT(options: GenerateJWTOptions): Promise {\n const { SignJWT } = await import(\"jose\");\n\n const secret = new TextEncoder().encode(options.secretKey);\n\n const jwt = new SignJWT(options.payload)\n .setIssuer(JWT_ISSUER)\n .setAudience(JWT_AUDIENCE)\n .setProtectedHeader({ alg: JWT_ALGORITHM })\n .setExpirationTime(options.expirationTime ?? \"15m\");\n\n if (!options.omitIssuedAt) {\n jwt.setIssuedAt();\n }\n\n return jwt.sign(secret);\n}\n\nexport type ValidationResult =\n | {\n ok: true;\n payload: JWTPayload;\n }\n | {\n ok: false;\n error: string;\n code: string;\n };\n" pre_fix = "export async function generateJWT(options: GenerateJWTOptions): Promise {\n const { SignJWT } = await import(\"jose\");\n\n const secret = new TextEncoder().encode(options.secretKey);\n\n return new SignJWT(options.payload)\n .setIssuer(JWT_ISSUER)\n .setAudience(JWT_AUDIENCE)\n .setProtectedHeader({ alg: JWT_ALGORITHM })\n .setIssuedAt()\n .setExpirationTime(options.expirationTime ?? \"15m\")\n .sign(secret);\n}\n\nexport type ValidationResult =\n | {\n ok: true;\n payload: JWTPayload;\n }\n | {\n ok: false;\n error: string;\n code: string;\n };\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "getLatestExecutionSnapshot" function_lines = [[199, 221]] id = "triggerdotdev-trigger.dev-816142e126393220" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "internal-packages/run-engine/src/engine/systems/executionSnapshotSystem.ts" post_fix = "export async function getLatestExecutionSnapshot(\n prisma: PrismaClientOrTransaction,\n runId: string,\n runStore?: RunStore,\n environmentId?: string\n): Promise {\n const snapshot = runStore\n ? await runStore.findLatestExecutionSnapshot(runId, prisma, environmentId)\n : await prisma.taskRunExecutionSnapshot.findFirst({\n where: { runId, isValid: true, ...(environmentId ? { environmentId } : {}) },\n include: {\n completedWaitpoints: true,\n checkpoint: true,\n },\n orderBy: { createdAt: \"desc\" },\n });\n\n if (!snapshot) {\n if (environmentId) {\n throw new ServiceValidationError(`No execution snapshot found for TaskRun ${runId}`, 404);\n }\n throw new Error(`No execution snapshot found for TaskRun ${runId}`);\n }\n\n return enhanceExecutionSnapshot(snapshot);\n}\n" pre_fix = "export async function getLatestExecutionSnapshot(\n prisma: PrismaClientOrTransaction,\n runId: string,\n runStore?: RunStore\n): Promise {\n const snapshot = runStore\n ? await runStore.findLatestExecutionSnapshot(runId, prisma)\n : await prisma.taskRunExecutionSnapshot.findFirst({\n where: { runId, isValid: true },\n include: {\n completedWaitpoints: true,\n checkpoint: true,\n },\n orderBy: { createdAt: \"desc\" },\n });\n\n if (!snapshot) {\n throw new Error(`No execution snapshot found for TaskRun ${runId}`);\n }\n\n return enhanceExecutionSnapshot(snapshot);\n}\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "emitSocketLifecycle" function_lines = [[703, 723]] id = "triggerdotdev-trigger.dev-874f7ae9b06d875b" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/workloadServer/index.ts" post_fix = " const emitSocketLifecycle = (\n event: \"run_connected\" | \"run_disconnected\",\n friendlyId: string,\n disconnectReason?: string\n ) => {\n emitOneShot({\n ...this.wideEventOpts,\n op: event === \"run_connected\" ? \"socket.run.connected\" : \"socket.run.disconnected\",\n kind: \"event\",\n populate: (state) => {\n state.extras.event = event;\n setMeta(state, \"run_id\", friendlyId);\n const deploymentId = socket.data.deploymentFriendlyId ?? socket.data.deploymentId;\n if (deploymentId) {\n setMeta(state, \"deployment_id\", deploymentId);\n }\n if (socket.data.runnerId) setMeta(state, \"runner_id\", socket.data.runnerId);\n state.extras.socket_id = socket.id;\n if (disconnectReason) state.extras.disconnect_reason = disconnectReason;\n },\n });\n };" pre_fix = " const emitSocketLifecycle = (\n event: \"run_connected\" | \"run_disconnected\",\n friendlyId: string,\n disconnectReason?: string\n ) => {\n emitOneShot({\n ...this.wideEventOpts,\n op: event === \"run_connected\" ? \"socket.run.connected\" : \"socket.run.disconnected\",\n kind: \"event\",\n populate: (state) => {\n state.extras.event = event;\n setMeta(state, \"run_id\", friendlyId);\n if (socket.data.deploymentId) {\n setMeta(state, \"deployment_id\", socket.data.deploymentId);\n }\n if (socket.data.runnerId) setMeta(state, \"runner_id\", socket.data.runnerId);\n state.extras.socket_id = socket.id;\n if (disconnectReason) state.extras.disconnect_reason = disconnectReason;\n },\n });\n };" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "create" function_lines = [[64, 235]] id = "triggerdotdev-trigger.dev-92c5190a8ba1209d" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/workloadManager/docker.ts" post_fix = " async create(opts: WorkloadManagerCreateOptions) {\n this.logger.verbose(\"create()\", { opts });\n\n const runnerId = getRunnerId(opts.runFriendlyId, opts.nextAttemptNumber);\n\n // Build environment variables\n const envVars: string[] = [\n `OTEL_EXPORTER_OTLP_ENDPOINT=${env.OTEL_EXPORTER_OTLP_ENDPOINT}`,\n `TRIGGER_DEQUEUED_AT_MS=${opts.dequeuedAt.getTime()}`,\n `TRIGGER_POD_SCHEDULED_AT_MS=${Date.now()}`,\n `TRIGGER_ENV_ID=${opts.envId}`,\n `TRIGGER_DEPLOYMENT_ID=${opts.deploymentToken ?? opts.deploymentFriendlyId}`,\n // Plain friendlyId for telemetry (worker.id), so it isn't the opaque token in DEPLOYMENT_ID.\n `TRIGGER_DEPLOYMENT_FRIENDLY_ID=${opts.deploymentFriendlyId}`,\n `TRIGGER_DEPLOYMENT_VERSION=${opts.deploymentVersion}`,\n `TRIGGER_RUN_ID=${opts.runFriendlyId}`,\n `TRIGGER_SNAPSHOT_ID=${opts.snapshotFriendlyId}`,\n `TRIGGER_SUPERVISOR_API_PROTOCOL=${this.opts.workloadApiProtocol}`,\n `TRIGGER_SUPERVISOR_API_PORT=${this.opts.workloadApiPort}`,\n `TRIGGER_SUPERVISOR_API_DOMAIN=${this.opts.workloadApiDomain ?? getDockerHostDomain()}`,\n `TRIGGER_WORKER_INSTANCE_NAME=${env.TRIGGER_WORKER_INSTANCE_NAME}`,\n `TRIGGER_RUNNER_ID=${runnerId}`,\n `TRIGGER_MACHINE_CPU=${opts.machine.cpu}`,\n `TRIGGER_MACHINE_MEMORY=${opts.machine.memory}`,\n `PRETTY_LOGS=${env.RUNNER_PRETTY_LOGS}`,\n `TRIGGER_SEND_RUN_DEBUG_LOGS=${env.SEND_RUN_DEBUG_LOGS}`,\n ];\n\n if (this.opts.warmStartUrl) {\n envVars.push(`TRIGGER_WARM_START_URL=${normalizeDockerHostUrl(this.opts.warmStartUrl)}`);\n }\n\n if (this.opts.metadataUrl) {\n envVars.push(`TRIGGER_METADATA_URL=${this.opts.metadataUrl}`);\n }\n\n if (this.opts.heartbeatIntervalSeconds) {\n envVars.push(`TRIGGER_HEARTBEAT_INTERVAL_SECONDS=${this.opts.heartbeatIntervalSeconds}`);\n }\n\n if (this.opts.snapshotPollIntervalSeconds) {\n envVars.push(\n `TRIGGER_SNAPSHOT_POLL_INTERVAL_SECONDS=${this.opts.snapshotPollIntervalSeconds}`\n );\n }\n\n if (this.opts.additionalEnvVars) {\n Object.entries(this.opts.additionalEnvVars).forEach(([key, value]) => {\n envVars.push(`${key}=${value}`);\n });\n }\n\n const hostConfig: Docker.HostConfig = {\n AutoRemove: !!this.opts.dockerAutoremove,\n };\n\n const [firstNetwork, ...remainingNetworks] = this.runnerNetworks;\n\n // Always attach the first network at container creation time. This has the following benefits:\n // - If there is only a single network to attach, this will prevent having to make a separate request.\n // - If there are multiple networks to attach, this will ensure the runner won't also be connected to the bridge network\n hostConfig.NetworkMode = firstNetwork;\n\n if (env.DOCKER_ENFORCE_MACHINE_PRESETS) {\n hostConfig.NanoCpus = opts.machine.cpu * 1e9;\n hostConfig.Memory = opts.machine.memory * 1024 * 1024 * 1024;\n }\n\n let imageRef = opts.image;\n\n if (env.DOCKER_STRIP_IMAGE_DIGEST) {\n imageRef = opts.image.split(\"@\")[0]!;\n }\n\n const containerCreateOpts: Docker.ContainerCreateOptions = {\n name: runnerId,\n Hostname: runnerId,\n HostConfig: hostConfig,\n Image: imageRef,\n AttachStdout: false,\n AttachStderr: false,\n AttachStdin: false,\n };\n\n if (this.platformOverride) {\n containerCreateOpts.platform = this.platformOverride;\n }\n\n const logger = this.logger.child({ opts, containerCreateOpts });\n\n const [inspectError, inspectResult] = await tryCatch(this.docker.getImage(imageRef).inspect());\n\n let shouldPull = !!inspectError;\n if (this.platformOverride) {\n const imageArchitecture = inspectResult?.Architecture;\n\n // When the image architecture doesn't match the platform, we need to pull the image\n if (imageArchitecture && !this.platformOverride.includes(imageArchitecture)) {\n shouldPull = true;\n }\n }\n\n // If the image is not present, try to pull it\n if (shouldPull) {\n logger.info(\"Pulling image\", {\n error: inspectError,\n image: opts.image,\n targetPlatform: this.platformOverride,\n imageArchitecture: inspectResult?.Architecture,\n });\n\n // Get auth config (static or ECR)\n const authConfig = await this.getAuthConfig();\n\n // Ensure the image is present\n const [createImageError, imageResponseReader] = await tryCatch(\n this.docker.createImage(authConfig, {\n fromImage: imageRef,\n ...(this.platformOverride ? { platform: this.platformOverride } : {}),\n })\n );\n if (createImageError) {\n logger.error(\"Failed to pull image\", { error: createImageError });\n return;\n }\n\n const [imageReadError, imageResponse] = await tryCatch(readAllChunks(imageResponseReader));\n if (imageReadError) {\n logger.error(\"failed to read image response\", { error: imageReadError });\n return;\n }\n\n logger.debug(\"pulled image\", { image: opts.image, imageResponse });\n } else {\n // Image is present, so we can use it to create the container\n }\n\n // Create container\n const [createContainerError, container] = await tryCatch(\n this.docker.createContainer({\n ...containerCreateOpts,\n // Add env vars here so they're not logged\n Env: envVars,\n })\n );\n\n if (createContainerError) {\n logger.error(\"Failed to create container\", { error: createContainerError });\n return;\n }\n\n // If there are multiple networks to attach to we need to attach the remaining ones after creation\n if (remainingNetworks.length > 0) {\n await this.attachContainerToNetworks({\n containerId: container.id,\n networkNames: remainingNetworks,\n });\n }\n\n // Start container\n const [startError, startResult] = await tryCatch(container.start());\n\n if (startError) {\n logger.error(\"Failed to start container\", { error: startError, containerId: container.id });\n return;\n }\n\n logger.debug(\"create succeeded\", { startResult, containerId: container.id });\n }\n\n /**\n * Get authentication config for Docker operations\n * Uses static credentials if available, otherwise attempts ECR auth\n */" pre_fix = " async create(opts: WorkloadManagerCreateOptions) {\n this.logger.verbose(\"create()\", { opts });\n\n const runnerId = getRunnerId(opts.runFriendlyId, opts.nextAttemptNumber);\n\n // Build environment variables\n const envVars: string[] = [\n `OTEL_EXPORTER_OTLP_ENDPOINT=${env.OTEL_EXPORTER_OTLP_ENDPOINT}`,\n `TRIGGER_DEQUEUED_AT_MS=${opts.dequeuedAt.getTime()}`,\n `TRIGGER_POD_SCHEDULED_AT_MS=${Date.now()}`,\n `TRIGGER_ENV_ID=${opts.envId}`,\n `TRIGGER_DEPLOYMENT_ID=${opts.deploymentFriendlyId}`,\n `TRIGGER_DEPLOYMENT_VERSION=${opts.deploymentVersion}`,\n `TRIGGER_RUN_ID=${opts.runFriendlyId}`,\n `TRIGGER_SNAPSHOT_ID=${opts.snapshotFriendlyId}`,\n `TRIGGER_SUPERVISOR_API_PROTOCOL=${this.opts.workloadApiProtocol}`,\n `TRIGGER_SUPERVISOR_API_PORT=${this.opts.workloadApiPort}`,\n `TRIGGER_SUPERVISOR_API_DOMAIN=${this.opts.workloadApiDomain ?? getDockerHostDomain()}`,\n `TRIGGER_WORKER_INSTANCE_NAME=${env.TRIGGER_WORKER_INSTANCE_NAME}`,\n `TRIGGER_RUNNER_ID=${runnerId}`,\n `TRIGGER_MACHINE_CPU=${opts.machine.cpu}`,\n `TRIGGER_MACHINE_MEMORY=${opts.machine.memory}`,\n `PRETTY_LOGS=${env.RUNNER_PRETTY_LOGS}`,\n `TRIGGER_SEND_RUN_DEBUG_LOGS=${env.SEND_RUN_DEBUG_LOGS}`,\n ];\n\n if (this.opts.warmStartUrl) {\n envVars.push(`TRIGGER_WARM_START_URL=${normalizeDockerHostUrl(this.opts.warmStartUrl)}`);\n }\n\n if (this.opts.metadataUrl) {\n envVars.push(`TRIGGER_METADATA_URL=${this.opts.metadataUrl}`);\n }\n\n if (this.opts.heartbeatIntervalSeconds) {\n envVars.push(`TRIGGER_HEARTBEAT_INTERVAL_SECONDS=${this.opts.heartbeatIntervalSeconds}`);\n }\n\n if (this.opts.snapshotPollIntervalSeconds) {\n envVars.push(\n `TRIGGER_SNAPSHOT_POLL_INTERVAL_SECONDS=${this.opts.snapshotPollIntervalSeconds}`\n );\n }\n\n if (this.opts.additionalEnvVars) {\n Object.entries(this.opts.additionalEnvVars).forEach(([key, value]) => {\n envVars.push(`${key}=${value}`);\n });\n }\n\n const hostConfig: Docker.HostConfig = {\n AutoRemove: !!this.opts.dockerAutoremove,\n };\n\n const [firstNetwork, ...remainingNetworks] = this.runnerNetworks;\n\n // Always attach the first network at container creation time. This has the following benefits:\n // - If there is only a single network to attach, this will prevent having to make a separate request.\n // - If there are multiple networks to attach, this will ensure the runner won't also be connected to the bridge network\n hostConfig.NetworkMode = firstNetwork;\n\n if (env.DOCKER_ENFORCE_MACHINE_PRESETS) {\n hostConfig.NanoCpus = opts.machine.cpu * 1e9;\n hostConfig.Memory = opts.machine.memory * 1024 * 1024 * 1024;\n }\n\n let imageRef = opts.image;\n\n if (env.DOCKER_STRIP_IMAGE_DIGEST) {\n imageRef = opts.image.split(\"@\")[0]!;\n }\n\n const containerCreateOpts: Docker.ContainerCreateOptions = {\n name: runnerId,\n Hostname: runnerId,\n HostConfig: hostConfig,\n Image: imageRef,\n AttachStdout: false,\n AttachStderr: false,\n AttachStdin: false,\n };\n\n if (this.platformOverride) {\n containerCreateOpts.platform = this.platformOverride;\n }\n\n const logger = this.logger.child({ opts, containerCreateOpts });\n\n const [inspectError, inspectResult] = await tryCatch(this.docker.getImage(imageRef).inspect());\n\n let shouldPull = !!inspectError;\n if (this.platformOverride) {\n const imageArchitecture = inspectResult?.Architecture;\n\n // When the image architecture doesn't match the platform, we need to pull the image\n if (imageArchitecture && !this.platformOverride.includes(imageArchitecture)) {\n shouldPull = true;\n }\n }\n\n // If the image is not present, try to pull it\n if (shouldPull) {\n logger.info(\"Pulling image\", {\n error: inspectError,\n image: opts.image,\n targetPlatform: this.platformOverride,\n imageArchitecture: inspectResult?.Architecture,\n });\n\n // Get auth config (static or ECR)\n const authConfig = await this.getAuthConfig();\n\n // Ensure the image is present\n const [createImageError, imageResponseReader] = await tryCatch(\n this.docker.createImage(authConfig, {\n fromImage: imageRef,\n ...(this.platformOverride ? { platform: this.platformOverride } : {}),\n })\n );\n if (createImageError) {\n logger.error(\"Failed to pull image\", { error: createImageError });\n return;\n }\n\n const [imageReadError, imageResponse] = await tryCatch(readAllChunks(imageResponseReader));\n if (imageReadError) {\n logger.error(\"failed to read image response\", { error: imageReadError });\n return;\n }\n\n logger.debug(\"pulled image\", { image: opts.image, imageResponse });\n } else {\n // Image is present, so we can use it to create the container\n }\n\n // Create container\n const [createContainerError, container] = await tryCatch(\n this.docker.createContainer({\n ...containerCreateOpts,\n // Add env vars here so they're not logged\n Env: envVars,\n })\n );\n\n if (createContainerError) {\n logger.error(\"Failed to create container\", { error: createContainerError });\n return;\n }\n\n // If there are multiple networks to attach to we need to attach the remaining ones after creation\n if (remainingNetworks.length > 0) {\n await this.attachContainerToNetworks({\n containerId: container.id,\n networkNames: remainingNetworks,\n });\n }\n\n // Start container\n const [startError, startResult] = await tryCatch(container.start());\n\n if (startError) {\n logger.error(\"Failed to start container\", { error: startError, containerId: container.id });\n return;\n }\n\n logger.debug(\"create succeeded\", { startResult, containerId: container.id });\n }\n\n /**\n * Get authentication config for Docker operations\n * Uses static credentials if available, otherwise attempts ECR auth\n */" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "runDisconnected" function_lines = [[744, 838]] id = "triggerdotdev-trigger.dev-984189f717b2a3da" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/workloadServer/index.ts" post_fix = " const runDisconnected = (friendlyId: string, reason: string) => {\n socketLogger.debug(\"runDisconnected\", { ...getSocketMetadata() });\n\n // A newer socket may have taken over this run (same-runner reconnect race). If the\n // run is now bound to a different socket, this stale socket must not clear the fresh\n // binding or emit a spurious disconnect - just drop its own reference and bail.\n const bound = this.runSockets.get(friendlyId);\n if (bound && bound.id !== socket.id) {\n socketLogger.debug(\"runDisconnected: run rebound to another socket, skipping\", {\n ...getSocketMetadata(),\n friendlyId,\n boundSocketId: bound.id,\n });\n if (socket.data.runFriendlyId === friendlyId) {\n socket.data.runFriendlyId = undefined;\n }\n return;\n }\n\n // The run is gone from this runner (crash, exit, or replaced by a new\n // run), so a pending delayed snapshot for it is stale. Genuine\n // waitpoint suspensions keep the socket connected, so this doesn't\n // cancel a snapshot that's still wanted; the runnerId match guards\n // against a stale duplicate runner cancelling a fresh runner's\n // snapshot after the run was reassigned. Caveat: socket.data.runnerId\n // is frozen at the websocket handshake, so after a same-supervisor\n // restore (new runner id, socket not recreated) this guard refuses\n // the cancel - a missed cancel, never a wrong one. The\n // attempt.complete cancel uses the runner's current HTTP header id\n // and is unaffected.\n this.snapshotService?.cancel(friendlyId, socket.data.runnerId);\n\n this.runSockets.delete(friendlyId);\n this.emit(\"runDisconnected\", { run: { friendlyId } });\n socket.data.runFriendlyId = undefined;\n emitSocketLifecycle(\"run_disconnected\", friendlyId, reason);\n };\n\n socketLogger.debug(\"wsServer socket connected\", { ...getSocketMetadata() });\n\n // FIXME: where does this get set?\n if (socket.data.runFriendlyId) {\n runConnected(socket.data.runFriendlyId);\n }\n\n socket.on(\"disconnecting\", (reason, description) => {\n socketLogger.verbose(\"Socket disconnecting\", {\n ...getSocketMetadata(),\n reason,\n description,\n });\n\n if (socket.data.runFriendlyId) {\n runDisconnected(socket.data.runFriendlyId, `socket_disconnecting:${reason}`);\n }\n });\n\n socket.on(\"disconnect\", (reason, description) => {\n socketLogger.debug(\"Socket disconnected\", { ...getSocketMetadata(), reason, description });\n });\n\n socket.on(\"error\", (error) => {\n socketLogger.error(\"Socket error\", {\n ...getSocketMetadata(),\n error: {\n name: error.name,\n message: error.message,\n stack: error.stack,\n },\n });\n });\n\n socket.on(\"run:start\", async (message) => {\n const log = socketLogger.child({\n eventName: \"run:start\",\n ...getSocketMetadata(),\n ...message,\n });\n\n log.debug(\"Handling run:start\");\n\n try {\n runConnected(message.run.friendlyId);\n } catch (error) {\n log.error(\"run:start error\", { error });\n }\n });\n\n socket.on(\"run:stop\", async (message) => {\n const log = socketLogger.child({\n eventName: \"run:stop\",\n ...getSocketMetadata(),\n ...message,\n });\n\n log.debug(\"Handling run:stop\");\n\n try {\n runDisconnected(message.run.friendlyId, \"run_stop_message\");\n // Don't delete trace context here - run:stop fires after each snapshot/shutdown\n // but the run may be restored on a new VM and snapshot again. Trace context is\n // re-populated on dequeue, and entries are small (4 strings per run).\n } catch (error) {\n log.error(\"run:stop error\", { error });\n }\n });\n });\n\n return websocketServer;\n }\n" pre_fix = " const runDisconnected = (friendlyId: string, reason: string) => {\n socketLogger.debug(\"runDisconnected\", { ...getSocketMetadata() });\n\n // The run is gone from this runner (crash, exit, or replaced by a new\n // run), so a pending delayed snapshot for it is stale. Genuine\n // waitpoint suspensions keep the socket connected, so this doesn't\n // cancel a snapshot that's still wanted; the runnerId match guards\n // against a stale duplicate runner cancelling a fresh runner's\n // snapshot after the run was reassigned. Caveat: socket.data.runnerId\n // is frozen at the websocket handshake, so after a same-supervisor\n // restore (new runner id, socket not recreated) this guard refuses\n // the cancel - a missed cancel, never a wrong one. The\n // attempt.complete cancel uses the runner's current HTTP header id\n // and is unaffected.\n this.snapshotService?.cancel(friendlyId, socket.data.runnerId);\n\n this.runSockets.delete(friendlyId);\n this.emit(\"runDisconnected\", { run: { friendlyId } });\n socket.data.runFriendlyId = undefined;\n emitSocketLifecycle(\"run_disconnected\", friendlyId, reason);\n };\n\n socketLogger.debug(\"wsServer socket connected\", { ...getSocketMetadata() });\n\n // FIXME: where does this get set?\n if (socket.data.runFriendlyId) {\n runConnected(socket.data.runFriendlyId);\n }\n\n socket.on(\"disconnecting\", (reason, description) => {\n socketLogger.verbose(\"Socket disconnecting\", {\n ...getSocketMetadata(),\n reason,\n description,\n });\n\n if (socket.data.runFriendlyId) {\n runDisconnected(socket.data.runFriendlyId, `socket_disconnecting:${reason}`);\n }\n });\n\n socket.on(\"disconnect\", (reason, description) => {\n socketLogger.debug(\"Socket disconnected\", { ...getSocketMetadata(), reason, description });\n });\n\n socket.on(\"error\", (error) => {\n socketLogger.error(\"Socket error\", {\n ...getSocketMetadata(),\n error: {\n name: error.name,\n message: error.message,\n stack: error.stack,\n },\n });\n });\n\n socket.on(\"run:start\", async (message) => {\n const log = socketLogger.child({\n eventName: \"run:start\",\n ...getSocketMetadata(),\n ...message,\n });\n\n log.debug(\"Handling run:start\");\n\n try {\n runConnected(message.run.friendlyId);\n } catch (error) {\n log.error(\"run:start error\", { error });\n }\n });\n\n socket.on(\"run:stop\", async (message) => {\n const log = socketLogger.child({\n eventName: \"run:stop\",\n ...getSocketMetadata(),\n ...message,\n });\n\n log.debug(\"Handling run:stop\");\n\n try {\n runDisconnected(message.run.friendlyId, \"run_stop_message\");\n // Don't delete trace context here - run:stop fires after each snapshot/shutdown\n // but the run may be restored on a new VM and snapshot again. Trace context is\n // re-populated on dequeue, and entries are small (4 strings per run).\n } catch (error) {\n log.error(\"run:stop error\", { error });\n }\n });\n });\n\n return websocketServer;\n }\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "updateGitHubAppInstallation" function_lines = [[63, 103]] id = "triggerdotdev-trigger.dev-99347f6b51258e29" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/services/gitHub.server.ts" post_fix = "export async function updateGitHubAppInstallation(\n installationId: number,\n organizationId: string\n): Promise {\n if (!githubApp) {\n throw new Error(\"GitHub App is not enabled\");\n }\n\n // Scope the lookup to the caller's organization so a cross-tenant\n // installation_id cannot update another org's record. Resolve ownership\n // before calling GitHub to avoid burning the victim's API rate limit.\n const existingInstallation = await prisma.githubAppInstallation.findFirst({\n where: { appInstallationId: installationId, organizationId },\n });\n\n if (!existingInstallation) {\n throw new Error(\"GitHub App installation not found\");\n }\n\n const octokit = await githubApp.getInstallationOctokit(installationId);\n const { data: installation } = await octokit.rest.apps.getInstallation({\n installation_id: installationId,\n });\n\n const repositorySelection = installation.repository_selection === \"all\" ? \"ALL\" : \"SELECTED\";\n\n // repos are updated asynchronously via webhook events\n await prisma.githubAppInstallation.update({\n where: { id: existingInstallation?.id },\n data: {\n appInstallationId: installationId,\n targetId: installation.target_id,\n targetType: installation.target_type,\n accountHandle: installation.account\n ? \"login\" in installation.account\n ? installation.account.login\n : \"slug\" in installation.account\n ? installation.account.slug\n : \"-\"\n : \"-\",\n permissions: installation.permissions,\n suspendedAt: existingInstallation?.suspendedAt,\n repositorySelection,\n },\n });\n}\n" pre_fix = "export async function updateGitHubAppInstallation(installationId: number): Promise {\n if (!githubApp) {\n throw new Error(\"GitHub App is not enabled\");\n }\n\n const octokit = await githubApp.getInstallationOctokit(installationId);\n const { data: installation } = await octokit.rest.apps.getInstallation({\n installation_id: installationId,\n });\n\n const existingInstallation = await prisma.githubAppInstallation.findFirst({\n where: { appInstallationId: installationId },\n });\n\n if (!existingInstallation) {\n throw new Error(\"GitHub App installation not found\");\n }\n\n const repositorySelection = installation.repository_selection === \"all\" ? \"ALL\" : \"SELECTED\";\n\n // repos are updated asynchronously via webhook events\n await prisma.githubAppInstallation.update({\n where: { id: existingInstallation?.id },\n data: {\n appInstallationId: installationId,\n targetId: installation.target_id,\n targetType: installation.target_type,\n accountHandle: installation.account\n ? \"login\" in installation.account\n ? installation.account.login\n : \"slug\" in installation.account\n ? installation.account.slug\n : \"-\"\n : \"-\",\n permissions: installation.permissions,\n suspendedAt: existingInstallation?.suspendedAt,\n repositorySelection,\n },\n });\n}\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "constructor" function_lines = [[52, 72]] id = "triggerdotdev-trigger.dev-a20e065c9b6ced3b" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/services/computeSnapshotService.ts" post_fix = " constructor(opts: ComputeSnapshotServiceOptions) {\n this.computeManager = opts.computeManager;\n this.workerClient = opts.workerClient;\n this.tracing = opts.tracing;\n this.wideEventOpts = opts.wideEventOpts;\n\n // Reject an empty secret up front: an empty HMAC key would make callback\n // tokens forgeable by anyone. Guarding here (rather than only at env parse)\n // also covers the case where the secret is read from an empty file.\n if (!opts.snapshotCallbackSecret) {\n throw new Error(\"snapshotCallbackSecret must not be empty\");\n }\n // Derive a dedicated key by domain separation so the raw secret is never\n // used directly as a MAC key for this protocol.\n this.snapshotCallbackKey = createHmac(\"sha256\", opts.snapshotCallbackSecret)\n .update(SNAPSHOT_CALLBACK_KEY_INFO)\n .digest();\n\n this.dispatchLimit = pLimit(this.computeManager.snapshotDispatchLimit);\n this.timerWheel = new TimerWheel({\n delayMs: this.computeManager.snapshotDelayMs,\n onExpire: (item) => {\n this.dispatchLimit(() => this.dispatch(item.data)).catch((error) => {\n this.logger.error(\"Snapshot dispatch failed\", {\n runId: item.data.runFriendlyId,\n runnerId: item.data.runnerId,\n error,\n });\n });\n },\n });\n this.timerWheel.start();\n }" pre_fix = " constructor(opts: ComputeSnapshotServiceOptions) {\n this.computeManager = opts.computeManager;\n this.workerClient = opts.workerClient;\n this.tracing = opts.tracing;\n this.wideEventOpts = opts.wideEventOpts;\n\n this.dispatchLimit = pLimit(this.computeManager.snapshotDispatchLimit);\n this.timerWheel = new TimerWheel({\n delayMs: this.computeManager.snapshotDelayMs,\n onExpire: (item) => {\n this.dispatchLimit(() => this.dispatch(item.data)).catch((error) => {\n this.logger.error(\"Snapshot dispatch failed\", {\n runId: item.data.runFriendlyId,\n runnerId: item.data.runnerId,\n error,\n });\n });\n },\n });\n this.timerWheel.start();\n }" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "unflattenAttributes" function_lines = [[247, 345]] id = "triggerdotdev-trigger.dev-b2314fca2554ca64" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "packages/core/src/v3/utils/flattenAttributes.ts" post_fix = "export function unflattenAttributes(\n obj: Attributes,\n filteredKeys?: string[],\n maxDepth: number = DEFAULT_MAX_DEPTH\n): Record | string | number | boolean | null | undefined {\n if (typeof obj !== \"object\" || obj === null || Array.isArray(obj)) {\n return obj;\n }\n\n if (\n typeof obj === \"object\" &&\n obj !== null &&\n Object.keys(obj).length === 1 &&\n Object.keys(obj)[0] === \"\"\n ) {\n return rehydrateNull(obj[\"\"]) as any;\n }\n\n if (Object.keys(obj).length === 0) {\n return;\n }\n\n const result: Record = {};\n\n for (const [key, value] of Object.entries(obj)) {\n if (filteredKeys?.includes(key)) {\n continue;\n }\n\n const parts = key.split(\".\").reduce(\n (acc, part) => {\n if (part.startsWith(\"[\") && part.endsWith(\"]\")) {\n // Handle array indices more precisely\n const match = part.match(/^\\[(\\d+)\\]$/);\n if (match && match[1]) {\n acc.push(parseInt(match[1]));\n } else {\n // Remove brackets for non-numeric array keys\n acc.push(part.slice(1, -1));\n }\n } else {\n acc.push(part);\n }\n return acc;\n },\n [] as (string | number)[]\n );\n\n // Skip keys that exceed max depth to prevent memory exhaustion\n if (parts.length > maxDepth) {\n continue;\n }\n\n // Skip any key whose path could walk into Object.prototype.\n if (parts.includes(PROTOTYPE_POLLUTION_KEY)) {\n continue;\n }\n\n let current: any = result;\n for (let i = 0; i < parts.length - 1; i++) {\n const part = parts[i];\n const nextPart = parts[i + 1];\n\n if (!part && part !== 0) {\n continue;\n }\n\n if (typeof nextPart === \"number\") {\n if (!Array.isArray(current[part])) {\n current[part] = [];\n }\n } else if (\n current[part] === null ||\n typeof current[part] !== \"object\" ||\n Array.isArray(current[part])\n ) {\n // Last-write-wins when a prior key wrote a primitive, null, or array\n // at this slot — keeps unflatten total for conflicting OTLP inputs.\n current[part] = {};\n }\n\n current = current[part];\n }\n\n const lastPart = parts[parts.length - 1];\n\n if (lastPart !== undefined) {\n current[lastPart] = rehydrateNull(rehydrateCircular(value));\n }\n }\n\n // Convert the result to an array if all top-level keys are numeric indices.\n // Guard against an empty result (e.g. every key was skipped as unsafe), which\n // would otherwise produce Array(-Infinity) and throw.\n if (Object.keys(result).length > 0 && Object.keys(result).every((k) => /^\\d+$/.test(k))) {\n const maxIndex = Math.max(...Object.keys(result).map((k) => parseInt(k)));\n const arrayResult = Array(maxIndex + 1);\n for (const key in result) {\n arrayResult[parseInt(key)] = result[key];\n }\n return arrayResult as any;\n }\n\n return result;\n}\n" pre_fix = "export function unflattenAttributes(\n obj: Attributes,\n filteredKeys?: string[],\n maxDepth: number = DEFAULT_MAX_DEPTH\n): Record | string | number | boolean | null | undefined {\n if (typeof obj !== \"object\" || obj === null || Array.isArray(obj)) {\n return obj;\n }\n\n if (\n typeof obj === \"object\" &&\n obj !== null &&\n Object.keys(obj).length === 1 &&\n Object.keys(obj)[0] === \"\"\n ) {\n return rehydrateNull(obj[\"\"]) as any;\n }\n\n if (Object.keys(obj).length === 0) {\n return;\n }\n\n const result: Record = {};\n\n for (const [key, value] of Object.entries(obj)) {\n if (filteredKeys?.includes(key)) {\n continue;\n }\n\n const parts = key.split(\".\").reduce(\n (acc, part) => {\n if (part.startsWith(\"[\") && part.endsWith(\"]\")) {\n // Handle array indices more precisely\n const match = part.match(/^\\[(\\d+)\\]$/);\n if (match && match[1]) {\n acc.push(parseInt(match[1]));\n } else {\n // Remove brackets for non-numeric array keys\n acc.push(part.slice(1, -1));\n }\n } else {\n acc.push(part);\n }\n return acc;\n },\n [] as (string | number)[]\n );\n\n // Skip keys that exceed max depth to prevent memory exhaustion\n if (parts.length > maxDepth) {\n continue;\n }\n\n let current: any = result;\n for (let i = 0; i < parts.length - 1; i++) {\n const part = parts[i];\n const nextPart = parts[i + 1];\n\n if (!part && part !== 0) {\n continue;\n }\n\n if (typeof nextPart === \"number\") {\n if (!Array.isArray(current[part])) {\n current[part] = [];\n }\n } else if (\n current[part] === null ||\n typeof current[part] !== \"object\" ||\n Array.isArray(current[part])\n ) {\n // Last-write-wins when a prior key wrote a primitive, null, or array\n // at this slot — keeps unflatten total for conflicting OTLP inputs.\n current[part] = {};\n }\n\n current = current[part];\n }\n\n const lastPart = parts[parts.length - 1];\n\n if (lastPart !== undefined) {\n current[lastPart] = rehydrateNull(rehydrateCircular(value));\n }\n }\n\n // Convert the result to an array if all top-level keys are numeric indices\n if (Object.keys(result).every((k) => /^\\d+$/.test(k))) {\n const maxIndex = Math.max(...Object.keys(result).map((k) => parseInt(k)));\n const arrayResult = Array(maxIndex + 1);\n for (const key in result) {\n arrayResult[parseInt(key)] = result[key];\n }\n return arrayResult as any;\n }\n\n return result;\n}\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "getPersonalAccessToken" function_lines = [[401, 431]] id = "triggerdotdev-trigger.dev-b8f3fea0ac68f12c" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "packages/cli-v3/src/commands/login.ts" post_fix = "export async function getPersonalAccessToken(apiClient: CliApiClient, authorizationCode: string) {\n return await tracer.startActiveSpan(\"getPersonalAccessToken\", async (span) => {\n try {\n const token = await apiClient.getPersonalAccessToken(authorizationCode);\n\n if (!token.success) {\n // A 429 from the per-code poll rate limiter is transient: the auth code\n // is still valid and the user may just not have approved the consent\n // screen yet. Throw a regular (retryable) error so the poll loop backs\n // off and keeps polling, rather than an AbortError, which pRetry treats\n // as fatal and would abandon the whole login.\n if (token.statusCode === 429) {\n throw new Error(token.error);\n }\n\n throw new AbortError(token.error);\n }\n\n if (!token.data.token) {\n throw new Error(\"No token found yet\");\n }\n\n span.end();\n\n return {\n token: token.data.token.token,\n obfuscatedToken: token.data.token.obfuscatedToken,\n };\n } catch (e) {\n if (e instanceof AbortError) {\n recordSpanException(span, e);\n }\n\n span.end();\n\n throw e;\n }\n });\n}\n" pre_fix = "export async function getPersonalAccessToken(apiClient: CliApiClient, authorizationCode: string) {\n return await tracer.startActiveSpan(\"getPersonalAccessToken\", async (span) => {\n try {\n const token = await apiClient.getPersonalAccessToken(authorizationCode);\n\n if (!token.success) {\n throw new AbortError(token.error);\n }\n\n if (!token.data.token) {\n throw new Error(\"No token found yet\");\n }\n\n span.end();\n\n return {\n token: token.data.token.token,\n obfuscatedToken: token.data.token.obfuscatedToken,\n };\n } catch (e) {\n if (e instanceof AbortError) {\n recordSpanException(span, e);\n }\n\n span.end();\n\n throw e;\n }\n });\n}\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "action" function_lines = [[20, 122]] id = "triggerdotdev-trigger.dev-ca2ef47f420ef2eb" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/routes/api.v1.schedules.$scheduleId.ts" post_fix = "export async function action({ request, params }: ActionFunctionArgs) {\n // Authenticate the request\n const authenticationResult = await authenticateApiRequest(request);\n\n if (!authenticationResult) {\n return json({ error: \"Invalid or Missing API Key\" }, { status: 401 });\n }\n\n const parsedParams = ParamsSchema.safeParse(params);\n\n if (!parsedParams.success) {\n return json(\n { error: \"Invalid request parameters\", issues: parsedParams.error.issues },\n { status: 400 }\n );\n }\n\n const method = request.method.toUpperCase();\n\n switch (method) {\n case \"DELETE\": {\n const visibility = await getScheduleEnvVisibility(\n prisma,\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId,\n authenticationResult.environment.id\n );\n if (visibility.status !== \"visible\") {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n try {\n const deletedSchedule = await prisma.taskSchedule.delete({\n where: scheduleUniqWhereClause(\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId\n ),\n });\n\n return json(\n {\n id: deletedSchedule.friendlyId,\n },\n { status: 200 }\n );\n } catch (error) {\n // Check if it's a Prisma error\n if (error instanceof Prisma.PrismaClientKnownRequestError) {\n return json(\n {\n error: error.code === \"P2025\" ? \"Schedule not found\" : clientSafeErrorMessage(error),\n },\n { status: error.code === \"P2025\" ? 404 : 422 }\n );\n } else {\n logger.error(\"Failed to delete schedule\", { error });\n return json({ error: \"Something went wrong, please try again.\" }, { status: 500 });\n }\n }\n }\n case \"PUT\": {\n const rawBody = await request.json();\n\n const body = UpdateScheduleOptions.safeParse(rawBody);\n\n if (!body.success) {\n return json({ error: \"Invalid request body\", issues: body.error.issues }, { status: 400 });\n }\n\n // Env-scoped API keys can't see or mutate a schedule whose\n // instances live in a different environment. \"hidden\" → refuse;\n // \"missing\" → fall through to the upsert's create path.\n const visibility = await getScheduleEnvVisibility(\n prisma,\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId,\n authenticationResult.environment.id\n );\n if (visibility.status === \"hidden\") {\n return json({ error: \"Schedule not found\" }, { status: 404 });\n }\n\n const service = new UpsertTaskScheduleService();\n\n try {\n const options: UpsertSchedule = {\n friendlyId: parsedParams.data.scheduleId,\n taskIdentifier: body.data.task,\n cron: body.data.cron,\n timezone: body.data.timezone,\n environments: [authenticationResult.environment.id],\n externalId: body.data.externalId,\n };\n\n const schedule = await service.call(authenticationResult.environment.projectId, options);\n\n const responseObject: ScheduleObject = {\n id: schedule.id,\n type: schedule.type,\n task: schedule.task,\n active: schedule.active,\n generator: {\n type: \"CRON\",\n expression: schedule.cron,\n description: schedule.cronDescription,\n },\n timezone: schedule.timezone,\n externalId: schedule.externalId ?? undefined,\n deduplicationKey: schedule.deduplicationKey,\n environments: schedule.environments,\n nextRun: schedule.nextRun,\n };\n\n return json(responseObject, { status: 200 });\n } catch (error) {\n if (error instanceof ServiceValidationError) {\n return json({ error: error.message }, { status: 422 });\n }\n\n logger.error(\"Failed to upsert schedule\", { error });\n return json({ error: \"Something went wrong, please try again.\" }, { status: 500 });\n }\n }\n }\n}\n" pre_fix = "export async function action({ request, params }: ActionFunctionArgs) {\n // Authenticate the request\n const authenticationResult = await authenticateApiRequest(request);\n\n if (!authenticationResult) {\n return json({ error: \"Invalid or Missing API Key\" }, { status: 401 });\n }\n\n const parsedParams = ParamsSchema.safeParse(params);\n\n if (!parsedParams.success) {\n return json(\n { error: \"Invalid request parameters\", issues: parsedParams.error.issues },\n { status: 400 }\n );\n }\n\n const method = request.method.toUpperCase();\n\n switch (method) {\n case \"DELETE\": {\n try {\n const deletedSchedule = await prisma.taskSchedule.delete({\n where: scheduleUniqWhereClause(\n authenticationResult.environment.projectId,\n parsedParams.data.scheduleId\n ),\n });\n\n return json(\n {\n id: deletedSchedule.friendlyId,\n },\n { status: 200 }\n );\n } catch (error) {\n // Check if it's a Prisma error\n if (error instanceof Prisma.PrismaClientKnownRequestError) {\n return json(\n {\n error: error.code === \"P2025\" ? \"Schedule not found\" : clientSafeErrorMessage(error),\n },\n { status: error.code === \"P2025\" ? 404 : 422 }\n );\n } else {\n logger.error(\"Failed to delete schedule\", { error });\n return json({ error: \"Something went wrong, please try again.\" }, { status: 500 });\n }\n }\n }\n case \"PUT\": {\n const rawBody = await request.json();\n\n const body = UpdateScheduleOptions.safeParse(rawBody);\n\n if (!body.success) {\n return json({ error: \"Invalid request body\", issues: body.error.issues }, { status: 400 });\n }\n\n const service = new UpsertTaskScheduleService();\n\n try {\n const options: UpsertSchedule = {\n friendlyId: parsedParams.data.scheduleId,\n taskIdentifier: body.data.task,\n cron: body.data.cron,\n timezone: body.data.timezone,\n environments: [authenticationResult.environment.id],\n externalId: body.data.externalId,\n };\n\n const schedule = await service.call(authenticationResult.environment.projectId, options);\n\n const responseObject: ScheduleObject = {\n id: schedule.id,\n type: schedule.type,\n task: schedule.task,\n active: schedule.active,\n generator: {\n type: \"CRON\",\n expression: schedule.cron,\n description: schedule.cronDescription,\n },\n timezone: schedule.timezone,\n externalId: schedule.externalId ?? undefined,\n deduplicationKey: schedule.deduplicationKey,\n environments: schedule.environments,\n nextRun: schedule.nextRun,\n };\n\n return json(responseObject, { status: 200 });\n } catch (error) {\n if (error instanceof ServiceValidationError) {\n return json({ error: error.message }, { status: 422 });\n }\n\n logger.error(\"Failed to upsert schedule\", { error });\n return json({ error: \"Something went wrong, please try again.\" }, { status: 500 });\n }\n }\n }\n}\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "action" function_lines = [[66, 183]] id = "triggerdotdev-trigger.dev-d7690485d67bf995" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.schedules.$scheduleParam/route.tsx" post_fix = "export const action = async ({ request, params }: ActionFunctionArgs) => {\n const userId = await requireUserId(request);\n const { organizationSlug, projectParam, envParam, scheduleParam } =\n v3ScheduleParams.parse(params);\n\n const formData = await request.formData();\n const submission = parseWithZod(formData, { schema });\n\n if (submission.status !== \"success\") {\n return json(submission.reply());\n }\n\n // `_format=json` → return JSON instead of redirecting; caller stays put.\n const wantsJson = formData.get(\"_format\") === \"json\";\n\n const project = await findProjectBySlug(organizationSlug, projectParam, userId);\n\n if (!project) {\n const message = `No project found with slug ${projectParam}`;\n if (wantsJson) {\n return json({ ok: false as const, message }, { status: 404 });\n }\n return redirectWithErrorMessage(\n v3SchedulePath(\n { slug: organizationSlug },\n { slug: projectParam },\n { slug: envParam },\n { friendlyId: scheduleParam }\n ),\n request,\n message\n );\n }\n\n switch (submission.value.action) {\n case \"delete\": {\n const deleteService = new DeleteTaskScheduleService();\n try {\n await deleteService.call({\n projectId: project.id,\n userId,\n friendlyId: scheduleParam,\n });\n if (wantsJson) {\n return json({ ok: true as const, message: `${scheduleParam} deleted` });\n }\n return redirectWithSuccessMessage(\n v3EnvironmentPath({ slug: organizationSlug }, { slug: projectParam }, { slug: envParam }),\n request,\n `${scheduleParam} deleted`\n );\n } catch (e) {\n const message = `${scheduleParam} could not be deleted: ${\n e instanceof Error ? e.message : JSON.stringify(e)\n }`;\n if (wantsJson) {\n return json({ ok: false as const, message }, { status: 500 });\n }\n return redirectWithErrorMessage(\n v3SchedulePath(\n { slug: organizationSlug },\n { slug: projectParam },\n { slug: envParam },\n { friendlyId: scheduleParam }\n ),\n request,\n message\n );\n }\n }\n case \"enable\":\n case \"disable\": {\n const service = new SetActiveOnTaskScheduleService();\n const active = submission.value.action === \"enable\";\n try {\n await service.call({\n projectId: project.id,\n userId,\n friendlyId: scheduleParam,\n active,\n });\n if (wantsJson) {\n return json({ ok: true as const, active });\n }\n return redirectWithSuccessMessage(\n v3SchedulePath(\n { slug: organizationSlug },\n { slug: projectParam },\n { slug: envParam },\n { friendlyId: scheduleParam }\n ),\n request,\n `${scheduleParam} ${active ? \"enabled\" : \"disabled\"}`\n );\n } catch (e) {\n const message = e instanceof Error ? e.message : JSON.stringify(e);\n if (wantsJson) {\n return json({ ok: false as const, message }, { status: 500 });\n }\n return redirectWithErrorMessage(\n v3SchedulePath(\n { slug: organizationSlug },\n { slug: projectParam },\n { slug: envParam },\n { friendlyId: scheduleParam }\n ),\n request,\n `${scheduleParam} could not be ${active ? \"enabled\" : \"disabled\"}: ${message}`\n );\n }\n }\n }\n};\n" pre_fix = "export const action = async ({ request, params }: ActionFunctionArgs) => {\n const userId = await requireUserId(request);\n const { organizationSlug, projectParam, envParam, scheduleParam } =\n v3ScheduleParams.parse(params);\n\n const formData = await request.formData();\n const submission = parseWithZod(formData, { schema });\n\n if (submission.status !== \"success\") {\n return json(submission.reply());\n }\n\n // `_format=json` → return JSON instead of redirecting; caller stays put.\n const wantsJson = formData.get(\"_format\") === \"json\";\n\n const project = await prisma.project.findFirst({\n where: {\n slug: projectParam,\n },\n });\n\n if (!project) {\n const message = `No project found with slug ${projectParam}`;\n if (wantsJson) {\n return json({ ok: false as const, message }, { status: 404 });\n }\n return redirectWithErrorMessage(\n v3SchedulePath(\n { slug: organizationSlug },\n { slug: projectParam },\n { slug: envParam },\n { friendlyId: scheduleParam }\n ),\n request,\n message\n );\n }\n\n switch (submission.value.action) {\n case \"delete\": {\n const deleteService = new DeleteTaskScheduleService();\n try {\n await deleteService.call({\n projectId: project.id,\n userId,\n friendlyId: scheduleParam,\n });\n if (wantsJson) {\n return json({ ok: true as const, message: `${scheduleParam} deleted` });\n }\n return redirectWithSuccessMessage(\n v3EnvironmentPath({ slug: organizationSlug }, { slug: projectParam }, { slug: envParam }),\n request,\n `${scheduleParam} deleted`\n );\n } catch (e) {\n const message = `${scheduleParam} could not be deleted: ${\n e instanceof Error ? e.message : JSON.stringify(e)\n }`;\n if (wantsJson) {\n return json({ ok: false as const, message }, { status: 500 });\n }\n return redirectWithErrorMessage(\n v3SchedulePath(\n { slug: organizationSlug },\n { slug: projectParam },\n { slug: envParam },\n { friendlyId: scheduleParam }\n ),\n request,\n message\n );\n }\n }\n case \"enable\":\n case \"disable\": {\n const service = new SetActiveOnTaskScheduleService();\n const active = submission.value.action === \"enable\";\n try {\n await service.call({\n projectId: project.id,\n userId,\n friendlyId: scheduleParam,\n active,\n });\n if (wantsJson) {\n return json({ ok: true as const, active });\n }\n return redirectWithSuccessMessage(\n v3SchedulePath(\n { slug: organizationSlug },\n { slug: projectParam },\n { slug: envParam },\n { friendlyId: scheduleParam }\n ),\n request,\n `${scheduleParam} ${active ? \"enabled\" : \"disabled\"}`\n );\n } catch (e) {\n const message = e instanceof Error ? e.message : JSON.stringify(e);\n if (wantsJson) {\n return json({ ok: false as const, message }, { status: 500 });\n }\n return redirectWithErrorMessage(\n v3SchedulePath(\n { slug: organizationSlug },\n { slug: projectParam },\n { slug: envParam },\n { friendlyId: scheduleParam }\n ),\n request,\n `${scheduleParam} could not be ${active ? \"enabled\" : \"disabled\"}: ${message}`\n );\n }\n }\n }\n};\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "sanitizeHeaders" function_lines = [[321, 356]] id = "triggerdotdev-trigger.dev-dcc34c0e95ea739c" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/v3/services/worker/workerGroupTokenService.server.ts" post_fix = " private sanitizeHeaders(request: Request, skipHeaders = [\"authorization\"]) {\n const sanitizedHeaders: Partial> = {};\n\n for (const [key, value] of request.headers.entries()) {\n if (!skipHeaders.includes(key.toLowerCase())) {\n sanitizedHeaders[key] = value;\n }\n }\n\n return sanitizedHeaders;\n }\n}\n\nexport const WorkerInstanceEnv = z.enum([\"dev\", \"staging\", \"prod\"]).default(\"prod\");\nexport type WorkerInstanceEnv = z.infer;\n\nexport type AuthenticatedWorkerInstanceOptions = WithRunEngineOptions<{\n type: WorkerInstanceGroupType;\n name: string;\n workerGroupId: string;\n workerInstanceId: string;\n masterQueue: string;\n}>;\n\nexport class AuthenticatedWorkerInstance extends WithRunEngine {\n readonly type: WorkerInstanceGroupType;\n readonly name: string;\n readonly workerGroupId: string;\n readonly workerInstanceId: string;\n readonly masterQueue: string;\n\n // FIXME: Required for unmanaged workers\n readonly isLatestDeployment = true;\n\n constructor(opts: AuthenticatedWorkerInstanceOptions) {\n super({ prisma: opts.prisma, engine: opts.engine });\n\n this.type = opts.type;\n this.name = opts.name;\n this.workerGroupId = opts.workerGroupId;\n this.workerInstanceId = opts.workerInstanceId;\n this.masterQueue = opts.masterQueue;\n }\n" pre_fix = " private sanitizeHeaders(request: Request, denylist = SENSITIVE_WORKER_HEADERS) {\n return sanitizeWorkerHeaders(request.headers, denylist);\n }\n}\n\nexport const WorkerInstanceEnv = z.enum([\"dev\", \"staging\", \"prod\"]).default(\"prod\");\nexport type WorkerInstanceEnv = z.infer;\n\nexport type AuthenticatedWorkerInstanceOptions = WithRunEngineOptions<{\n type: WorkerInstanceGroupType;\n name: string;\n workerGroupId: string;\n workerInstanceId: string;\n masterQueue: string;\n}>;\n\nexport class AuthenticatedWorkerInstance extends WithRunEngine {\n readonly type: WorkerInstanceGroupType;\n readonly name: string;\n readonly workerGroupId: string;\n readonly workerInstanceId: string;\n readonly masterQueue: string;\n\n // FIXME: Required for unmanaged workers\n readonly isLatestDeployment = true;\n\n constructor(opts: AuthenticatedWorkerInstanceOptions) {\n super({ prisma: opts.prisma, engine: opts.engine });\n\n this.type = opts.type;\n this.name = opts.name;\n this.workerGroupId = opts.workerGroupId;\n this.workerInstanceId = opts.workerInstanceId;\n this.masterQueue = opts.masterQueue;\n }\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "extractEventProperties" function_lines = [[469, 490]] id = "triggerdotdev-trigger.dev-ddd75cb2ab0e406d" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/v3/otlpTransform.server.ts" post_fix = "function extractEventProperties(attributes: KeyValue[], prefix?: string) {\n return {\n // Decode a deployment-token worker.id back to its friendlyId so the credential never lands in\n // stored span/log metadata (the metrics path unwraps its own worker_id separately).\n metadata: unwrapWorkerIdInMetadata(\n convertSelectedKeyValueItemsToMap(attributes, [SemanticInternalAttributes.METADATA])\n ),\n environmentId: extractStringAttribute(attributes, [\n prefix,\n SemanticInternalAttributes.ENVIRONMENT_ID,\n ]),\n organizationId: extractStringAttribute(attributes, [\n prefix,\n SemanticInternalAttributes.ORGANIZATION_ID,\n ]),\n projectId: extractStringAttribute(attributes, [prefix, SemanticInternalAttributes.PROJECT_ID]),\n runId: extractStringAttribute(attributes, [prefix, SemanticInternalAttributes.RUN_ID]),\n attemptNumber: extractNumberAttribute(attributes, [\n prefix,\n SemanticInternalAttributes.ATTEMPT_NUMBER,\n ]),\n taskSlug: extractStringAttribute(attributes, [prefix, SemanticInternalAttributes.TASK_SLUG]),\n machineId: extractStringAttribute(attributes, [prefix, SemanticInternalAttributes.MACHINE_ID]),\n };\n}\n" pre_fix = "function extractEventProperties(attributes: KeyValue[], prefix?: string) {\n return {\n metadata: convertSelectedKeyValueItemsToMap(attributes, [SemanticInternalAttributes.METADATA]),\n environmentId: extractStringAttribute(attributes, [\n prefix,\n SemanticInternalAttributes.ENVIRONMENT_ID,\n ]),\n organizationId: extractStringAttribute(attributes, [\n prefix,\n SemanticInternalAttributes.ORGANIZATION_ID,\n ]),\n projectId: extractStringAttribute(attributes, [prefix, SemanticInternalAttributes.PROJECT_ID]),\n runId: extractStringAttribute(attributes, [prefix, SemanticInternalAttributes.RUN_ID]),\n attemptNumber: extractNumberAttribute(attributes, [\n prefix,\n SemanticInternalAttributes.ATTEMPT_NUMBER,\n ]),\n taskSlug: extractStringAttribute(attributes, [prefix, SemanticInternalAttributes.TASK_SLUG]),\n machineId: extractStringAttribute(attributes, [prefix, SemanticInternalAttributes.MACHINE_ID]),\n };\n}\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "continueRunExecution" function_lines = [[238, 292]] id = "triggerdotdev-trigger.dev-df02f538ad370706" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "packages/core/src/v3/runEngineWorker/supervisor/http.ts" post_fix = " async continueRunExecution(\n runId: string,\n snapshotId: string,\n runnerId?: string,\n environmentId?: string\n ) {\n return wrapZodFetch(\n WorkerApiContinueRunExecutionRequestBody,\n `${this.apiUrl}/engine/v1/worker-actions/runs/${runId}/snapshots/${snapshotId}/continue`,\n {\n method: \"GET\",\n headers: {\n ...this.defaultHeaders,\n ...this.runnerIdHeader(runnerId),\n ...this.environmentIdHeader(environmentId),\n },\n },\n {\n // This is the hop that reaches the engine, so it's where a transient\n // database outage during resume surfaces (as a retryable 5xx). Resuming\n // is idempotent server-side (guarded by the snapshot id), so retry\n // generously to ride out the outage rather than aborting the run.\n // `randomize` jitters the delay so a fleet of runs resuming at once\n // doesn't stampede the DB the moment it recovers.\n retry: {\n minTimeoutInMs: 500,\n maxTimeoutInMs: 10_000,\n maxAttempts: 8,\n factor: 2,\n randomize: true,\n },\n }\n );\n }" pre_fix = " async continueRunExecution(runId: string, snapshotId: string, runnerId?: string) {\n return wrapZodFetch(\n WorkerApiContinueRunExecutionRequestBody,\n `${this.apiUrl}/engine/v1/worker-actions/runs/${runId}/snapshots/${snapshotId}/continue`,\n {\n method: \"GET\",\n headers: {\n ...this.defaultHeaders,\n ...this.runnerIdHeader(runnerId),\n },\n },\n {\n // This is the hop that reaches the engine, so it's where a transient\n // database outage during resume surfaces (as a retryable 5xx). Resuming\n // is idempotent server-side (guarded by the snapshot id), so retry\n // generously to ride out the outage rather than aborting the run.\n // `randomize` jitters the delay so a fleet of runs resuming at once\n // doesn't stampede the DB the moment it recovers.\n retry: {\n minTimeoutInMs: 500,\n maxTimeoutInMs: 10_000,\n maxAttempts: 8,\n factor: 2,\n randomize: true,\n },\n }\n );\n }\n\n async submitSuspendCompletion({\n runId,\n snapshotId,\n runnerId,\n body,\n }: {\n runId: string;\n snapshotId: string;\n runnerId?: string;\n body: WorkerApiSuspendRunRequestBody;\n }) {\n return wrapZodFetch(\n WorkerApiSuspendRunResponseBody,\n `${this.apiUrl}/engine/v1/worker-actions/runs/${runId}/snapshots/${snapshotId}/suspend`,\n {\n method: \"POST\",\n headers: {\n ...this.defaultHeaders,\n ...this.runnerIdHeader(runnerId),\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(body),\n }\n );\n }\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "create" function_lines = [[146, 332]] id = "triggerdotdev-trigger.dev-dfa82db3c18c0e1b" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/workloadManager/compute.ts" post_fix = " async create(opts: WorkloadManagerCreateOptions) {\n const runnerId = getRunnerId(opts.runFriendlyId, opts.nextAttemptNumber);\n\n const envVars: Record = {\n OTEL_EXPORTER_OTLP_ENDPOINT: this.opts.runner.otelEndpoint,\n TRIGGER_DEQUEUED_AT_MS: String(opts.dequeuedAt.getTime()),\n TRIGGER_POD_SCHEDULED_AT_MS: String(Date.now()),\n TRIGGER_ENV_ID: opts.envId,\n TRIGGER_DEPLOYMENT_ID: opts.deploymentToken ?? opts.deploymentFriendlyId,\n // Plain friendlyId for telemetry (worker.id), so it isn't the opaque token in DEPLOYMENT_ID.\n TRIGGER_DEPLOYMENT_FRIENDLY_ID: opts.deploymentFriendlyId,\n TRIGGER_DEPLOYMENT_VERSION: opts.deploymentVersion,\n TRIGGER_RUN_ID: opts.runFriendlyId,\n TRIGGER_SNAPSHOT_ID: opts.snapshotFriendlyId,\n TRIGGER_SUPERVISOR_API_PROTOCOL: this.opts.workloadApiProtocol,\n TRIGGER_SUPERVISOR_API_PORT: String(this.opts.workloadApiPort),\n TRIGGER_SUPERVISOR_API_DOMAIN: this.opts.workloadApiDomain ?? \"\",\n TRIGGER_WORKER_INSTANCE_NAME: this.opts.runner.instanceName,\n TRIGGER_RUNNER_ID: runnerId,\n TRIGGER_MACHINE_CPU: String(opts.machine.cpu),\n TRIGGER_MACHINE_MEMORY: String(opts.machine.memory),\n PRETTY_LOGS: String(this.opts.runner.prettyLogs),\n TRIGGER_SEND_RUN_DEBUG_LOGS: String(this.opts.runner.sendRunDebugLogs),\n };\n\n if (this.opts.warmStartUrl) {\n envVars.TRIGGER_WARM_START_URL = this.opts.warmStartUrl;\n }\n\n if (this.snapshotsEnabled && this.opts.metadataUrl) {\n envVars.TRIGGER_METADATA_URL = this.opts.metadataUrl;\n }\n\n if (this.opts.heartbeatIntervalSeconds) {\n envVars.TRIGGER_HEARTBEAT_INTERVAL_SECONDS = String(this.opts.heartbeatIntervalSeconds);\n }\n\n if (this.opts.snapshotPollIntervalSeconds) {\n envVars.TRIGGER_SNAPSHOT_POLL_INTERVAL_SECONDS = String(\n this.opts.snapshotPollIntervalSeconds\n );\n }\n\n if (this.opts.additionalEnvVars) {\n Object.assign(envVars, this.opts.additionalEnvVars);\n }\n\n // Strip image digest - resolve by tag, not digest\n const imageRef = stripImageDigest(opts.image);\n\n // Labels forwarded to the compute provider for network-policy selection.\n // `org` is always set so every run carries its org identity.\n const labels: Record = {\n org: opts.orgId,\n };\n\n // Wide event: single canonical log line emitted in finally\n const event: Record = {\n // High-cardinality identifiers\n runId: opts.runFriendlyId,\n runnerId,\n envId: opts.envId,\n envType: opts.envType,\n orgId: opts.orgId,\n projectId: opts.projectId,\n deploymentVersion: opts.deploymentVersion,\n machine: opts.machine.name,\n // Environment\n instanceName: this.opts.runner.instanceName,\n // Supervisor timing\n dequeueResponseMs: opts.dequeueResponseMs,\n pollingIntervalMs: opts.pollingIntervalMs,\n warmStartCheckMs: opts.warmStartCheckMs,\n // Request\n image: imageRef,\n };\n\n const startMs = performance.now();\n\n try {\n const createRequest = {\n name: runnerId,\n image: imageRef,\n env: envVars,\n cpu: opts.machine.cpu,\n memory_gb: opts.machine.memory,\n metadata: {\n runId: opts.runFriendlyId,\n envId: opts.envId,\n envType: opts.envType,\n orgId: opts.orgId,\n projectId: opts.projectId,\n deploymentVersion: opts.deploymentVersion,\n machine: opts.machine.name,\n },\n ...(Object.keys(labels).length > 0 ? { labels } : {}),\n };\n\n // Retry transient placement failures instead of abandoning the run: a\n // swallowed create error leaves the run waiting for the run engine's\n // PENDING_EXECUTING timeout (minutes) before it is redriven, while a\n // retried create typically succeeds in under a second (TRI-10293).\n let error: unknown;\n let data: Awaited> | null | undefined;\n let attempt = 1;\n // Set after a ComputeClientError: the failed create may have left its\n // name registered, so subsequent attempts use a suffixed name.\n let suffixAttempts = false;\n for (; attempt <= this.createMaxAttempts; attempt++) {\n const attemptRunnerId = suffixAttempts ? runnerNameForAttempt(runnerId, attempt) : runnerId;\n [error, data] = await tryCatch(\n this.compute.instances.create(\n attemptRunnerId === runnerId\n ? createRequest\n : {\n ...createRequest,\n name: attemptRunnerId,\n env: { ...envVars, TRIGGER_RUNNER_ID: attemptRunnerId },\n }\n )\n );\n\n if (!error) {\n event.runnerId = attemptRunnerId;\n break;\n }\n\n if (error instanceof ComputeClientError) {\n suffixAttempts = true;\n }\n\n this.logger.warn(\"create instance attempt failed\", {\n runnerId: attemptRunnerId,\n attempt,\n error: error instanceof Error ? error.message : String(error),\n });\n\n if (!isRetryableCreateError(error) || attempt === this.createMaxAttempts) break;\n await sleep(this.createRetryBaseDelayMs * attempt);\n }\n event.createAttempts = attempt;\n\n if (error || !data) {\n event.error = error instanceof Error ? error.message : String(error);\n event.errorType =\n error instanceof DOMException && error.name === \"TimeoutError\" ? \"timeout\" : \"fetch\";\n // Intentional: errors are captured in the wide event, not thrown. This matches\n // the Docker/K8s managers. The run will eventually time out if scheduling fails.\n return;\n }\n\n event.instanceId = data.id;\n event.ok = true;\n\n // Parse timing data from compute response (optional - requires gateway timing flag)\n if (data._timing) {\n event.timing = data._timing;\n }\n\n this.#emitProvisionSpan(opts, startMs, data._timing);\n } finally {\n event.durationMs = Math.round(performance.now() - startMs);\n event.ok ??= false;\n this.logger.debug(\"create instance\", event);\n }\n }\n\n async snapshot(opts: { runnerId: string; metadata: Record }): Promise {\n const [error] = await tryCatch(\n this.compute.instances.snapshot(opts.runnerId, {\n callback: {\n url: this.opts.snapshots.callbackUrl,\n metadata: opts.metadata,\n },\n })\n );\n\n if (error) {\n this.logger.error(\"snapshot request failed\", {\n runnerId: opts.runnerId,\n error: error instanceof Error ? error.message : String(error),\n });\n return false;\n }\n\n this.logger.debug(\"snapshot request accepted\", { runnerId: opts.runnerId });\n return true;\n }\n" pre_fix = " async create(opts: WorkloadManagerCreateOptions) {\n const runnerId = getRunnerId(opts.runFriendlyId, opts.nextAttemptNumber);\n\n const envVars: Record = {\n OTEL_EXPORTER_OTLP_ENDPOINT: this.opts.runner.otelEndpoint,\n TRIGGER_DEQUEUED_AT_MS: String(opts.dequeuedAt.getTime()),\n TRIGGER_POD_SCHEDULED_AT_MS: String(Date.now()),\n TRIGGER_ENV_ID: opts.envId,\n TRIGGER_DEPLOYMENT_ID: opts.deploymentFriendlyId,\n TRIGGER_DEPLOYMENT_VERSION: opts.deploymentVersion,\n TRIGGER_RUN_ID: opts.runFriendlyId,\n TRIGGER_SNAPSHOT_ID: opts.snapshotFriendlyId,\n TRIGGER_SUPERVISOR_API_PROTOCOL: this.opts.workloadApiProtocol,\n TRIGGER_SUPERVISOR_API_PORT: String(this.opts.workloadApiPort),\n TRIGGER_SUPERVISOR_API_DOMAIN: this.opts.workloadApiDomain ?? \"\",\n TRIGGER_WORKER_INSTANCE_NAME: this.opts.runner.instanceName,\n TRIGGER_RUNNER_ID: runnerId,\n TRIGGER_MACHINE_CPU: String(opts.machine.cpu),\n TRIGGER_MACHINE_MEMORY: String(opts.machine.memory),\n PRETTY_LOGS: String(this.opts.runner.prettyLogs),\n TRIGGER_SEND_RUN_DEBUG_LOGS: String(this.opts.runner.sendRunDebugLogs),\n };\n\n if (this.opts.warmStartUrl) {\n envVars.TRIGGER_WARM_START_URL = this.opts.warmStartUrl;\n }\n\n if (this.snapshotsEnabled && this.opts.metadataUrl) {\n envVars.TRIGGER_METADATA_URL = this.opts.metadataUrl;\n }\n\n if (this.opts.heartbeatIntervalSeconds) {\n envVars.TRIGGER_HEARTBEAT_INTERVAL_SECONDS = String(this.opts.heartbeatIntervalSeconds);\n }\n\n if (this.opts.snapshotPollIntervalSeconds) {\n envVars.TRIGGER_SNAPSHOT_POLL_INTERVAL_SECONDS = String(\n this.opts.snapshotPollIntervalSeconds\n );\n }\n\n if (this.opts.additionalEnvVars) {\n Object.assign(envVars, this.opts.additionalEnvVars);\n }\n\n // Strip image digest - resolve by tag, not digest\n const imageRef = stripImageDigest(opts.image);\n\n // Labels forwarded to the compute provider for network-policy selection.\n // `org` is always set so every run carries its org identity.\n const labels: Record = {\n org: opts.orgId,\n };\n\n // Wide event: single canonical log line emitted in finally\n const event: Record = {\n // High-cardinality identifiers\n runId: opts.runFriendlyId,\n runnerId,\n envId: opts.envId,\n envType: opts.envType,\n orgId: opts.orgId,\n projectId: opts.projectId,\n deploymentVersion: opts.deploymentVersion,\n machine: opts.machine.name,\n // Environment\n instanceName: this.opts.runner.instanceName,\n // Supervisor timing\n dequeueResponseMs: opts.dequeueResponseMs,\n pollingIntervalMs: opts.pollingIntervalMs,\n warmStartCheckMs: opts.warmStartCheckMs,\n // Request\n image: imageRef,\n };\n\n const startMs = performance.now();\n\n try {\n const createRequest = {\n name: runnerId,\n image: imageRef,\n env: envVars,\n cpu: opts.machine.cpu,\n memory_gb: opts.machine.memory,\n metadata: {\n runId: opts.runFriendlyId,\n envId: opts.envId,\n envType: opts.envType,\n orgId: opts.orgId,\n projectId: opts.projectId,\n deploymentVersion: opts.deploymentVersion,\n machine: opts.machine.name,\n },\n ...(Object.keys(labels).length > 0 ? { labels } : {}),\n };\n\n // Retry transient placement failures instead of abandoning the run: a\n // swallowed create error leaves the run waiting for the run engine's\n // PENDING_EXECUTING timeout (minutes) before it is redriven, while a\n // retried create typically succeeds in under a second (TRI-10293).\n let error: unknown;\n let data: Awaited> | null | undefined;\n let attempt = 1;\n // Set after a ComputeClientError: the failed create may have left its\n // name registered, so subsequent attempts use a suffixed name.\n let suffixAttempts = false;\n for (; attempt <= this.createMaxAttempts; attempt++) {\n const attemptRunnerId = suffixAttempts ? runnerNameForAttempt(runnerId, attempt) : runnerId;\n [error, data] = await tryCatch(\n this.compute.instances.create(\n attemptRunnerId === runnerId\n ? createRequest\n : {\n ...createRequest,\n name: attemptRunnerId,\n env: { ...envVars, TRIGGER_RUNNER_ID: attemptRunnerId },\n }\n )\n );\n\n if (!error) {\n event.runnerId = attemptRunnerId;\n break;\n }\n\n if (error instanceof ComputeClientError) {\n suffixAttempts = true;\n }\n\n this.logger.warn(\"create instance attempt failed\", {\n runnerId: attemptRunnerId,\n attempt,\n error: error instanceof Error ? error.message : String(error),\n });\n\n if (!isRetryableCreateError(error) || attempt === this.createMaxAttempts) break;\n await sleep(this.createRetryBaseDelayMs * attempt);\n }\n event.createAttempts = attempt;\n\n if (error || !data) {\n event.error = error instanceof Error ? error.message : String(error);\n event.errorType =\n error instanceof DOMException && error.name === \"TimeoutError\" ? \"timeout\" : \"fetch\";\n // Intentional: errors are captured in the wide event, not thrown. This matches\n // the Docker/K8s managers. The run will eventually time out if scheduling fails.\n return;\n }\n\n event.instanceId = data.id;\n event.ok = true;\n\n // Parse timing data from compute response (optional - requires gateway timing flag)\n if (data._timing) {\n event.timing = data._timing;\n }\n\n this.#emitProvisionSpan(opts, startMs, data._timing);\n } finally {\n event.durationMs = Math.round(performance.now() - startMs);\n event.ok ??= false;\n this.logger.debug(\"create instance\", event);\n }\n }\n\n async snapshot(opts: { runnerId: string; metadata: Record }): Promise {\n const [error] = await tryCatch(\n this.compute.instances.snapshot(opts.runnerId, {\n callback: {\n url: this.opts.snapshots.callbackUrl,\n metadata: opts.metadata,\n },\n })\n );\n\n if (error) {\n this.logger.error(\"snapshot request failed\", {\n runnerId: opts.runnerId,\n error: error instanceof Error ? error.message : String(error),\n });\n return false;\n }\n\n this.logger.debug(\"snapshot request accepted\", { runnerId: opts.runnerId });\n return true;\n }\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "cancelDeployment" function_lines = [[193, 270]] id = "triggerdotdev-trigger.dev-eebfca9646e01b1c" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/webapp/app/v3/services/deployment.server.ts" post_fix = " public cancelDeployment(\n authenticatedEnv: Pick,\n friendlyId: string,\n data?: Partial>\n ) {\n const validateDeployment = (\n deployment: Pick & {\n environment: { project: { externalRef: string } };\n }\n ) => {\n if (FINAL_DEPLOYMENT_STATUSES.includes(deployment.status)) {\n logger.warn(\"Attempted cancelling deployment in a final state\", {\n deployment,\n });\n return errAsync({ type: \"deployment_cannot_be_cancelled\" as const });\n }\n\n return okAsync(deployment);\n };\n\n const cancelDeployment = (\n deployment: Pick & {\n environment: { project: { externalRef: string } };\n }\n ) =>\n fromPromise(\n this._prisma.workerDeployment.updateMany({\n where: {\n id: deployment.id,\n status: {\n notIn: FINAL_DEPLOYMENT_STATUSES, // status could've changed in the meantime, we're not locking the row\n },\n },\n data: {\n status: \"CANCELED\",\n canceledAt: new Date(),\n canceledReason: data?.canceledReason,\n },\n }),\n (error) => ({\n type: \"other\" as const,\n cause: error,\n })\n ).andThen((result) => {\n if (result.count === 0) {\n return errAsync({ type: \"deployment_cannot_be_cancelled\" as const });\n }\n return okAsync({ deployment });\n });\n\n const deleteTimeout = (deployment: Pick) =>\n fromPromise(TimeoutDeploymentService.dequeue(deployment.id, this._prisma), (error) => ({\n type: \"failed_to_delete_deployment_timeout\" as const,\n cause: error,\n }));\n\n return this.getDeployment(authenticatedEnv.id, friendlyId)\n .andThen(validateDeployment)\n .andThen(cancelDeployment)\n .andThen(({ deployment }) =>\n this.appendToEventLog(deployment.environment.project, deployment, [\n {\n type: \"finalized\",\n data: {\n result: \"canceled\",\n message: data?.canceledReason ?? undefined,\n },\n },\n ])\n .orElse((error) => {\n logger.error(\"Failed to append event to deployment event log\", { error });\n return okAsync(deployment);\n })\n .map(() => deployment)\n )\n .andThen(deleteTimeout)\n .map(() => undefined);\n }" pre_fix = " public cancelDeployment(\n authenticatedEnv: Pick,\n friendlyId: string,\n data?: Partial>\n ) {\n const validateDeployment = (\n deployment: Pick & {\n environment: { project: { externalRef: string } };\n }\n ) => {\n if (FINAL_DEPLOYMENT_STATUSES.includes(deployment.status)) {\n logger.warn(\"Attempted cancelling deployment in a final state\", {\n deployment,\n });\n return errAsync({ type: \"deployment_cannot_be_cancelled\" as const });\n }\n\n return okAsync(deployment);\n };\n\n const cancelDeployment = (\n deployment: Pick & {\n environment: { project: { externalRef: string } };\n }\n ) =>\n fromPromise(\n this._prisma.workerDeployment.updateMany({\n where: {\n id: deployment.id,\n status: {\n notIn: FINAL_DEPLOYMENT_STATUSES, // status could've changed in the meantime, we're not locking the row\n },\n },\n data: {\n status: \"CANCELED\",\n canceledAt: new Date(),\n canceledReason: data?.canceledReason,\n },\n }),\n (error) => ({\n type: \"other\" as const,\n cause: error,\n })\n ).andThen((result) => {\n if (result.count === 0) {\n return errAsync({ type: \"deployment_cannot_be_cancelled\" as const });\n }\n return okAsync({ deployment });\n });\n\n const deleteTimeout = (deployment: Pick) =>\n fromPromise(TimeoutDeploymentService.dequeue(deployment.id, this._prisma), (error) => ({\n type: \"failed_to_delete_deployment_timeout\" as const,\n cause: error,\n }));\n\n return this.getDeployment(authenticatedEnv.projectId, friendlyId)\n .andThen(validateDeployment)\n .andThen(cancelDeployment)\n .andThen(({ deployment }) =>\n this.appendToEventLog(deployment.environment.project, deployment, [\n {\n type: \"finalized\",\n data: {\n result: \"canceled\",\n message: data?.canceledReason ?? undefined,\n },\n },\n ])\n .orElse((error) => {\n logger.error(\"Failed to append event to deployment event log\", { error });\n return okAsync(deployment);\n })\n .map(() => deployment)\n )\n .andThen(deleteTimeout)\n .map(() => undefined);\n }" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "createWebsocketServer" function_lines = [[636, 693]] id = "triggerdotdev-trigger.dev-f2588e86d347fea6" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "apps/supervisor/src/workloadServer/index.ts" post_fix = " private createWebsocketServer() {\n const io = new Server(this.httpServer.server);\n\n const websocketServer: Namespace<\n WorkloadClientToServerEvents,\n WorkloadServerToClientEvents,\n DefaultEventsMap,\n WorkloadClientSocketData\n > = io.of(\"/workload\");\n\n websocketServer.on(\"disconnect\", (socket) => {\n this.logger.verbose(\"[WS] disconnect\", socket.id);\n });\n websocketServer.use(async (socket, next) => {\n const setSocketDataFromHeader = (\n dataKey: keyof typeof socket.data,\n headerName: string,\n required: boolean = true\n ) => {\n const value = socket.handshake.headers[headerName];\n\n if (value) {\n if (Array.isArray(value)) {\n if (value[0]) {\n socket.data[dataKey] = value[0];\n return;\n }\n } else {\n socket.data[dataKey] = value;\n return;\n }\n }\n\n if (required) {\n this.logger.error(\"[WS] missing required header\", { headerName });\n throw new Error(\"missing header\");\n }\n };\n\n try {\n setSocketDataFromHeader(\"deploymentId\", WORKLOAD_HEADERS.DEPLOYMENT_ID);\n setSocketDataFromHeader(\"runnerId\", WORKLOAD_HEADERS.RUNNER_ID);\n } catch (error) {\n this.logger.error(\"[WS] setSocketDataFromHeader error\", { error });\n socket.disconnect(true);\n return;\n }\n\n if (workloadTokensEnabled) {\n const result = await verifyDeploymentIdHeader(socket.data.deploymentId, \"ws\");\n\n if (result.outcome === \"jwt_invalid\" && workloadTokenEnforced) {\n this.logger.error(\"[WS] deployment token verification failed\", {\n runnerId: socket.data.runnerId,\n });\n socket.disconnect(true);\n return;\n }\n\n // Re-source the deployment id from the verified claim; the raw header may be an opaque token.\n // A legacy bare id is itself the friendlyId, so it's safe to keep.\n socket.data.deploymentFriendlyId =\n result.outcome === \"jwt_valid\"\n ? result.claims.deployment\n : result.outcome === \"legacy_bare\"\n ? socket.data.deploymentId\n : undefined;\n }\n\n this.logger.debug(\"[WS] handshake complete\", {\n runnerId: socket.data.runnerId,\n deploymentFriendlyId: socket.data.deploymentFriendlyId,\n });\n\n next();\n });\n websocketServer.on(\"connection\", (socket) => {\n const socketLogger = this.logger.child({\n socketId: socket.id,\n socketData: socket.data,\n });\n" pre_fix = " private createWebsocketServer() {\n const io = new Server(this.httpServer.server);\n\n const websocketServer: Namespace<\n WorkloadClientToServerEvents,\n WorkloadServerToClientEvents,\n DefaultEventsMap,\n WorkloadClientSocketData\n > = io.of(\"/workload\");\n\n websocketServer.on(\"disconnect\", (socket) => {\n this.logger.verbose(\"[WS] disconnect\", socket.id);\n });\n websocketServer.use(async (socket, next) => {\n const setSocketDataFromHeader = (\n dataKey: keyof typeof socket.data,\n headerName: string,\n required: boolean = true\n ) => {\n const value = socket.handshake.headers[headerName];\n\n if (value) {\n if (Array.isArray(value)) {\n if (value[0]) {\n socket.data[dataKey] = value[0];\n return;\n }\n } else {\n socket.data[dataKey] = value;\n return;\n }\n }\n\n if (required) {\n this.logger.error(\"[WS] missing required header\", { headerName });\n throw new Error(\"missing header\");\n }\n };\n\n try {\n setSocketDataFromHeader(\"deploymentId\", WORKLOAD_HEADERS.DEPLOYMENT_ID);\n setSocketDataFromHeader(\"runnerId\", WORKLOAD_HEADERS.RUNNER_ID);\n } catch (error) {\n this.logger.error(\"[WS] setSocketDataFromHeader error\", { error });\n socket.disconnect(true);\n return;\n }\n\n this.logger.debug(\"[WS] auth success\", socket.data);\n\n next();\n });\n websocketServer.on(\"connection\", (socket) => {\n const socketLogger = this.logger.child({\n socketId: socket.id,\n socketData: socket.data,\n });\n" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-4672-hwv6-gq62" advisory_text = "Trigger.dev: Cross-environment deployment cancel\n\n### Summary\n\nTrigger.dev isolates each project into multiple **environments** (`dev`, `staging`, `prod`, and per-PR `preview` branches), each with its **own secret API key** — the environment is a trust boundary (a `dev`/preview/CI key is lower-trust than a `prod` key). Most API routes enforce this by scoping resource lookups to the authenticated key's environment (`where: { friendlyId, runtimeEnvironmentId: auth.environment.id }`).\n\nThe deployment **cancel** path does not. `DeploymentService.getDeployment()` scopes the lookup by **`projectId` only** — never `environmentId` — so a secret key for *any* environment in a project can cancel a deployment belonging to *any other* environment of the same project, including **production**. The deployment **GET** route, by contrast, *is* env-scoped — so the same key that is **404'd when trying to read** a prod deployment can nonetheless **cancel** it. That asymmetry is the bug.\n\n### Affected\n\n`apps/webapp`, HEAD `5d99457` (current `main`). Affects self-hosted and cloud.\n\n### Root cause\n\n`apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts` authenticates to an environment and calls `deploymentService.cancelDeployment(authenticatedEnv, deploymentId, ...)`.\n\n`apps/webapp/app/v3/services/deployment.server.ts`:\n```ts\npublic cancelDeployment(authenticatedEnv: Pick, friendlyId, ...) {\n return this.getDeployment(authenticatedEnv.projectId, friendlyId) // projectId only\n .andThen(validateDeployment) // rejects only FINAL statuses\n .andThen(cancelDeployment); // updateMany -> status CANCELED\n}\nprivate getDeployment(projectId: string, friendlyId: string) {\n return this._prisma.workerDeployment.findFirst({\n where: { friendlyId, projectId }, // <-- NO environmentId filter\n });\n}\n```\n\n`cancelDeployment` accepts `authenticatedEnv` but its type is literally `Pick` — it discards the environment identity. `validateDeployment` blocks only `FINAL_DEPLOYMENT_STATUSES`, so any in-progress deployment (`PENDING`/`INSTALLING`/`BUILDING`/`DEPLOYING`) is cancellable.\n\n**Contrast — the correctly env-scoped sibling** `api.v1.deployments.$deploymentId.ts` (GET):\n```ts\nconst deployment = await prisma.workerDeployment.findFirst({\n where: { friendlyId: deploymentId, environmentId: authenticatedEnv.id }, // env-scoped\n});\n```\nReads are env-scoped; the cancel mutation is not. The same `getDeployment(authenticatedEnv.projectId, …)` helper also backs the deployment *progress* methods (`deployment.server.ts:172,329`), so the projectId-only scope is a small class.\n\n### Runtime PoC (proven on the self-host stack)\n\nSeeded one project with a `prod` env (key `tr_prod_…`) and a `dev` env (key `tr_dev_…`) and one `WorkerDeployment` (`deployment_pocvictim`, status `DEPLOYING`) in the **prod** env. As the **dev** key:\n\n```\nstatus BEFORE : DEPLOYING\nGET /api/v1/deployments/deployment_pocvictim (dev key) -> 404 (env-scoped read DENIES it)\nPOST /api/v1/deployments/deployment_pocvictim/cancel (dev key) -> 204\nstatus AFTER : CANCELED (prod deploy canceled by the dev key)\nCONTROL: same cancel with a DIFFERENT project's key -> 404 (projectId scope blocks cross-project)\n```\n\nThe dev key cannot *read* the prod deployment (404) yet *cancels* it (204 → CANCELED); a different project's key is correctly 404'd — so the gap is precisely cross-environment within a project." commit = "6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0" cwe = "CWE-639" family = "access_control" function = "query" function_lines = [[2101, 2113]] id = "triggerdotdev-trigger.dev-f809e61cae1a9f29" language = "typescript" method = "fix_site" parent = "cc748422d8188833948035281cc50ef4f7ab77e2" path = "internal-packages/run-engine/src/engine/index.ts" post_fix = " const query = async (\n client: PrismaClientOrTransaction,\n repairClient?: PrismaClientOrTransaction\n ) => {\n const snapshots = await getExecutionSnapshotsSince(\n client,\n runId,\n snapshotId,\n this.runStore,\n repairClient,\n environmentId\n );\n return snapshots.map(executionDataFromSnapshot);\n };" pre_fix = " const query = async (\n client: PrismaClientOrTransaction,\n repairClient?: PrismaClientOrTransaction\n ) => {\n const snapshots = await getExecutionSnapshotsSince(\n client,\n runId,\n snapshotId,\n this.runStore,\n repairClient\n );\n return snapshots.map(executionDataFromSnapshot);\n };" repo = "triggerdotdev/trigger.dev" url = "https://github.com/triggerdotdev/trigger.dev.git" [[case]] advisory = "GHSA-ph58-4vrj-w6hr" advisory_text = "bootstrap Cross-site Scripting vulnerability\n\nIn Bootstrap before 3.4.0, XSS is possible in the affix configuration target property." commit = "2a5ba23ce8f041f3548317acc992ed8a736b609d" cwe = "CWE-79" family = "output_encoding" function = "function" function_lines = [[10, 162]] id = "twbs-bootstrap-a6f8f24cd4354719" language = "javascript" method = "fix_site" parent = "13bf8aeae3db71e28af69782328c22215795c169" path = "js/affix.js" post_fix = "+function ($) {\n 'use strict';\n\n // AFFIX CLASS DEFINITION\n // ======================\n\n var Affix = function (element, options) {\n this.options = $.extend({}, Affix.DEFAULTS, options)\n\n var target = this.options.target === Affix.DEFAULTS.target ? $(this.options.target) : $(document).find(this.options.target)\n\n this.$target = target\n .on('scroll.bs.affix.data-api', $.proxy(this.checkPosition, this))\n .on('click.bs.affix.data-api', $.proxy(this.checkPositionWithEventLoop, this))\n\n this.$element = $(element)\n this.affixed = null\n this.unpin = null\n this.pinnedOffset = null\n\n this.checkPosition()\n }\n\n Affix.VERSION = '3.4.0'\n\n Affix.RESET = 'affix affix-top affix-bottom'\n\n Affix.DEFAULTS = {\n offset: 0,\n target: window\n }\n\n Affix.prototype.getState = function (scrollHeight, height, offsetTop, offsetBottom) {\n var scrollTop = this.$target.scrollTop()\n var position = this.$element.offset()\n var targetHeight = this.$target.height()\n\n if (offsetTop != null && this.affixed == 'top') return scrollTop < offsetTop ? 'top' : false\n\n if (this.affixed == 'bottom') {\n if (offsetTop != null) return (scrollTop + this.unpin <= position.top) ? false : 'bottom'\n return (scrollTop + targetHeight <= scrollHeight - offsetBottom) ? false : 'bottom'\n }\n\n var initializing = this.affixed == null\n var colliderTop = initializing ? scrollTop : position.top\n var colliderHeight = initializing ? targetHeight : height\n\n if (offsetTop != null && scrollTop <= offsetTop) return 'top'\n if (offsetBottom != null && (colliderTop + colliderHeight >= scrollHeight - offsetBottom)) return 'bottom'\n\n return false\n }\n\n Affix.prototype.getPinnedOffset = function () {\n if (this.pinnedOffset) return this.pinnedOffset\n this.$element.removeClass(Affix.RESET).addClass('affix')\n var scrollTop = this.$target.scrollTop()\n var position = this.$element.offset()\n return (this.pinnedOffset = position.top - scrollTop)\n }\n\n Affix.prototype.checkPositionWithEventLoop = function () {\n setTimeout($.proxy(this.checkPosition, this), 1)\n }\n\n Affix.prototype.checkPosition = function () {\n if (!this.$element.is(':visible')) return\n\n var height = this.$element.height()\n var offset = this.options.offset\n var offsetTop = offset.top\n var offsetBottom = offset.bottom\n var scrollHeight = Math.max($(document).height(), $(document.body).height())\n\n if (typeof offset != 'object') offsetBottom = offsetTop = offset\n if (typeof offsetTop == 'function') offsetTop = offset.top(this.$element)\n if (typeof offsetBottom == 'function') offsetBottom = offset.bottom(this.$element)\n\n var affix = this.getState(scrollHeight, height, offsetTop, offsetBottom)\n\n if (this.affixed != affix) {\n if (this.unpin != null) this.$element.css('top', '')\n\n var affixType = 'affix' + (affix ? '-' + affix : '')\n var e = $.Event(affixType + '.bs.affix')\n\n this.$element.trigger(e)\n\n if (e.isDefaultPrevented()) return\n\n this.affixed = affix\n this.unpin = affix == 'bottom' ? this.getPinnedOffset() : null\n\n this.$element\n .removeClass(Affix.RESET)\n .addClass(affixType)\n .trigger(affixType.replace('affix', 'affixed') + '.bs.affix')\n }\n\n if (affix == 'bottom') {\n this.$element.offset({\n top: scrollHeight - height - offsetBottom\n })\n }\n }\n\n\n // AFFIX PLUGIN DEFINITION\n // =======================\n\n function Plugin(option) {\n return this.each(function () {\n var $this = $(this)\n var data = $this.data('bs.affix')\n var options = typeof option == 'object' && option\n\n if (!data) $this.data('bs.affix', (data = new Affix(this, options)))\n if (typeof option == 'string') data[option]()\n })\n }\n\n var old = $.fn.affix\n\n $.fn.affix = Plugin\n $.fn.affix.Constructor = Affix\n\n\n // AFFIX NO CONFLICT\n // =================\n\n $.fn.affix.noConflict = function () {\n $.fn.affix = old\n return this\n }\n\n\n // AFFIX DATA-API\n // ==============\n\n $(window).on('load', function () {\n $('[data-spy=\"affix\"]').each(function () {\n var $spy = $(this)\n var data = $spy.data()\n\n data.offset = data.offset || {}\n\n if (data.offsetBottom != null) data.offset.bottom = data.offsetBottom\n if (data.offsetTop != null) data.offset.top = data.offsetTop\n\n Plugin.call($spy, data)\n })\n })\n\n}(jQuery);" pre_fix = "+function ($) {\n 'use strict';\n\n // AFFIX CLASS DEFINITION\n // ======================\n\n var Affix = function (element, options) {\n this.options = $.extend({}, Affix.DEFAULTS, options)\n\n this.$target = $(this.options.target)\n .on('scroll.bs.affix.data-api', $.proxy(this.checkPosition, this))\n .on('click.bs.affix.data-api', $.proxy(this.checkPositionWithEventLoop, this))\n\n this.$element = $(element)\n this.affixed = null\n this.unpin = null\n this.pinnedOffset = null\n\n this.checkPosition()\n }\n\n Affix.VERSION = '3.4.0'\n\n Affix.RESET = 'affix affix-top affix-bottom'\n\n Affix.DEFAULTS = {\n offset: 0,\n target: window\n }\n\n Affix.prototype.getState = function (scrollHeight, height, offsetTop, offsetBottom) {\n var scrollTop = this.$target.scrollTop()\n var position = this.$element.offset()\n var targetHeight = this.$target.height()\n\n if (offsetTop != null && this.affixed == 'top') return scrollTop < offsetTop ? 'top' : false\n\n if (this.affixed == 'bottom') {\n if (offsetTop != null) return (scrollTop + this.unpin <= position.top) ? false : 'bottom'\n return (scrollTop + targetHeight <= scrollHeight - offsetBottom) ? false : 'bottom'\n }\n\n var initializing = this.affixed == null\n var colliderTop = initializing ? scrollTop : position.top\n var colliderHeight = initializing ? targetHeight : height\n\n if (offsetTop != null && scrollTop <= offsetTop) return 'top'\n if (offsetBottom != null && (colliderTop + colliderHeight >= scrollHeight - offsetBottom)) return 'bottom'\n\n return false\n }\n\n Affix.prototype.getPinnedOffset = function () {\n if (this.pinnedOffset) return this.pinnedOffset\n this.$element.removeClass(Affix.RESET).addClass('affix')\n var scrollTop = this.$target.scrollTop()\n var position = this.$element.offset()\n return (this.pinnedOffset = position.top - scrollTop)\n }\n\n Affix.prototype.checkPositionWithEventLoop = function () {\n setTimeout($.proxy(this.checkPosition, this), 1)\n }\n\n Affix.prototype.checkPosition = function () {\n if (!this.$element.is(':visible')) return\n\n var height = this.$element.height()\n var offset = this.options.offset\n var offsetTop = offset.top\n var offsetBottom = offset.bottom\n var scrollHeight = Math.max($(document).height(), $(document.body).height())\n\n if (typeof offset != 'object') offsetBottom = offsetTop = offset\n if (typeof offsetTop == 'function') offsetTop = offset.top(this.$element)\n if (typeof offsetBottom == 'function') offsetBottom = offset.bottom(this.$element)\n\n var affix = this.getState(scrollHeight, height, offsetTop, offsetBottom)\n\n if (this.affixed != affix) {\n if (this.unpin != null) this.$element.css('top', '')\n\n var affixType = 'affix' + (affix ? '-' + affix : '')\n var e = $.Event(affixType + '.bs.affix')\n\n this.$element.trigger(e)\n\n if (e.isDefaultPrevented()) return\n\n this.affixed = affix\n this.unpin = affix == 'bottom' ? this.getPinnedOffset() : null\n\n this.$element\n .removeClass(Affix.RESET)\n .addClass(affixType)\n .trigger(affixType.replace('affix', 'affixed') + '.bs.affix')\n }\n\n if (affix == 'bottom') {\n this.$element.offset({\n top: scrollHeight - height - offsetBottom\n })\n }\n }\n\n\n // AFFIX PLUGIN DEFINITION\n // =======================\n\n function Plugin(option) {\n return this.each(function () {\n var $this = $(this)\n var data = $this.data('bs.affix')\n var options = typeof option == 'object' && option\n\n if (!data) $this.data('bs.affix', (data = new Affix(this, options)))\n if (typeof option == 'string') data[option]()\n })\n }\n\n var old = $.fn.affix\n\n $.fn.affix = Plugin\n $.fn.affix.Constructor = Affix\n\n\n // AFFIX NO CONFLICT\n // =================\n\n $.fn.affix.noConflict = function () {\n $.fn.affix = old\n return this\n }\n\n\n // AFFIX DATA-API\n // ==============\n\n $(window).on('load', function () {\n $('[data-spy=\"affix\"]').each(function () {\n var $spy = $(this)\n var data = $spy.data()\n\n data.offset = data.offset || {}\n\n if (data.offsetBottom != null) data.offset.bottom = data.offsetBottom\n if (data.offsetTop != null) data.offset.top = data.offsetTop\n\n Plugin.call($spy, data)\n })\n })\n\n}(jQuery);" repo = "twbs/bootstrap" url = "https://github.com/twbs/bootstrap.git" [[case]] advisory = "GHSA-ph58-4vrj-w6hr" advisory_text = "bootstrap Cross-site Scripting vulnerability\n\nIn Bootstrap before 3.4.0, XSS is possible in the affix configuration target property." commit = "2a5ba23ce8f041f3548317acc992ed8a736b609d" cwe = "CWE-79" family = "output_encoding" function = "function" function_lines = [[11, 520]] id = "twbs-bootstrap-bfa547024b92ef59" language = "javascript" method = "fix_site" parent = "13bf8aeae3db71e28af69782328c22215795c169" path = "js/tooltip.js" post_fix = "+function ($) {\n 'use strict';\n\n // TOOLTIP PUBLIC CLASS DEFINITION\n // ===============================\n\n var Tooltip = function (element, options) {\n this.type = null\n this.options = null\n this.enabled = null\n this.timeout = null\n this.hoverState = null\n this.$element = null\n this.inState = null\n\n this.init('tooltip', element, options)\n }\n\n Tooltip.VERSION = '3.4.0'\n\n Tooltip.TRANSITION_DURATION = 150\n\n Tooltip.DEFAULTS = {\n animation: true,\n placement: 'top',\n selector: false,\n template: '

',\n trigger: 'hover focus',\n title: '',\n delay: 0,\n html: false,\n container: false,\n viewport: {\n selector: 'body',\n padding: 0\n }\n }\n\n Tooltip.prototype.init = function (type, element, options) {\n this.enabled = true\n this.type = type\n this.$element = $(element)\n this.options = this.getOptions(options)\n this.$viewport = this.options.viewport && $($.isFunction(this.options.viewport) ? this.options.viewport.call(this, this.$element) : (this.options.viewport.selector || this.options.viewport))\n this.inState = { click: false, hover: false, focus: false }\n\n if (this.$element[0] instanceof document.constructor && !this.options.selector) {\n throw new Error('`selector` option must be specified when initializing ' + this.type + ' on the window.document object!')\n }\n\n var triggers = this.options.trigger.split(' ')\n\n for (var i = triggers.length; i--;) {\n var trigger = triggers[i]\n\n if (trigger == 'click') {\n this.$element.on('click.' + this.type, this.options.selector, $.proxy(this.toggle, this))\n } else if (trigger != 'manual') {\n var eventIn = trigger == 'hover' ? 'mouseenter' : 'focusin'\n var eventOut = trigger == 'hover' ? 'mouseleave' : 'focusout'\n\n this.$element.on(eventIn + '.' + this.type, this.options.selector, $.proxy(this.enter, this))\n this.$element.on(eventOut + '.' + this.type, this.options.selector, $.proxy(this.leave, this))\n }\n }\n\n this.options.selector ?\n (this._options = $.extend({}, this.options, { trigger: 'manual', selector: '' })) :\n this.fixTitle()\n }\n\n Tooltip.prototype.getDefaults = function () {\n return Tooltip.DEFAULTS\n }\n\n Tooltip.prototype.getOptions = function (options) {\n options = $.extend({}, this.getDefaults(), this.$element.data(), options)\n\n if (options.delay && typeof options.delay == 'number') {\n options.delay = {\n show: options.delay,\n hide: options.delay\n }\n }\n\n return options\n }\n\n Tooltip.prototype.getDelegateOptions = function () {\n var options = {}\n var defaults = this.getDefaults()\n\n this._options && $.each(this._options, function (key, value) {\n if (defaults[key] != value) options[key] = value\n })\n\n return options\n }\n\n Tooltip.prototype.enter = function (obj) {\n var self = obj instanceof this.constructor ?\n obj : $(obj.currentTarget).data('bs.' + this.type)\n\n if (!self) {\n self = new this.constructor(obj.currentTarget, this.getDelegateOptions())\n $(obj.currentTarget).data('bs.' + this.type, self)\n }\n\n if (obj instanceof $.Event) {\n self.inState[obj.type == 'focusin' ? 'focus' : 'hover'] = true\n }\n\n if (self.tip().hasClass('in') || self.hoverState == 'in') {\n self.hoverState = 'in'\n return\n }\n\n clearTimeout(self.timeout)\n\n self.hoverState = 'in'\n\n if (!self.options.delay || !self.options.delay.show) return self.show()\n\n self.timeout = setTimeout(function () {\n if (self.hoverState == 'in') self.show()\n }, self.options.delay.show)\n }\n\n Tooltip.prototype.isInStateTrue = function () {\n for (var key in this.inState) {\n if (this.inState[key]) return true\n }\n\n return false\n }\n\n Tooltip.prototype.leave = function (obj) {\n var self = obj instanceof this.constructor ?\n obj : $(obj.currentTarget).data('bs.' + this.type)\n\n if (!self) {\n self = new this.constructor(obj.currentTarget, this.getDelegateOptions())\n $(obj.currentTarget).data('bs.' + this.type, self)\n }\n\n if (obj instanceof $.Event) {\n self.inState[obj.type == 'focusout' ? 'focus' : 'hover'] = false\n }\n\n if (self.isInStateTrue()) return\n\n clearTimeout(self.timeout)\n\n self.hoverState = 'out'\n\n if (!self.options.delay || !self.options.delay.hide) return self.hide()\n\n self.timeout = setTimeout(function () {\n if (self.hoverState == 'out') self.hide()\n }, self.options.delay.hide)\n }\n\n Tooltip.prototype.show = function () {\n var e = $.Event('show.bs.' + this.type)\n\n if (this.hasContent() && this.enabled) {\n this.$element.trigger(e)\n\n var inDom = $.contains(this.$element[0].ownerDocument.documentElement, this.$element[0])\n if (e.isDefaultPrevented() || !inDom) return\n var that = this\n\n var $tip = this.tip()\n\n var tipId = this.getUID(this.type)\n\n this.setContent()\n $tip.attr('id', tipId)\n this.$element.attr('aria-describedby', tipId)\n\n if (this.options.animation) $tip.addClass('fade')\n\n var placement = typeof this.options.placement == 'function' ?\n this.options.placement.call(this, $tip[0], this.$element[0]) :\n this.options.placement\n\n var autoToken = /\\s?auto?\\s?/i\n var autoPlace = autoToken.test(placement)\n if (autoPlace) placement = placement.replace(autoToken, '') || 'top'\n\n $tip\n .detach()\n .css({ top: 0, left: 0, display: 'block' })\n .addClass(placement)\n .data('bs.' + this.type, this)\n\n this.options.container ? $tip.appendTo(this.options.container) : $tip.insertAfter(this.$element)\n this.$element.trigger('inserted.bs.' + this.type)\n\n var pos = this.getPosition()\n var actualWidth = $tip[0].offsetWidth\n var actualHeight = $tip[0].offsetHeight\n\n if (autoPlace) {\n var orgPlacement = placement\n var viewportDim = this.getPosition(this.$viewport)\n\n placement = placement == 'bottom' && pos.bottom + actualHeight > viewportDim.bottom ? 'top' :\n placement == 'top' && pos.top - actualHeight < viewportDim.top ? 'bottom' :\n placement == 'right' && pos.right + actualWidth > viewportDim.width ? 'left' :\n placement == 'left' && pos.left - actualWidth < viewportDim.left ? 'right' :\n placement\n\n $tip\n .removeClass(orgPlacement)\n .addClass(placement)\n }\n\n var calculatedOffset = this.getCalculatedOffset(placement, pos, actualWidth, actualHeight)\n\n this.applyPlacement(calculatedOffset, placement)\n\n var complete = function () {\n var prevHoverState = that.hoverState\n that.$element.trigger('shown.bs.' + that.type)\n that.hoverState = null\n\n if (prevHoverState == 'out') that.leave(that)\n }\n\n $.support.transition && this.$tip.hasClass('fade') ?\n $tip\n .one('bsTransitionEnd', complete)\n .emulateTransitionEnd(Tooltip.TRANSITION_DURATION) :\n complete()\n }\n }\n\n Tooltip.prototype.applyPlacement = function (offset, placement) {\n var $tip = this.tip()\n var width = $tip[0].offsetWidth\n var height = $tip[0].offsetHeight\n\n // manually read margins because getBoundingClientRect includes difference\n var marginTop = parseInt($tip.css('margin-top'), 10)\n var marginLeft = parseInt($tip.css('margin-left'), 10)\n\n // we must check for NaN for ie 8/9\n if (isNaN(marginTop)) marginTop = 0\n if (isNaN(marginLeft)) marginLeft = 0\n\n offset.top += marginTop\n offset.left += marginLeft\n\n // $.fn.offset doesn't round pixel values\n // so we use setOffset directly with our own function B-0\n $.offset.setOffset($tip[0], $.extend({\n using: function (props) {\n $tip.css({\n top: Math.round(props.top),\n left: Math.round(props.left)\n })\n }\n }, offset), 0)\n\n $tip.addClass('in')\n\n // check to see if placing tip in new offset caused the tip to resize itself\n var actualWidth = $tip[0].offsetWidth\n var actualHeight = $tip[0].offsetHeight\n\n if (placement == 'top' && actualHeight != height) {\n offset.top = offset.top + height - actualHeight\n }\n\n var delta = this.getViewportAdjustedDelta(placement, offset, actualWidth, actualHeight)\n\n if (delta.left) offset.left += delta.left\n else offset.top += delta.top\n\n var isVertical = /top|bottom/.test(placement)\n var arrowDelta = isVertical ? delta.left * 2 - width + actualWidth : delta.top * 2 - height + actualHeight\n var arrowOffsetPosition = isVertical ? 'offsetWidth' : 'offsetHeight'\n\n $tip.offset(offset)\n this.replaceArrow(arrowDelta, $tip[0][arrowOffsetPosition], isVertical)\n }\n\n Tooltip.prototype.replaceArrow = function (delta, dimension, isVertical) {\n this.arrow()\n .css(isVertical ? 'left' : 'top', 50 * (1 - delta / dimension) + '%')\n .css(isVertical ? 'top' : 'left', '')\n }\n\n Tooltip.prototype.setContent = function () {\n var $tip = this.tip()\n var title = this.getTitle()\n\n $tip.find('.tooltip-inner')[this.options.html ? 'html' : 'text'](title)\n $tip.removeClass('fade in top bottom left right')\n }\n\n Tooltip.prototype.hide = function (callback) {\n var that = this\n var $tip = $(this.$tip)\n var e = $.Event('hide.bs.' + this.type)\n\n function complete() {\n if (that.hoverState != 'in') $tip.detach()\n if (that.$element) { // TODO: Check whether guarding this code with this `if` is really necessary.\n that.$element\n .removeAttr('aria-describedby')\n .trigger('hidden.bs.' + that.type)\n }\n callback && callback()\n }\n\n this.$element.trigger(e)\n\n if (e.isDefaultPrevented()) return\n\n $tip.removeClass('in')\n\n $.support.transition && $tip.hasClass('fade') ?\n $tip\n .one('bsTransitionEnd', complete)\n .emulateTransitionEnd(Tooltip.TRANSITION_DURATION) :\n complete()\n\n this.hoverState = null\n\n return this\n }\n\n Tooltip.prototype.fixTitle = function () {\n var $e = this.$element\n if ($e.attr('title') || typeof $e.attr('data-original-title') != 'string') {\n $e.attr('data-original-title', $e.attr('title') || '').attr('title', '')\n }\n }\n\n Tooltip.prototype.hasContent = function () {\n return this.getTitle()\n }\n\n Tooltip.prototype.getPosition = function ($element) {\n $element = $element || this.$element\n\n var el = $element[0]\n var isBody = el.tagName == 'BODY'\n\n var elRect = el.getBoundingClientRect()\n if (elRect.width == null) {\n // width and height are missing in IE8, so compute them manually; see https://github.com/twbs/bootstrap/issues/14093\n elRect = $.extend({}, elRect, { width: elRect.right - elRect.left, height: elRect.bottom - elRect.top })\n }\n var isSvg = window.SVGElement && el instanceof window.SVGElement\n // Avoid using $.offset() on SVGs since it gives incorrect results in jQuery 3.\n // See https://github.com/twbs/bootstrap/issues/20280\n var elOffset = isBody ? { top: 0, left: 0 } : (isSvg ? null : $element.offset())\n var scroll = { scroll: isBody ? document.documentElement.scrollTop || document.body.scrollTop : $element.scrollTop() }\n var outerDims = isBody ? { width: $(window).width(), height: $(window).height() } : null\n\n return $.extend({}, elRect, scroll, outerDims, elOffset)\n }\n\n Tooltip.prototype.getCalculatedOffset = function (placement, pos, actualWidth, actualHeight) {\n return placement == 'bottom' ? { top: pos.top + pos.height, left: pos.left + pos.width / 2 - actualWidth / 2 } :\n placement == 'top' ? { top: pos.top - actualHeight, left: pos.left + pos.width / 2 - actualWidth / 2 } :\n placement == 'left' ? { top: pos.top + pos.height / 2 - actualHeight / 2, left: pos.left - actualWidth } :\n /* placement == 'right' */ { top: pos.top + pos.height / 2 - actualHeight / 2, left: pos.left + pos.width }\n\n }\n\n Tooltip.prototype.getViewportAdjustedDelta = function (placement, pos, actualWidth, actualHeight) {\n var delta = { top: 0, left: 0 }\n if (!this.$viewport) return delta\n\n var viewportPadding = this.options.viewport && this.options.viewport.padding || 0\n var viewportDimensions = this.getPosition(this.$viewport)\n\n if (/right|left/.test(placement)) {\n var topEdgeOffset = pos.top - viewportPadding - viewportDimensions.scroll\n var bottomEdgeOffset = pos.top + viewportPadding - viewportDimensions.scroll + actualHeight\n if (topEdgeOffset < viewportDimensions.top) { // top overflow\n delta.top = viewportDimensions.top - topEdgeOffset\n } else if (bottomEdgeOffset > viewportDimensions.top + viewportDimensions.height) { // bottom overflow\n delta.top = viewportDimensions.top + viewportDimensions.height - bottomEdgeOffset\n }\n } else {\n var leftEdgeOffset = pos.left - viewportPadding\n var rightEdgeOffset = pos.left + viewportPadding + actualWidth\n if (leftEdgeOffset < viewportDimensions.left) { // left overflow\n delta.left = viewportDimensions.left - leftEdgeOffset\n } else if (rightEdgeOffset > viewportDimensions.right) { // right overflow\n delta.left = viewportDimensions.left + viewportDimensions.width - rightEdgeOffset\n }\n }\n\n return delta\n }\n\n Tooltip.prototype.getTitle = function () {\n var title\n var $e = this.$element\n var o = this.options\n\n title = $e.attr('data-original-title')\n || (typeof o.title == 'function' ? o.title.call($e[0]) : o.title)\n\n return title\n }\n\n Tooltip.prototype.getUID = function (prefix) {\n do prefix += ~~(Math.random() * 1000000)\n while (document.getElementById(prefix))\n return prefix\n }\n\n Tooltip.prototype.tip = function () {\n if (!this.$tip) {\n this.$tip = $(this.options.template)\n if (this.$tip.length != 1) {\n throw new Error(this.type + ' `template` option must consist of exactly 1 top-level element!')\n }\n }\n return this.$tip\n }\n\n Tooltip.prototype.arrow = function () {\n return (this.$arrow = this.$arrow || this.tip().find('.tooltip-arrow'))\n }\n\n Tooltip.prototype.enable = function () {\n this.enabled = true\n }\n\n Tooltip.prototype.disable = function () {\n this.enabled = false\n }\n\n Tooltip.prototype.toggleEnabled = function () {\n this.enabled = !this.enabled\n }\n\n Tooltip.prototype.toggle = function (e) {\n var self = this\n if (e) {\n self = $(e.currentTarget).data('bs.' + this.type)\n if (!self) {\n self = new this.constructor(e.currentTarget, this.getDelegateOptions())\n $(e.currentTarget).data('bs.' + this.type, self)\n }\n }\n\n if (e) {\n self.inState.click = !self.inState.click\n if (self.isInStateTrue()) self.enter(self)\n else self.leave(self)\n } else {\n self.tip().hasClass('in') ? self.leave(self) : self.enter(self)\n }\n }\n\n Tooltip.prototype.destroy = function () {\n var that = this\n clearTimeout(this.timeout)\n this.hide(function () {\n that.$element.off('.' + that.type).removeData('bs.' + that.type)\n if (that.$tip) {\n that.$tip.detach()\n }\n that.$tip = null\n that.$arrow = null\n that.$viewport = null\n that.$element = null\n })\n }\n\n\n // TOOLTIP PLUGIN DEFINITION\n // =========================\n\n function Plugin(option) {\n return this.each(function () {\n var $this = $(this)\n var data = $this.data('bs.tooltip')\n var options = typeof option == 'object' && option\n\n if (!data && /destroy|hide/.test(option)) return\n if (!data) $this.data('bs.tooltip', (data = new Tooltip(this, options)))\n if (typeof option == 'string') data[option]()\n })\n }\n\n var old = $.fn.tooltip\n\n $.fn.tooltip = Plugin\n $.fn.tooltip.Constructor = Tooltip\n\n\n // TOOLTIP NO CONFLICT\n // ===================\n\n $.fn.tooltip.noConflict = function () {\n $.fn.tooltip = old\n return this\n }\n\n}(jQuery);" repo = "twbs/bootstrap" url = "https://github.com/twbs/bootstrap.git" [[case]] advisory = "GHSA-ph58-4vrj-w6hr" advisory_text = "bootstrap Cross-site Scripting vulnerability\n\nIn Bootstrap before 3.4.0, XSS is possible in the affix configuration target property." commit = "2a5ba23ce8f041f3548317acc992ed8a736b609d" cwe = "CWE-79" family = "output_encoding" function = "function" function_lines = [[11, 212]] id = "twbs-bootstrap-d29d2c0e551ad5e8" language = "javascript" method = "fix_site" parent = "13bf8aeae3db71e28af69782328c22215795c169" path = "js/collapse.js" post_fix = "+function ($) {\n 'use strict';\n\n // COLLAPSE PUBLIC CLASS DEFINITION\n // ================================\n\n var Collapse = function (element, options) {\n this.$element = $(element)\n this.options = $.extend({}, Collapse.DEFAULTS, options)\n this.$trigger = $('[data-toggle=\"collapse\"][href=\"#' + element.id + '\"],' +\n '[data-toggle=\"collapse\"][data-target=\"#' + element.id + '\"]')\n this.transitioning = null\n\n if (this.options.parent) {\n this.$parent = this.getParent()\n } else {\n this.addAriaAndCollapsedClass(this.$element, this.$trigger)\n }\n\n if (this.options.toggle) this.toggle()\n }\n\n Collapse.VERSION = '3.4.0'\n\n Collapse.TRANSITION_DURATION = 350\n\n Collapse.DEFAULTS = {\n toggle: true\n }\n\n Collapse.prototype.dimension = function () {\n var hasWidth = this.$element.hasClass('width')\n return hasWidth ? 'width' : 'height'\n }\n\n Collapse.prototype.show = function () {\n if (this.transitioning || this.$element.hasClass('in')) return\n\n var activesData\n var actives = this.$parent && this.$parent.children('.panel').children('.in, .collapsing')\n\n if (actives && actives.length) {\n activesData = actives.data('bs.collapse')\n if (activesData && activesData.transitioning) return\n }\n\n var startEvent = $.Event('show.bs.collapse')\n this.$element.trigger(startEvent)\n if (startEvent.isDefaultPrevented()) return\n\n if (actives && actives.length) {\n Plugin.call(actives, 'hide')\n activesData || actives.data('bs.collapse', null)\n }\n\n var dimension = this.dimension()\n\n this.$element\n .removeClass('collapse')\n .addClass('collapsing')[dimension](0)\n .attr('aria-expanded', true)\n\n this.$trigger\n .removeClass('collapsed')\n .attr('aria-expanded', true)\n\n this.transitioning = 1\n\n var complete = function () {\n this.$element\n .removeClass('collapsing')\n .addClass('collapse in')[dimension]('')\n this.transitioning = 0\n this.$element\n .trigger('shown.bs.collapse')\n }\n\n if (!$.support.transition) return complete.call(this)\n\n var scrollSize = $.camelCase(['scroll', dimension].join('-'))\n\n this.$element\n .one('bsTransitionEnd', $.proxy(complete, this))\n .emulateTransitionEnd(Collapse.TRANSITION_DURATION)[dimension](this.$element[0][scrollSize])\n }\n\n Collapse.prototype.hide = function () {\n if (this.transitioning || !this.$element.hasClass('in')) return\n\n var startEvent = $.Event('hide.bs.collapse')\n this.$element.trigger(startEvent)\n if (startEvent.isDefaultPrevented()) return\n\n var dimension = this.dimension()\n\n this.$element[dimension](this.$element[dimension]())[0].offsetHeight\n\n this.$element\n .addClass('collapsing')\n .removeClass('collapse in')\n .attr('aria-expanded', false)\n\n this.$trigger\n .addClass('collapsed')\n .attr('aria-expanded', false)\n\n this.transitioning = 1\n\n var complete = function () {\n this.transitioning = 0\n this.$element\n .removeClass('collapsing')\n .addClass('collapse')\n .trigger('hidden.bs.collapse')\n }\n\n if (!$.support.transition) return complete.call(this)\n\n this.$element\n [dimension](0)\n .one('bsTransitionEnd', $.proxy(complete, this))\n .emulateTransitionEnd(Collapse.TRANSITION_DURATION)\n }\n\n Collapse.prototype.toggle = function () {\n this[this.$element.hasClass('in') ? 'hide' : 'show']()\n }\n\n Collapse.prototype.getParent = function () {\n return $(document).find(this.options.parent)\n .find('[data-toggle=\"collapse\"][data-parent=\"' + this.options.parent + '\"]')\n .each($.proxy(function (i, element) {\n var $element = $(element)\n this.addAriaAndCollapsedClass(getTargetFromTrigger($element), $element)\n }, this))\n .end()\n }\n\n Collapse.prototype.addAriaAndCollapsedClass = function ($element, $trigger) {\n var isOpen = $element.hasClass('in')\n\n $element.attr('aria-expanded', isOpen)\n $trigger\n .toggleClass('collapsed', !isOpen)\n .attr('aria-expanded', isOpen)\n }\n\n function getTargetFromTrigger($trigger) {\n var href\n var target = $trigger.attr('data-target')\n || (href = $trigger.attr('href')) && href.replace(/.*(?=#[^\\s]+$)/, '') // strip for ie7\n\n return $(document).find(target)\n }\n\n\n // COLLAPSE PLUGIN DEFINITION\n // ==========================\n\n function Plugin(option) {\n return this.each(function () {\n var $this = $(this)\n var data = $this.data('bs.collapse')\n var options = $.extend({}, Collapse.DEFAULTS, $this.data(), typeof option == 'object' && option)\n\n if (!data && options.toggle && /show|hide/.test(option)) options.toggle = false\n if (!data) $this.data('bs.collapse', (data = new Collapse(this, options)))\n if (typeof option == 'string') data[option]()\n })\n }\n\n var old = $.fn.collapse\n\n $.fn.collapse = Plugin\n $.fn.collapse.Constructor = Collapse\n\n\n // COLLAPSE NO CONFLICT\n // ====================\n\n $.fn.collapse.noConflict = function () {\n $.fn.collapse = old\n return this\n }\n\n\n // COLLAPSE DATA-API\n // =================\n\n $(document).on('click.bs.collapse.data-api', '[data-toggle=\"collapse\"]', function (e) {\n var $this = $(this)\n\n if (!$this.attr('data-target')) e.preventDefault()\n\n var $target = getTargetFromTrigger($this)\n var data = $target.data('bs.collapse')\n var option = data ? 'toggle' : $this.data()\n\n Plugin.call($target, option)\n })\n\n}(jQuery);" pre_fix = "+function ($) {\n 'use strict';\n\n // COLLAPSE PUBLIC CLASS DEFINITION\n // ================================\n\n var Collapse = function (element, options) {\n this.$element = $(element)\n this.options = $.extend({}, Collapse.DEFAULTS, options)\n this.$trigger = $('[data-toggle=\"collapse\"][href=\"#' + element.id + '\"],' +\n '[data-toggle=\"collapse\"][data-target=\"#' + element.id + '\"]')\n this.transitioning = null\n\n if (this.options.parent) {\n this.$parent = this.getParent()\n } else {\n this.addAriaAndCollapsedClass(this.$element, this.$trigger)\n }\n\n if (this.options.toggle) this.toggle()\n }\n\n Collapse.VERSION = '3.4.0'\n\n Collapse.TRANSITION_DURATION = 350\n\n Collapse.DEFAULTS = {\n toggle: true\n }\n\n Collapse.prototype.dimension = function () {\n var hasWidth = this.$element.hasClass('width')\n return hasWidth ? 'width' : 'height'\n }\n\n Collapse.prototype.show = function () {\n if (this.transitioning || this.$element.hasClass('in')) return\n\n var activesData\n var actives = this.$parent && this.$parent.children('.panel').children('.in, .collapsing')\n\n if (actives && actives.length) {\n activesData = actives.data('bs.collapse')\n if (activesData && activesData.transitioning) return\n }\n\n var startEvent = $.Event('show.bs.collapse')\n this.$element.trigger(startEvent)\n if (startEvent.isDefaultPrevented()) return\n\n if (actives && actives.length) {\n Plugin.call(actives, 'hide')\n activesData || actives.data('bs.collapse', null)\n }\n\n var dimension = this.dimension()\n\n this.$element\n .removeClass('collapse')\n .addClass('collapsing')[dimension](0)\n .attr('aria-expanded', true)\n\n this.$trigger\n .removeClass('collapsed')\n .attr('aria-expanded', true)\n\n this.transitioning = 1\n\n var complete = function () {\n this.$element\n .removeClass('collapsing')\n .addClass('collapse in')[dimension]('')\n this.transitioning = 0\n this.$element\n .trigger('shown.bs.collapse')\n }\n\n if (!$.support.transition) return complete.call(this)\n\n var scrollSize = $.camelCase(['scroll', dimension].join('-'))\n\n this.$element\n .one('bsTransitionEnd', $.proxy(complete, this))\n .emulateTransitionEnd(Collapse.TRANSITION_DURATION)[dimension](this.$element[0][scrollSize])\n }\n\n Collapse.prototype.hide = function () {\n if (this.transitioning || !this.$element.hasClass('in')) return\n\n var startEvent = $.Event('hide.bs.collapse')\n this.$element.trigger(startEvent)\n if (startEvent.isDefaultPrevented()) return\n\n var dimension = this.dimension()\n\n this.$element[dimension](this.$element[dimension]())[0].offsetHeight\n\n this.$element\n .addClass('collapsing')\n .removeClass('collapse in')\n .attr('aria-expanded', false)\n\n this.$trigger\n .addClass('collapsed')\n .attr('aria-expanded', false)\n\n this.transitioning = 1\n\n var complete = function () {\n this.transitioning = 0\n this.$element\n .removeClass('collapsing')\n .addClass('collapse')\n .trigger('hidden.bs.collapse')\n }\n\n if (!$.support.transition) return complete.call(this)\n\n this.$element\n [dimension](0)\n .one('bsTransitionEnd', $.proxy(complete, this))\n .emulateTransitionEnd(Collapse.TRANSITION_DURATION)\n }\n\n Collapse.prototype.toggle = function () {\n this[this.$element.hasClass('in') ? 'hide' : 'show']()\n }\n\n Collapse.prototype.getParent = function () {\n return $(this.options.parent)\n .find('[data-toggle=\"collapse\"][data-parent=\"' + this.options.parent + '\"]')\n .each($.proxy(function (i, element) {\n var $element = $(element)\n this.addAriaAndCollapsedClass(getTargetFromTrigger($element), $element)\n }, this))\n .end()\n }\n\n Collapse.prototype.addAriaAndCollapsedClass = function ($element, $trigger) {\n var isOpen = $element.hasClass('in')\n\n $element.attr('aria-expanded', isOpen)\n $trigger\n .toggleClass('collapsed', !isOpen)\n .attr('aria-expanded', isOpen)\n }\n\n function getTargetFromTrigger($trigger) {\n var href\n var target = $trigger.attr('data-target')\n || (href = $trigger.attr('href')) && href.replace(/.*(?=#[^\\s]+$)/, '') // strip for ie7\n\n return $(document).find(target)\n }\n\n\n // COLLAPSE PLUGIN DEFINITION\n // ==========================\n\n function Plugin(option) {\n return this.each(function () {\n var $this = $(this)\n var data = $this.data('bs.collapse')\n var options = $.extend({}, Collapse.DEFAULTS, $this.data(), typeof option == 'object' && option)\n\n if (!data && options.toggle && /show|hide/.test(option)) options.toggle = false\n if (!data) $this.data('bs.collapse', (data = new Collapse(this, options)))\n if (typeof option == 'string') data[option]()\n })\n }\n\n var old = $.fn.collapse\n\n $.fn.collapse = Plugin\n $.fn.collapse.Constructor = Collapse\n\n\n // COLLAPSE NO CONFLICT\n // ====================\n\n $.fn.collapse.noConflict = function () {\n $.fn.collapse = old\n return this\n }\n\n\n // COLLAPSE DATA-API\n // =================\n\n $(document).on('click.bs.collapse.data-api', '[data-toggle=\"collapse\"]', function (e) {\n var $this = $(this)\n\n if (!$this.attr('data-target')) e.preventDefault()\n\n var $target = getTargetFromTrigger($this)\n var data = $target.data('bs.collapse')\n var option = data ? 'toggle' : $this.data()\n\n Plugin.call($target, option)\n })\n\n}(jQuery);" repo = "twbs/bootstrap" url = "https://github.com/twbs/bootstrap.git" [[case]] advisory = "GHSA-84jw-g43v-8gjm" advisory_text = "DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS\n\nHi, Rspack|Webpack developer team!\n\n## Summary\nWe discovered a DOM Clobbering vulnerability in Webpack’s AutoPublicPathRuntimeModule. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present.\n\nWe found the real-world exploitation of this gadget in the Canvas LMS which allows XSS attack happens through an javascript code compiled by Webpack (the vulnerable part is from Webpack). We believe this is a severe issue. If Webpack’s code is not resilient to DOM Clobbering attacks, it could lead to significant security vulnerabilities in any web application using Webpack-compiled code.\n\n## Details\n### Backgrounds\nDOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references:\n\n[1] [scnps.co/papers/sp23_domclob.pdf](https://scnps.co/papers/sp23_domclob.pdf)\n[2] [research.securitum.com/xss-in-amp4email-dom-clobbering](https://research.securitum.com/xss-in-amp4email-dom-clobbering/)\n\n### Gadgets found in Webpack | Rspack\nWe identified a DOM Clobbering vulnerability in Webpack’s AutoPublicPathRuntimeModule. When the output.publicPath field in the configuration is not set or is set to auto, the following code is generated in the bundle to dynamically resolve and load additional JavaScript files:\n```js\n/******/ \t/* webpack/runtime/publicPath */\n/******/ \t(() => {\n/******/ \t\tvar scriptUrl;\n/******/ \t\tif (__webpack_require__.g.importScripts) scriptUrl = __webpack_require__.g.location + \"\";\n/******/ \t\tvar document = __webpack_require__.g.document;\n/******/ \t\tif (!scriptUrl && document) {\n/******/ \t\t\tif (document.currentScript)\n/******/ \t\t\t\tscriptUrl = document.currentScript.src;\n/******/ \t\t\tif (!scriptUrl) {\n/******/ \t\t\t\tvar scripts = document.getElementsByTagName(\"script\");\n/******/ \t\t\t\tif(scripts.length) {\n/******/ \t\t\t\t\tvar i = scripts.length - 1;\n/******/ \t\t\t\t\twhile (i > -1 && (!scriptUrl || !/^http(s?):/.test(scriptUrl))) scriptUrl = scripts[i--].src;\n/******/ \t\t\t\t}\n/******/ \t\t\t}\n/******/ \t\t}\n/******/ \t\t// When supporting browsers where an automatic publicPath is not supported you must specify an output.publicPath manually via configuration\n/******/ \t\t// or pass an empty string (\"\") and set the __webpack_public_path__ variable from your code to use your own logic.\n/******/ \t\tif (!scriptUrl) throw new Error(\"Automatic publicPath is not supported in this browser\");\n/******/ \t\tscriptUrl = scriptUrl.replace(/#.*$/, \"\").replace(/\\?.*$/, \"\").replace(/\\/[^\\/]+$/, \"/\");\n/******/ \t\t__webpack_require__.p = scriptUrl;\n/******/ \t})();\n```\nHowever, this code is vulnerable to a DOM Clobbering attack. The lookup on the line with document.currentScript can be shadowed by an attacker, causing it to return an attacker-controlled HTML element instead of the current script element as intended. In such a scenario, the src attribute of the attacker-controlled element will be used as the scriptUrl and assigned to __webpack_require__.p. If additional scripts are loaded from the server, __webpack_require__.p will be used as the base URL, pointing to the attacker's domain. This could lead to arbitrary script loading from the attacker's server, resulting in severe security risks.\n\n## PoC\nPlease note that we have identified a real-world exploitation of this vulnerability in the Canvas LMS. Once the issue has been patched, I am willing to share more details on the exploitation. For now, I’m providing a demo to illustrate the concept.\n\nConsider a website developer with the following two scripts, entry.js and import1.js, that are compiled using Webpack:\n```js\n// entry.js\nimport('./import1.js')\n .then(module => {\n module.hello();\n })\n .catch(err => {\n console.error('Failed to load module', err);\n });\n```\n```js\n// import1.js\nexport function hello () {\n console.log('Hello');\n}\nThe webpack.config.js is set up as follows:\n\nconst path = require('path');\n\nmodule.exports = {\n entry: './entry.js', // Ensure the correct path to your entry file\n output: {\n filename: 'webpack-gadgets.bundle.js', // Output bundle file\n path: path.resolve(__dirname, 'dist'), // Output directory\n publicPath: \"auto\", // Or leave this field not set\n },\n target: 'web',\n mode: 'development',\n};\n```\nWhen the developer builds these scripts into a bundle and adds it to a webpage, the page could load the import1.js file from the attacker's domain, attacker.controlled.server. The attacker only needs to insert an img tag with the name attribute set to currentScript. This can be done through a website's feature that allows users to embed certain script-less HTML (e.g., markdown renderers, web email clients, forums) or via an HTML injection vulnerability in third-party JavaScript loaded on the page.\n```html\n\n\n\n Webpack Example\n \n

\n \n\n\n\n\n\n```\n## Impact\nThis vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes.\n\n## Patch\nA possible patch to this vulnerability could refer to the Google Closure project which makes itself resistant to DOM Clobbering attack: [google/closure-library@b312823/closure/goog/base.js#L174](https://github.com/google/closure-library/blob/b312823ec5f84239ff1db7526f4a75cba0420a33/closure/goog/base.js#L174)\n```js\n/******/ \t/* webpack/runtime/publicPath */\n/******/ \t(() => {\n/******/ \t\tvar scriptUrl;\n/******/ \t\tif (__webpack_require__.g.importScripts) scriptUrl = __webpack_require__.g.location + \"\";\n/******/ \t\tvar document = __webpack_require__.g.document;\n/******/ \t\tif (!scriptUrl && document) {\n/******/ \t\t\tif (document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT') // Assume attacker cannot control script tag, otherwise it is XSS already :>\n/******/ \t\t\t\tscriptUrl = document.currentScript.src;\n/******/ \t\t\tif (!scriptUrl) {\n/******/ \t\t\t\tvar scripts = document.getElementsByTagName(\"script\");\n/******/ \t\t\t\tif(scripts.length) {\n/******/ \t\t\t\t\tvar i = scripts.length - 1;\n/******/ \t\t\t\t\twhile (i > -1 && (!scriptUrl || !/^http(s?):/.test(scriptUrl))) scriptUrl = scripts[i--].src;\n/******/ \t\t\t\t}\n/******/ \t\t\t}\n/******/ \t\t}\n/******/ \t\t// When supporting browsers where an automatic publicPath is not supported you must specify an output.publicPath manually via configuration\n/******/ \t\t// or pass an empty string (\"\") and set the __webpack_public_path__ variable from your code to use your own logic.\n/******/ \t\tif (!scriptUrl) throw new Error(\"Automatic publicPath is not supported in this browser\");\n/******/ \t\tscriptUrl = scriptUrl.replace(/#.*$/, \"\").replace(/\\?.*$/, \"\").replace(/\\/[^\\/]+$/, \"/\");\n/******/ \t\t__webpack_require__.p = scriptUrl;\n/******/ \t})();\n```\nPlease note that if we do not receive a response from the development team within three months, we will disclose this vulnerability to the CVE agent." commit = "0303c68bd76da258c9fd483936d3a00b9761aad0" cwe = "CWE-79" family = "output_encoding" function = "applyOutputDefaults" function_lines = [[509, 832]] id = "web-infra-dev-rspack-c788948210260bd9" language = "typescript" method = "fix_site" parent = "b96bf7dee38c0d7ccccfc63b2e48186b4460e2f0" path = "packages/rspack/src/config/defaults.ts" post_fix = "const applyOutputDefaults = (\n\toutput: OutputNormalized,\n\t{\n\t\tcontext,\n\t\toutputModule,\n\t\ttargetProperties: tp,\n\t\tisAffectedByBrowserslist,\n\t\tdevelopment,\n\t\tentry,\n\t\tfutureDefaults\n\t}: {\n\t\tcontext: Context;\n\t\toutputModule?: boolean;\n\t\ttargetProperties: any;\n\t\tisAffectedByBrowserslist: boolean;\n\t\tdevelopment: boolean;\n\t\tentry: EntryNormalized;\n\t\tfutureDefaults: boolean;\n\t}\n) => {\n\tconst getLibraryName = (library: Library): string => {\n\t\tconst libraryName =\n\t\t\ttypeof library === \"object\" &&\n\t\t\tlibrary &&\n\t\t\t!Array.isArray(library) &&\n\t\t\t\"type\" in library\n\t\t\t\t? library.name\n\t\t\t\t: library;\n\t\tif (Array.isArray(libraryName)) {\n\t\t\treturn libraryName.join(\".\");\n\t\t}\n\t\tif (typeof libraryName === \"object\") {\n\t\t\treturn getLibraryName(libraryName.root);\n\t\t}\n\t\tif (typeof libraryName === \"string\") {\n\t\t\treturn libraryName;\n\t\t}\n\t\treturn \"\";\n\t};\n\tF(output, \"uniqueName\", () => {\n\t\tconst libraryName = getLibraryName(output.library).replace(\n\t\t\t/^\\[(\\\\*[\\w:]+\\\\*)\\](\\.)|(\\.)\\[(\\\\*[\\w:]+\\\\*)\\](?=\\.|$)|\\[(\\\\*[\\w:]+\\\\*)\\]/g,\n\t\t\t(m, a, d1, d2, b, c) => {\n\t\t\t\tconst content = a || b || c;\n\t\t\t\treturn content.startsWith(\"\\\\\") && content.endsWith(\"\\\\\")\n\t\t\t\t\t? `${d2 || \"\"}[${content.slice(1, -1)}]${d1 || \"\"}`\n\t\t\t\t\t: \"\";\n\t\t\t}\n\t\t);\n\t\tif (libraryName) return libraryName;\n\t\tconst pkgPath = path.resolve(context, \"package.json\");\n\t\ttry {\n\t\t\tconst packageInfo = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n\t\t\treturn packageInfo.name || \"\";\n\t\t} catch (err) {\n\t\t\tconst e = err as Error & { code: string };\n\t\t\tif (e.code !== \"ENOENT\") {\n\t\t\t\te.message += `\\nwhile determining default 'output.uniqueName' from 'name' in ${pkgPath}`;\n\t\t\t\tthrow e;\n\t\t\t}\n\t\t\treturn \"\";\n\t\t}\n\t});\n\tF(output, \"devtoolNamespace\", () => output.uniqueName);\n\tF(output, \"module\", () => !!outputModule);\n\tD(output, \"filename\", output.module ? \"[name].mjs\" : \"[name].js\");\n\tF(output, \"iife\", () => !output.module);\n\n\tF(output, \"chunkFilename\", () => {\n\t\tconst filename = output.filename!;\n\t\tif (typeof filename !== \"function\") {\n\t\t\tconst hasName = filename.includes(\"[name]\");\n\t\t\tconst hasId = filename.includes(\"[id]\");\n\t\t\tconst hasChunkHash = filename.includes(\"[chunkhash]\");\n\t\t\tconst hasContentHash = filename.includes(\"[contenthash]\");\n\t\t\t// Anything changing depending on chunk is fine\n\t\t\tif (hasChunkHash || hasContentHash || hasName || hasId) return filename;\n\t\t\t// Otherwise prefix \"[id].\" in front of the basename to make it changing\n\t\t\treturn filename.replace(/(^|\\/)([^/]*(?:\\?|$))/, \"$1[id].$2\");\n\t\t}\n\t\treturn \"[id].js\";\n\t});\n\tF(output, \"cssFilename\", () => {\n\t\tconst filename = output.filename!;\n\t\tif (typeof filename !== \"function\") {\n\t\t\treturn filename.replace(/\\.[mc]?js(\\?|$)/, \".css$1\");\n\t\t}\n\t\treturn \"[id].css\";\n\t});\n\tF(output, \"cssChunkFilename\", () => {\n\t\tconst chunkFilename = output.chunkFilename!;\n\t\tif (typeof chunkFilename !== \"function\") {\n\t\t\treturn chunkFilename.replace(/\\.[mc]?js(\\?|$)/, \".css$1\");\n\t\t}\n\t\treturn \"[id].css\";\n\t});\n\tD(\n\t\toutput,\n\t\t\"hotUpdateChunkFilename\",\n\t\t`[id].[fullhash].hot-update.${output.module ? \"mjs\" : \"js\"}`\n\t);\n\tD(output, \"hotUpdateMainFilename\", \"[runtime].[fullhash].hot-update.json\");\n\n\tconst uniqueNameId = Template.toIdentifier(output.uniqueName);\n\tF(output, \"hotUpdateGlobal\", () => `webpackHotUpdate${uniqueNameId}`);\n\tF(output, \"chunkLoadingGlobal\", () => `webpackChunk${uniqueNameId}`);\n\tD(output, \"cssHeadDataCompression\", !development);\n\tD(output, \"assetModuleFilename\", \"[hash][ext][query]\");\n\tD(output, \"webassemblyModuleFilename\", \"[hash].module.wasm\");\n\tF(output, \"path\", () => path.join(process.cwd(), \"dist\"));\n\tF(output, \"pathinfo\", () => development);\n\tD(\n\t\toutput,\n\t\t\"publicPath\",\n\t\ttp && (tp.document || tp.importScripts) ? \"auto\" : \"\"\n\t);\n\n\tD(output, \"hashFunction\", futureDefaults ? \"xxhash64\" : \"md4\");\n\tD(output, \"hashDigest\", \"hex\");\n\tD(output, \"hashDigestLength\", futureDefaults ? 16 : 20);\n\tD(output, \"strictModuleErrorHandling\", false);\n\tif (output.library) {\n\t\tF(output.library, \"type\", () => (output.module ? \"module\" : \"var\"));\n\t}\n\tF(output, \"chunkFormat\", () => {\n\t\tif (tp) {\n\t\t\tconst helpMessage = isAffectedByBrowserslist\n\t\t\t\t? \"Make sure that your 'browserslist' includes only platforms that support these features or select an appropriate 'target' to allow selecting a chunk format by default. Alternatively specify the 'output.chunkFormat' directly.\"\n\t\t\t\t: \"Select an appropriate 'target' to allow selecting one by default, or specify the 'output.chunkFormat' directly.\";\n\t\t\tif (output.module) {\n\t\t\t\tif (tp.dynamicImport) return \"module\";\n\t\t\t\tif (tp.document) return \"array-push\";\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`For the selected environment is no default ESM chunk format available:\\nESM exports can be chosen when 'import()' is available.\\nJSONP Array push can be chosen when 'document' is available.\\n${helpMessage}`\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (tp.document) return \"array-push\";\n\t\t\tif (tp.require) return \"commonjs\";\n\t\t\tif (tp.nodeBuiltins) return \"commonjs\";\n\t\t\tif (tp.importScripts) return \"array-push\";\n\t\t\tthrow new Error(\n\t\t\t\t`For the selected environment is no default script chunk format available:\\nJSONP Array push can be chosen when 'document' or 'importScripts' is available.\\nCommonJs exports can be chosen when 'require' or node builtins are available.\\n${helpMessage}`\n\t\t\t);\n\t\t}\n\t\tthrow new Error(\n\t\t\t\"Chunk format can't be selected by default when no target is specified\"\n\t\t);\n\t});\n\tD(output, \"asyncChunks\", true);\n\tF(output, \"chunkLoading\", () => {\n\t\tif (tp) {\n\t\t\tswitch (output.chunkFormat) {\n\t\t\t\tcase \"array-push\":\n\t\t\t\t\tif (tp.document) return \"jsonp\";\n\t\t\t\t\tif (tp.importScripts) return \"import-scripts\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"commonjs\":\n\t\t\t\t\tif (tp.require) return \"require\";\n\t\t\t\t\tif (tp.nodeBuiltins) return \"async-node\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"module\":\n\t\t\t\t\tif (tp.dynamicImport) return \"import\";\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (\n\t\t\t\ttp.require === null ||\n\t\t\t\ttp.nodeBuiltins === null ||\n\t\t\t\ttp.document === null ||\n\t\t\t\ttp.importScripts === null\n\t\t\t) {\n\t\t\t\treturn \"universal\";\n\t\t\t}\n\t\t}\n\t\treturn false;\n\t});\n\tF(output, \"workerChunkLoading\", () => {\n\t\tif (tp) {\n\t\t\tswitch (output.chunkFormat) {\n\t\t\t\tcase \"array-push\":\n\t\t\t\t\tif (tp.importScriptsInWorker) return \"import-scripts\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"commonjs\":\n\t\t\t\t\tif (tp.require) return \"require\";\n\t\t\t\t\tif (tp.nodeBuiltins) return \"async-node\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"module\":\n\t\t\t\t\tif (tp.dynamicImportInWorker) return \"import\";\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (\n\t\t\t\ttp.require === null ||\n\t\t\t\ttp.nodeBuiltins === null ||\n\t\t\t\ttp.importScriptsInWorker === null\n\t\t\t) {\n\t\t\t\treturn \"universal\";\n\t\t\t}\n\t\t}\n\t\treturn false;\n\t});\n\tF(output, \"wasmLoading\", () => {\n\t\tif (tp) {\n\t\t\tif (tp.fetchWasm) return \"fetch\";\n\t\t\tif (tp.nodeBuiltins)\n\t\t\t\treturn output.module ? \"async-node-module\" : \"async-node\";\n\t\t\tif (tp.nodeBuiltins === null || tp.fetchWasm === null) {\n\t\t\t\treturn \"universal\";\n\t\t\t}\n\t\t}\n\t\treturn false;\n\t});\n\tF(output, \"workerWasmLoading\", () => output.wasmLoading);\n\tF(output, \"globalObject\", () => {\n\t\tif (tp) {\n\t\t\tif (tp.global) return \"global\";\n\t\t\tif (tp.globalThis) return \"globalThis\";\n\t\t}\n\t\treturn \"self\";\n\t});\n\tD(output, \"importFunctionName\", \"import\");\n\tD(output, \"importMetaName\", \"import.meta\");\n\t// IGNORE(output.clean): The default value of `output.clean` in webpack is undefined, but it has the same effect as false.\n\tF(output, \"clean\", () => !!output.clean);\n\tD(output, \"crossOriginLoading\", false);\n\tD(output, \"workerPublicPath\", \"\");\n\tD(output, \"sourceMapFilename\", \"[file].map[query]\");\n\tF(output, \"scriptType\", () => (output.module ? \"module\" : false));\n\tD(output, \"charset\", true);\n\tD(output, \"chunkLoadTimeout\", 120000);\n\n\tconst { trustedTypes } = output;\n\tif (trustedTypes) {\n\t\tF(\n\t\t\ttrustedTypes,\n\t\t\t\"policyName\",\n\t\t\t() =>\n\t\t\t\toutput.uniqueName!.replace(/[^a-zA-Z0-9\\-#=_/@.%]+/g, \"_\") || \"webpack\"\n\t\t);\n\t}\n\n\tconst forEachEntry = (fn: (desc: EntryDescriptionNormalized) => void) => {\n\t\tif (typeof entry === \"function\") {\n\t\t\treturn;\n\t\t}\n\t\tfor (const name of Object.keys(entry)) {\n\t\t\tfn(entry[name]);\n\t\t}\n\t};\n\tA(output, \"enabledLibraryTypes\", () => {\n\t\tconst enabledLibraryTypes = [];\n\t\tif (output.library) {\n\t\t\tenabledLibraryTypes.push(output.library.type);\n\t\t}\n\t\tforEachEntry(desc => {\n\t\t\tif (desc.library) {\n\t\t\t\tenabledLibraryTypes.push(desc.library.type);\n\t\t\t}\n\t\t});\n\t\treturn enabledLibraryTypes;\n\t});\n\tA(output, \"enabledChunkLoadingTypes\", () => {\n\t\tconst enabledChunkLoadingTypes = new Set();\n\t\tif (output.chunkLoading) {\n\t\t\tenabledChunkLoadingTypes.add(output.chunkLoading);\n\t\t}\n\t\tif (output.workerChunkLoading) {\n\t\t\tenabledChunkLoadingTypes.add(output.workerChunkLoading);\n\t\t}\n\t\tforEachEntry(desc => {\n\t\t\tif (desc.chunkLoading) {\n\t\t\t\tenabledChunkLoadingTypes.add(desc.chunkLoading);\n\t\t\t}\n\t\t});\n\t\treturn Array.from(enabledChunkLoadingTypes);\n\t});\n\tA(output, \"enabledWasmLoadingTypes\", () => {\n\t\tconst enabledWasmLoadingTypes = new Set();\n\t\tif (output.wasmLoading) {\n\t\t\tenabledWasmLoadingTypes.add(output.wasmLoading);\n\t\t}\n\t\tif (output.workerWasmLoading) {\n\t\t\tenabledWasmLoadingTypes.add(output.workerWasmLoading);\n\t\t}\n\t\t// forEachEntry(desc => {\n\t\t// \tif (desc.wasmLoading) {\n\t\t// \t\tenabledWasmLoadingTypes.add(desc.wasmLoading);\n\t\t// \t}\n\t\t// });\n\t\treturn Array.from(enabledWasmLoadingTypes);\n\t});\n\n\tconst environment = output.environment!;\n\tconst optimistic = (v?: boolean) => v || v === undefined;\n\tconst conditionallyOptimistic = (v?: boolean, c?: boolean) =>\n\t\t(v === undefined && c) || v;\n\n\tF(environment, \"globalThis\", () => tp?.globalThis);\n\tF(environment, \"bigIntLiteral\", () => tp && optimistic(tp.bigIntLiteral));\n\tF(environment, \"const\", () => tp && optimistic(tp.const));\n\tF(environment, \"arrowFunction\", () => tp && optimistic(tp.arrowFunction));\n\tF(environment, \"asyncFunction\", () => tp && optimistic(tp.asyncFunction));\n\tF(environment, \"forOf\", () => tp && optimistic(tp.forOf));\n\tF(environment, \"destructuring\", () => tp && optimistic(tp.destructuring));\n\tF(\n\t\tenvironment,\n\t\t\"optionalChaining\",\n\t\t() => tp && optimistic(tp.optionalChaining)\n\t);\n\tF(\n\t\tenvironment,\n\t\t\"nodePrefixForCoreModules\",\n\t\t() => tp && optimistic(tp.nodePrefixForCoreModules)\n\t);\n\tF(environment, \"templateLiteral\", () => tp && optimistic(tp.templateLiteral));\n\tF(environment, \"dynamicImport\", () =>\n\t\tconditionallyOptimistic(tp?.dynamicImport, output.module)\n\t);\n\tF(environment, \"dynamicImportInWorker\", () =>\n\t\tconditionallyOptimistic(tp?.dynamicImportInWorker, output.module)\n\t);\n\tF(environment, \"module\", () =>\n\t\tconditionallyOptimistic(tp?.module, output.module)\n\t);\n\tF(environment, \"document\", () => tp && optimistic(tp.document));\n};" pre_fix = "const applyOutputDefaults = (\n\toutput: OutputNormalized,\n\t{\n\t\tcontext,\n\t\toutputModule,\n\t\ttargetProperties: tp,\n\t\tisAffectedByBrowserslist,\n\t\tdevelopment,\n\t\tentry,\n\t\tfutureDefaults\n\t}: {\n\t\tcontext: Context;\n\t\toutputModule?: boolean;\n\t\ttargetProperties: any;\n\t\tisAffectedByBrowserslist: boolean;\n\t\tdevelopment: boolean;\n\t\tentry: EntryNormalized;\n\t\tfutureDefaults: boolean;\n\t}\n) => {\n\tconst getLibraryName = (library: Library): string => {\n\t\tconst libraryName =\n\t\t\ttypeof library === \"object\" &&\n\t\t\tlibrary &&\n\t\t\t!Array.isArray(library) &&\n\t\t\t\"type\" in library\n\t\t\t\t? library.name\n\t\t\t\t: library;\n\t\tif (Array.isArray(libraryName)) {\n\t\t\treturn libraryName.join(\".\");\n\t\t}\n\t\tif (typeof libraryName === \"object\") {\n\t\t\treturn getLibraryName(libraryName.root);\n\t\t}\n\t\tif (typeof libraryName === \"string\") {\n\t\t\treturn libraryName;\n\t\t}\n\t\treturn \"\";\n\t};\n\tF(output, \"uniqueName\", () => {\n\t\tconst libraryName = getLibraryName(output.library).replace(\n\t\t\t/^\\[(\\\\*[\\w:]+\\\\*)\\](\\.)|(\\.)\\[(\\\\*[\\w:]+\\\\*)\\](?=\\.|$)|\\[(\\\\*[\\w:]+\\\\*)\\]/g,\n\t\t\t(m, a, d1, d2, b, c) => {\n\t\t\t\tconst content = a || b || c;\n\t\t\t\treturn content.startsWith(\"\\\\\") && content.endsWith(\"\\\\\")\n\t\t\t\t\t? `${d2 || \"\"}[${content.slice(1, -1)}]${d1 || \"\"}`\n\t\t\t\t\t: \"\";\n\t\t\t}\n\t\t);\n\t\tif (libraryName) return libraryName;\n\t\tconst pkgPath = path.resolve(context, \"package.json\");\n\t\ttry {\n\t\t\tconst packageInfo = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n\t\t\treturn packageInfo.name || \"\";\n\t\t} catch (err) {\n\t\t\tconst e = err as Error & { code: string };\n\t\t\tif (e.code !== \"ENOENT\") {\n\t\t\t\te.message += `\\nwhile determining default 'output.uniqueName' from 'name' in ${pkgPath}`;\n\t\t\t\tthrow e;\n\t\t\t}\n\t\t\treturn \"\";\n\t\t}\n\t});\n\tF(output, \"devtoolNamespace\", () => output.uniqueName);\n\tF(output, \"module\", () => !!outputModule);\n\tD(output, \"filename\", output.module ? \"[name].mjs\" : \"[name].js\");\n\tF(output, \"iife\", () => !output.module);\n\n\tF(output, \"chunkFilename\", () => {\n\t\tconst filename = output.filename!;\n\t\tif (typeof filename !== \"function\") {\n\t\t\tconst hasName = filename.includes(\"[name]\");\n\t\t\tconst hasId = filename.includes(\"[id]\");\n\t\t\tconst hasChunkHash = filename.includes(\"[chunkhash]\");\n\t\t\tconst hasContentHash = filename.includes(\"[contenthash]\");\n\t\t\t// Anything changing depending on chunk is fine\n\t\t\tif (hasChunkHash || hasContentHash || hasName || hasId) return filename;\n\t\t\t// Otherwise prefix \"[id].\" in front of the basename to make it changing\n\t\t\treturn filename.replace(/(^|\\/)([^/]*(?:\\?|$))/, \"$1[id].$2\");\n\t\t}\n\t\treturn \"[id].js\";\n\t});\n\tF(output, \"cssFilename\", () => {\n\t\tconst filename = output.filename!;\n\t\tif (typeof filename !== \"function\") {\n\t\t\treturn filename.replace(/\\.[mc]?js(\\?|$)/, \".css$1\");\n\t\t}\n\t\treturn \"[id].css\";\n\t});\n\tF(output, \"cssChunkFilename\", () => {\n\t\tconst chunkFilename = output.chunkFilename!;\n\t\tif (typeof chunkFilename !== \"function\") {\n\t\t\treturn chunkFilename.replace(/\\.[mc]?js(\\?|$)/, \".css$1\");\n\t\t}\n\t\treturn \"[id].css\";\n\t});\n\tD(\n\t\toutput,\n\t\t\"hotUpdateChunkFilename\",\n\t\t`[id].[fullhash].hot-update.${output.module ? \"mjs\" : \"js\"}`\n\t);\n\tD(output, \"hotUpdateMainFilename\", \"[runtime].[fullhash].hot-update.json\");\n\n\tconst uniqueNameId = Template.toIdentifier(output.uniqueName);\n\tF(output, \"hotUpdateGlobal\", () => `webpackHotUpdate${uniqueNameId}`);\n\tF(output, \"chunkLoadingGlobal\", () => `webpackChunk${uniqueNameId}`);\n\tD(output, \"cssHeadDataCompression\", !development);\n\tD(output, \"assetModuleFilename\", \"[hash][ext][query]\");\n\tD(output, \"webassemblyModuleFilename\", \"[hash].module.wasm\");\n\tF(output, \"path\", () => path.join(process.cwd(), \"dist\"));\n\tF(output, \"pathinfo\", () => development);\n\tD(\n\t\toutput,\n\t\t\"publicPath\",\n\t\ttp && (tp.document || tp.importScripts) ? \"auto\" : \"\"\n\t);\n\n\tD(output, \"hashFunction\", futureDefaults ? \"xxhash64\" : \"md4\");\n\tD(output, \"hashDigest\", \"hex\");\n\tD(output, \"hashDigestLength\", futureDefaults ? 16 : 20);\n\tD(output, \"strictModuleErrorHandling\", false);\n\tif (output.library) {\n\t\tF(output.library, \"type\", () => (output.module ? \"module\" : \"var\"));\n\t}\n\tF(output, \"chunkFormat\", () => {\n\t\tif (tp) {\n\t\t\tconst helpMessage = isAffectedByBrowserslist\n\t\t\t\t? \"Make sure that your 'browserslist' includes only platforms that support these features or select an appropriate 'target' to allow selecting a chunk format by default. Alternatively specify the 'output.chunkFormat' directly.\"\n\t\t\t\t: \"Select an appropriate 'target' to allow selecting one by default, or specify the 'output.chunkFormat' directly.\";\n\t\t\tif (output.module) {\n\t\t\t\tif (tp.dynamicImport) return \"module\";\n\t\t\t\tif (tp.document) return \"array-push\";\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`For the selected environment is no default ESM chunk format available:\\nESM exports can be chosen when 'import()' is available.\\nJSONP Array push can be chosen when 'document' is available.\\n${helpMessage}`\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (tp.document) return \"array-push\";\n\t\t\tif (tp.require) return \"commonjs\";\n\t\t\tif (tp.nodeBuiltins) return \"commonjs\";\n\t\t\tif (tp.importScripts) return \"array-push\";\n\t\t\tthrow new Error(\n\t\t\t\t`For the selected environment is no default script chunk format available:\\nJSONP Array push can be chosen when 'document' or 'importScripts' is available.\\nCommonJs exports can be chosen when 'require' or node builtins are available.\\n${helpMessage}`\n\t\t\t);\n\t\t}\n\t\tthrow new Error(\n\t\t\t\"Chunk format can't be selected by default when no target is specified\"\n\t\t);\n\t});\n\tD(output, \"asyncChunks\", true);\n\tF(output, \"chunkLoading\", () => {\n\t\tif (tp) {\n\t\t\tswitch (output.chunkFormat) {\n\t\t\t\tcase \"array-push\":\n\t\t\t\t\tif (tp.document) return \"jsonp\";\n\t\t\t\t\tif (tp.importScripts) return \"import-scripts\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"commonjs\":\n\t\t\t\t\tif (tp.require) return \"require\";\n\t\t\t\t\tif (tp.nodeBuiltins) return \"async-node\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"module\":\n\t\t\t\t\tif (tp.dynamicImport) return \"import\";\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (\n\t\t\t\ttp.require === null ||\n\t\t\t\ttp.nodeBuiltins === null ||\n\t\t\t\ttp.document === null ||\n\t\t\t\ttp.importScripts === null\n\t\t\t) {\n\t\t\t\treturn \"universal\";\n\t\t\t}\n\t\t}\n\t\treturn false;\n\t});\n\tF(output, \"workerChunkLoading\", () => {\n\t\tif (tp) {\n\t\t\tswitch (output.chunkFormat) {\n\t\t\t\tcase \"array-push\":\n\t\t\t\t\tif (tp.importScriptsInWorker) return \"import-scripts\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"commonjs\":\n\t\t\t\t\tif (tp.require) return \"require\";\n\t\t\t\t\tif (tp.nodeBuiltins) return \"async-node\";\n\t\t\t\t\tbreak;\n\t\t\t\tcase \"module\":\n\t\t\t\t\tif (tp.dynamicImportInWorker) return \"import\";\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (\n\t\t\t\ttp.require === null ||\n\t\t\t\ttp.nodeBuiltins === null ||\n\t\t\t\ttp.importScriptsInWorker === null\n\t\t\t) {\n\t\t\t\treturn \"universal\";\n\t\t\t}\n\t\t}\n\t\treturn false;\n\t});\n\tF(output, \"wasmLoading\", () => {\n\t\tif (tp) {\n\t\t\tif (tp.fetchWasm) return \"fetch\";\n\t\t\tif (tp.nodeBuiltins)\n\t\t\t\treturn output.module ? \"async-node-module\" : \"async-node\";\n\t\t\tif (tp.nodeBuiltins === null || tp.fetchWasm === null) {\n\t\t\t\treturn \"universal\";\n\t\t\t}\n\t\t}\n\t\treturn false;\n\t});\n\tF(output, \"workerWasmLoading\", () => output.wasmLoading);\n\tF(output, \"globalObject\", () => {\n\t\tif (tp) {\n\t\t\tif (tp.global) return \"global\";\n\t\t\tif (tp.globalThis) return \"globalThis\";\n\t\t}\n\t\treturn \"self\";\n\t});\n\tD(output, \"importFunctionName\", \"import\");\n\tD(output, \"importMetaName\", \"import.meta\");\n\t// IGNORE(output.clean): The default value of `output.clean` in webpack is undefined, but it has the same effect as false.\n\tF(output, \"clean\", () => !!output.clean);\n\tD(output, \"crossOriginLoading\", false);\n\tD(output, \"workerPublicPath\", \"\");\n\tD(output, \"sourceMapFilename\", \"[file].map[query]\");\n\tF(output, \"scriptType\", () => (output.module ? \"module\" : false));\n\tD(output, \"charset\", true);\n\tD(output, \"chunkLoadTimeout\", 120000);\n\n\tconst { trustedTypes } = output;\n\tif (trustedTypes) {\n\t\tF(\n\t\t\ttrustedTypes,\n\t\t\t\"policyName\",\n\t\t\t() =>\n\t\t\t\toutput.uniqueName!.replace(/[^a-zA-Z0-9\\-#=_/@.%]+/g, \"_\") || \"webpack\"\n\t\t);\n\t}\n\n\tconst forEachEntry = (fn: (desc: EntryDescriptionNormalized) => void) => {\n\t\tif (typeof entry === \"function\") {\n\t\t\treturn;\n\t\t}\n\t\tfor (const name of Object.keys(entry)) {\n\t\t\tfn(entry[name]);\n\t\t}\n\t};\n\tA(output, \"enabledLibraryTypes\", () => {\n\t\tconst enabledLibraryTypes = [];\n\t\tif (output.library) {\n\t\t\tenabledLibraryTypes.push(output.library.type);\n\t\t}\n\t\tforEachEntry(desc => {\n\t\t\tif (desc.library) {\n\t\t\t\tenabledLibraryTypes.push(desc.library.type);\n\t\t\t}\n\t\t});\n\t\treturn enabledLibraryTypes;\n\t});\n\tA(output, \"enabledChunkLoadingTypes\", () => {\n\t\tconst enabledChunkLoadingTypes = new Set();\n\t\tif (output.chunkLoading) {\n\t\t\tenabledChunkLoadingTypes.add(output.chunkLoading);\n\t\t}\n\t\tif (output.workerChunkLoading) {\n\t\t\tenabledChunkLoadingTypes.add(output.workerChunkLoading);\n\t\t}\n\t\tforEachEntry(desc => {\n\t\t\tif (desc.chunkLoading) {\n\t\t\t\tenabledChunkLoadingTypes.add(desc.chunkLoading);\n\t\t\t}\n\t\t});\n\t\treturn Array.from(enabledChunkLoadingTypes);\n\t});\n\tA(output, \"enabledWasmLoadingTypes\", () => {\n\t\tconst enabledWasmLoadingTypes = new Set();\n\t\tif (output.wasmLoading) {\n\t\t\tenabledWasmLoadingTypes.add(output.wasmLoading);\n\t\t}\n\t\tif (output.workerWasmLoading) {\n\t\t\tenabledWasmLoadingTypes.add(output.workerWasmLoading);\n\t\t}\n\t\t// forEachEntry(desc => {\n\t\t// \tif (desc.wasmLoading) {\n\t\t// \t\tenabledWasmLoadingTypes.add(desc.wasmLoading);\n\t\t// \t}\n\t\t// });\n\t\treturn Array.from(enabledWasmLoadingTypes);\n\t});\n\n\tconst environment = output.environment!;\n\tconst optimistic = (v?: boolean) => v || v === undefined;\n\tconst conditionallyOptimistic = (v?: boolean, c?: boolean) =>\n\t\t(v === undefined && c) || v;\n\n\tF(environment, \"globalThis\", () => tp?.globalThis);\n\tF(environment, \"bigIntLiteral\", () => tp?.bigIntLiteral);\n\tF(environment, \"const\", () => tp && optimistic(tp.const));\n\tF(environment, \"arrowFunction\", () => tp && optimistic(tp.arrowFunction));\n\tF(environment, \"asyncFunction\", () => tp && optimistic(tp.asyncFunction));\n\tF(environment, \"forOf\", () => tp && optimistic(tp.forOf));\n\tF(environment, \"destructuring\", () => tp && optimistic(tp.destructuring));\n\tF(\n\t\tenvironment,\n\t\t\"optionalChaining\",\n\t\t() => tp && optimistic(tp.optionalChaining)\n\t);\n\tF(\n\t\tenvironment,\n\t\t\"nodePrefixForCoreModules\",\n\t\t() => tp && optimistic(tp.nodePrefixForCoreModules)\n\t);\n\tF(environment, \"templateLiteral\", () => tp && optimistic(tp.templateLiteral));\n\tF(environment, \"dynamicImport\", () =>\n\t\tconditionallyOptimistic(tp?.dynamicImport, output.module)\n\t);\n\tF(environment, \"dynamicImportInWorker\", () =>\n\t\tconditionallyOptimistic(tp?.dynamicImportInWorker, output.module)\n\t);\n\tF(environment, \"module\", () =>\n\t\tconditionallyOptimistic(tp?.module, output.module)\n\t);\n\tF(environment, \"document\", () => tp && optimistic(tp.document));\n};" repo = "web-infra-dev/rspack" url = "https://github.com/web-infra-dev/rspack.git" [[case]] advisory = "GHSA-qvv5-jq5g-4cgg" advisory_text = "Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload\n\n### Impact\nAny baileys session under the latest version (< 7.0.0-rc12, and < 6.7.22) can be sent a malicious payload via the placeholderResendMessage and trigger a fake `messages.upsert` event with a **fake message key and payload**. This allows anyone to spoof messages. The same exploit also allows an attacker to corrupt the app state sync system by sending fake key shares, and also allows for history sync spoofing which also serves the same problem, injecting fake previous context or \"on-demand\" sync.\n\n### Patches\nhttps://github.com/WhiskeySockets/Baileys/commit/3beb08eecfcb4e65722e674034bd84fb11a9de35 This commit has patched the issue, and a version tag has been released under 7.0.0 (6.7.22) for those still on Baileys v6. A new Baileys version, v7.0.0-rc12, has been released to remediate this.\n\n\n### Workarounds\nThere are no real workarounds other than dropping `messages.upsert `events that contain a `requestId` field, turning off automatic history sync (`shouldSyncHistoryMessage: () => false`) in socket config. There are no workarounds for the app state sync jamming." commit = "3beb08eecfcb4e65722e674034bd84fb11a9de35" cwe = "CWE-346" family = "config_secrets" function = "processMessage" function_lines = [[293, 751]] id = "whiskeysockets-baileys-89cd6d4edf46d286" language = "typescript" method = "fix_site" parent = "28ca087cf1cbe3c05a5b704d67b3e2270d647b74" path = "src/Utils/process-message.ts" post_fix = "const processMessage = async (\n\tmessage: WAMessage,\n\t{\n\t\tshouldProcessHistoryMsg,\n\t\tplaceholderResendCache,\n\t\tev,\n\t\tcreds,\n\t\tsignalRepository,\n\t\tkeyStore,\n\t\tlogger,\n\t\toptions,\n\t\tgetMessage\n\t}: ProcessMessageContext\n) => {\n\tconst meId = creds.me!.id\n\tconst { accountSettings } = creds\n\n\tconst chat: Partial = { id: jidNormalizedUser(getChatId(message.key)) }\n\tconst isRealMsg = isRealMessage(message)\n\n\tif (isRealMsg) {\n\t\tchat.messages = [{ message }]\n\t\tchat.conversationTimestamp = toNumber(message.messageTimestamp)\n\t\t// only increment unread count if not CIPHERTEXT and from another person\n\t\tif (shouldIncrementChatUnread(message)) {\n\t\t\tchat.unreadCount = (chat.unreadCount || 0) + 1\n\t\t}\n\t}\n\n\tconst content = normalizeMessageContent(message.message)\n\n\t// unarchive chat if it's a real message, or someone reacted to our message\n\t// and we've the unarchive chats setting on\n\tif ((isRealMsg || content?.reactionMessage?.key?.fromMe) && accountSettings?.unarchiveChats) {\n\t\tchat.archived = false\n\t\tchat.readOnly = false\n\t}\n\n\tconst protocolMsg = content?.protocolMessage\n\tif (protocolMsg) {\n\t\t// Mirror whatsmeow's `handleProtocolMessage` guard, but applied only to\n\t\t// the protocol message types that originate from our own device — an\n\t\t// attacker could otherwise spoof any of these to manipulate local state.\n\t\t//\n\t\t// Self-only types (drop if `!fromMe`):\n\t\t// - HISTORY_SYNC_NOTIFICATION (our phone driving history sync)\n\t\t// - APP_STATE_SYNC_KEY_SHARE (key share between our devices)\n\t\t// - LID_MIGRATION_MAPPING_SYNC (server-initiated via our phone)\n\t\t// - PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE (response from our phone to our PDO request)\n\t\t//\n\t\t// Cross-user types (must NOT be dropped — legitimately arrive from others):\n\t\t// - REVOKE\n\t\t// - MESSAGE_EDIT\n\t\t// - EPHEMERAL_SETTING\n\t\t// - GROUP_MEMBER_LABEL_CHANGE\n\t\t//\n\t\t// See https://github.com/tulir/whatsmeow/blob/8d3700152a/message.go#L842-L845\n\t\t// for the reference architecture — whatsmeow's `handleProtocolMessage`\n\t\t// only contains self-only types because edits are unwrapped from\n\t\t// `EditedMessage` BEFORE this dispatch and revokes aren't routed here.\n\t\tconst SELF_ONLY_TYPES = new Set([\n\t\t\tproto.Message.ProtocolMessage.Type.HISTORY_SYNC_NOTIFICATION,\n\t\t\tproto.Message.ProtocolMessage.Type.APP_STATE_SYNC_KEY_SHARE,\n\t\t\tproto.Message.ProtocolMessage.Type.LID_MIGRATION_MAPPING_SYNC,\n\t\t\tproto.Message.ProtocolMessage.Type.PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE\n\t\t])\n\t\tif (\n\t\t\tprotocolMsg.type !== null &&\n\t\t\tprotocolMsg.type !== undefined &&\n\t\t\tSELF_ONLY_TYPES.has(protocolMsg.type) &&\n\t\t\t!message.key.fromMe\n\t\t) {\n\t\t\tlogger?.warn(\n\t\t\t\t{ msgId: message.key.id, type: protocolMsg.type, from: message.key.participant || message.key.remoteJid },\n\t\t\t\t'dropping spoofed self-only protocolMessage from non-self origin'\n\t\t\t)\n\t\t\treturn\n\t\t}\n\n\t\tswitch (protocolMsg.type) {\n\t\t\tcase proto.Message.ProtocolMessage.Type.HISTORY_SYNC_NOTIFICATION:\n\t\t\t\tconst histNotification = protocolMsg.historySyncNotification!\n\t\t\t\tconst process = shouldProcessHistoryMsg\n\t\t\t\tconst isLatest = !creds.processedHistoryMessages?.length\n\n\t\t\t\tlogger?.info(\n\t\t\t\t\t{\n\t\t\t\t\t\thistNotification,\n\t\t\t\t\t\tprocess,\n\t\t\t\t\t\tid: message.key.id,\n\t\t\t\t\t\tisLatest\n\t\t\t\t\t},\n\t\t\t\t\t'got history notification'\n\t\t\t\t)\n\n\t\t\t\tif (process) {\n\t\t\t\t\t// TODO: investigate\n\t\t\t\t\tif (histNotification.syncType !== proto.HistorySync.HistorySyncType.ON_DEMAND) {\n\t\t\t\t\t\tev.emit('creds.update', {\n\t\t\t\t\t\t\tprocessedHistoryMessages: [\n\t\t\t\t\t\t\t\t...(creds.processedHistoryMessages || []),\n\t\t\t\t\t\t\t\t{ key: message.key, messageTimestamp: message.messageTimestamp }\n\t\t\t\t\t\t\t]\n\t\t\t\t\t\t})\n\t\t\t\t\t}\n\n\t\t\t\t\tconst data = await downloadAndProcessHistorySyncNotification(histNotification, options, logger)\n\n\t\t\t\t\tif (data.lidPnMappings?.length) {\n\t\t\t\t\t\tlogger?.debug({ count: data.lidPnMappings.length }, 'processing LID-PN mappings from history sync')\n\t\t\t\t\t\tawait signalRepository.lidMapping\n\t\t\t\t\t\t\t.storeLIDPNMappings(data.lidPnMappings)\n\t\t\t\t\t\t\t.catch(err => logger?.warn({ err }, 'failed to store LID-PN mappings from history sync'))\n\t\t\t\t\t}\n\n\t\t\t\t\tawait storeTcTokensFromHistorySync(data.chats, signalRepository, keyStore, logger)\n\n\t\t\t\t\tev.emit('messaging-history.set', {\n\t\t\t\t\t\t...data,\n\t\t\t\t\t\tisLatest: histNotification.syncType !== proto.HistorySync.HistorySyncType.ON_DEMAND ? isLatest : undefined,\n\t\t\t\t\t\tchunkOrder: histNotification.chunkOrder,\n\t\t\t\t\t\tpeerDataRequestSessionId: histNotification.peerDataRequestSessionId\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.APP_STATE_SYNC_KEY_SHARE:\n\t\t\t\tconst keys = protocolMsg.appStateSyncKeyShare!.keys\n\t\t\t\tif (keys?.length) {\n\t\t\t\t\tlet newAppStateSyncKeyId = ''\n\t\t\t\t\tawait keyStore.transaction(async () => {\n\t\t\t\t\t\tconst newKeys: string[] = []\n\t\t\t\t\t\tfor (const { keyData, keyId } of keys) {\n\t\t\t\t\t\t\tconst strKeyId = Buffer.from(keyId!.keyId!).toString('base64')\n\t\t\t\t\t\t\tnewKeys.push(strKeyId)\n\n\t\t\t\t\t\t\tawait keyStore.set({ 'app-state-sync-key': { [strKeyId]: keyData! } })\n\n\t\t\t\t\t\t\tnewAppStateSyncKeyId = strKeyId\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tlogger?.info({ newAppStateSyncKeyId, newKeys }, 'injecting new app state sync keys')\n\t\t\t\t\t}, meId)\n\n\t\t\t\t\tev.emit('creds.update', { myAppStateKeyId: newAppStateSyncKeyId })\n\t\t\t\t} else {\n\t\t\t\t\tlogger?.info({ protocolMsg }, 'recv app state sync with 0 keys')\n\t\t\t\t}\n\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.REVOKE:\n\t\t\t\tev.emit('messages.update', [\n\t\t\t\t\t{\n\t\t\t\t\t\tkey: {\n\t\t\t\t\t\t\t...message.key,\n\t\t\t\t\t\t\tid: protocolMsg.key!.id\n\t\t\t\t\t\t},\n\t\t\t\t\t\tupdate: { message: null, messageStubType: WAMessageStubType.REVOKE, key: message.key }\n\t\t\t\t\t}\n\t\t\t\t])\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.EPHEMERAL_SETTING:\n\t\t\t\tObject.assign(chat, {\n\t\t\t\t\tephemeralSettingTimestamp: toNumber(message.messageTimestamp),\n\t\t\t\t\tephemeralExpiration: protocolMsg.ephemeralExpiration || null\n\t\t\t\t})\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE:\n\t\t\t\tconst response = protocolMsg.peerDataOperationRequestResponseMessage!\n\t\t\t\tif (response) {\n\t\t\t\t\t// TODO: IMPLEMENT HISTORY SYNC ETC (sticker uploads etc.).\n\t\t\t\t\tconst peerDataOperationResult = response.peerDataOperationResult || []\n\t\t\t\t\tfor (const result of peerDataOperationResult) {\n\t\t\t\t\t\tconst retryResponse = result?.placeholderMessageResendResponse\n\t\t\t\t\t\t//eslint-disable-next-line max-depth\n\t\t\t\t\t\tif (!retryResponse?.webMessageInfoBytes) {\n\t\t\t\t\t\t\tcontinue\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t//eslint-disable-next-line max-depth\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tconst webMessageInfo = proto.WebMessageInfo.decode(retryResponse.webMessageInfoBytes)\n\t\t\t\t\t\t\tconst msgId = webMessageInfo.key?.id\n\t\t\t\t\t\t\t// Retrieve cached original message data (preserves LID details,\n\t\t\t\t\t\t\t// timestamps, etc. that the phone may omit in its PDO response)\n\t\t\t\t\t\t\tconst cachedData = msgId ? await placeholderResendCache?.get | true>(msgId) : undefined\n\t\t\t\t\t\t\t//eslint-disable-next-line max-depth\n\t\t\t\t\t\t\tif (msgId) {\n\t\t\t\t\t\t\t\tawait placeholderResendCache?.del(msgId)\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\tlet finalMsg: WAMessage\n\t\t\t\t\t\t\t//eslint-disable-next-line max-depth\n\t\t\t\t\t\t\tif (cachedData && typeof cachedData === 'object') {\n\t\t\t\t\t\t\t\t// Apply decoded message content onto cached metadata (preserves LID etc.)\n\t\t\t\t\t\t\t\tcachedData.message = webMessageInfo.message\n\t\t\t\t\t\t\t\t//eslint-disable-next-line max-depth\n\t\t\t\t\t\t\t\tif (webMessageInfo.messageTimestamp) {\n\t\t\t\t\t\t\t\t\tcachedData.messageTimestamp = webMessageInfo.messageTimestamp\n\t\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\t\tfinalMsg = cachedData as WAMessage\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\tfinalMsg = webMessageInfo as WAMessage\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\tlogger?.debug({ msgId, requestId: response.stanzaId }, 'received placeholder resend')\n\n\t\t\t\t\t\t\tev.emit('messages.upsert', {\n\t\t\t\t\t\t\t\tmessages: [finalMsg],\n\t\t\t\t\t\t\t\ttype: 'notify',\n\t\t\t\t\t\t\t\trequestId: response.stanzaId!\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t} catch (err) {\n\t\t\t\t\t\t\tlogger?.warn({ err, stanzaId: response.stanzaId }, 'failed to decode placeholder resend response')\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.MESSAGE_EDIT:\n\t\t\t\tev.emit('messages.update', [\n\t\t\t\t\t{\n\t\t\t\t\t\t// flip the sender / fromMe properties because they're in the perspective of the sender\n\t\t\t\t\t\tkey: { ...message.key, id: protocolMsg.key?.id },\n\t\t\t\t\t\tupdate: {\n\t\t\t\t\t\t\tmessage: {\n\t\t\t\t\t\t\t\teditedMessage: {\n\t\t\t\t\t\t\t\t\tmessage: protocolMsg.editedMessage\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tmessageTimestamp: protocolMsg.timestampMs\n\t\t\t\t\t\t\t\t? Math.floor(toNumber(protocolMsg.timestampMs) / 1000)\n\t\t\t\t\t\t\t\t: message.messageTimestamp\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t])\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.GROUP_MEMBER_LABEL_CHANGE:\n\t\t\t\tconst labelAssociationMsg = protocolMsg.memberLabel\n\t\t\t\tif (labelAssociationMsg?.label) {\n\t\t\t\t\tev.emit('group.member-tag.update', {\n\t\t\t\t\t\tgroupId: chat.id!,\n\t\t\t\t\t\tlabel: labelAssociationMsg.label,\n\t\t\t\t\t\tparticipant: message.key.participant!,\n\t\t\t\t\t\tparticipantAlt: message.key.participantAlt!,\n\t\t\t\t\t\tmessageTimestamp: Number(message.messageTimestamp)\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.LID_MIGRATION_MAPPING_SYNC:\n\t\t\t\tconst encodedPayload = protocolMsg.lidMigrationMappingSyncMessage?.encodedMappingPayload!\n\t\t\t\tconst { pnToLidMappings, chatDbMigrationTimestamp } =\n\t\t\t\t\tproto.LIDMigrationMappingSyncPayload.decode(encodedPayload)\n\t\t\t\tlogger?.debug({ pnToLidMappings, chatDbMigrationTimestamp }, 'got lid mappings and chat db migration timestamp')\n\t\t\t\tconst pairs = []\n\t\t\t\tfor (const { pn, latestLid, assignedLid } of pnToLidMappings) {\n\t\t\t\t\tconst lid = latestLid || assignedLid\n\t\t\t\t\tpairs.push({ lid: `${lid}@lid`, pn: `${pn}@s.whatsapp.net` })\n\t\t\t\t}\n\n\t\t\t\tawait signalRepository.lidMapping.storeLIDPNMappings(pairs)\n\t\t\t\tif (pairs.length) {\n\t\t\t\t\tfor (const { pn, lid } of pairs) {\n\t\t\t\t\t\tawait signalRepository.migrateSession(pn, lid)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t}\n\t} else if (content?.reactionMessage) {\n\t\tconst reaction: proto.IReaction = {\n\t\t\t...content.reactionMessage,\n\t\t\tkey: message.key\n\t\t}\n\t\tev.emit('messages.reaction', [\n\t\t\t{\n\t\t\t\treaction,\n\t\t\t\tkey: content.reactionMessage?.key!\n\t\t\t}\n\t\t])\n\t} else if (content?.encEventResponseMessage) {\n\t\tconst encEventResponse = content.encEventResponseMessage\n\t\tconst creationMsgKey = encEventResponse.eventCreationMessageKey!\n\n\t\t// we need to fetch the event creation message to get the event enc key\n\t\tconst eventMsg = await getMessage(creationMsgKey)\n\t\tif (eventMsg) {\n\t\t\ttry {\n\t\t\t\tconst meIdNormalised = jidNormalizedUser(meId)\n\n\t\t\t\t// all jids need to be PN\n\t\t\t\tconst eventCreatorKey = creationMsgKey.participant || creationMsgKey.remoteJid!\n\t\t\t\tconst eventCreatorPn = isLidUser(eventCreatorKey)\n\t\t\t\t\t? await signalRepository.lidMapping.getPNForLID(eventCreatorKey)\n\t\t\t\t\t: eventCreatorKey\n\t\t\t\tconst eventCreatorJid = getKeyAuthor(\n\t\t\t\t\t{ remoteJid: jidNormalizedUser(eventCreatorPn!), fromMe: meIdNormalised === eventCreatorPn },\n\t\t\t\t\tmeIdNormalised\n\t\t\t\t)\n\n\t\t\t\tconst responderJid = getKeyAuthor(message.key, meIdNormalised)\n\t\t\t\tconst eventEncKey = eventMsg?.messageContextInfo?.messageSecret\n\n\t\t\t\tif (!eventEncKey) {\n\t\t\t\t\tlogger?.warn({ creationMsgKey }, 'event response: missing messageSecret for decryption')\n\t\t\t\t} else {\n\t\t\t\t\tconst responseMsg = decryptEventResponse(encEventResponse, {\n\t\t\t\t\t\teventEncKey,\n\t\t\t\t\t\teventCreatorJid,\n\t\t\t\t\t\teventMsgId: creationMsgKey.id!,\n\t\t\t\t\t\tresponderJid\n\t\t\t\t\t})\n\n\t\t\t\t\tconst eventResponse = {\n\t\t\t\t\t\teventResponseMessageKey: message.key,\n\t\t\t\t\t\tsenderTimestampMs: responseMsg.timestampMs!,\n\t\t\t\t\t\tresponse: responseMsg\n\t\t\t\t\t}\n\n\t\t\t\t\tev.emit('messages.update', [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tkey: creationMsgKey,\n\t\t\t\t\t\t\tupdate: {\n\t\t\t\t\t\t\t\teventResponses: [eventResponse]\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t])\n\t\t\t\t}\n\t\t\t} catch (err) {\n\t\t\t\tlogger?.warn({ err, creationMsgKey }, 'failed to decrypt event response')\n\t\t\t}\n\t\t} else {\n\t\t\tlogger?.warn({ creationMsgKey }, 'event creation message not found, cannot decrypt response')\n\t\t}\n\t} else if (message.messageStubType) {\n\t\tconst jid = message.key?.remoteJid!\n\t\t//let actor = whatsappID (message.participant)\n\t\tlet participants: GroupParticipant[]\n\t\tconst emitParticipantsUpdate = (action: ParticipantAction) =>\n\t\t\tev.emit('group-participants.update', {\n\t\t\t\tid: jid,\n\t\t\t\tauthor: message.key.participant!,\n\t\t\t\tauthorPn: message.key.participantAlt!,\n\t\t\t\tauthorUsername: message.key.participantUsername!,\n\t\t\t\tparticipants,\n\t\t\t\taction\n\t\t\t})\n\t\tconst emitGroupUpdate = (update: Partial) => {\n\t\t\tev.emit('groups.update', [\n\t\t\t\t{\n\t\t\t\t\tid: jid,\n\t\t\t\t\t...update,\n\t\t\t\t\tauthor: message.key.participant ?? undefined,\n\t\t\t\t\tauthorPn: message.key.participantAlt,\n\t\t\t\t\tauthorUsername: message.key.participantUsername\n\t\t\t\t}\n\t\t\t])\n\t\t}\n\n\t\tconst emitGroupRequestJoin = (participant: LIDMapping, action: RequestJoinAction, method: RequestJoinMethod) => {\n\t\t\tev.emit('group.join-request', {\n\t\t\t\tid: jid,\n\t\t\t\tauthor: message.key.participant!,\n\t\t\t\tauthorPn: message.key.participantAlt!,\n\t\t\t\tauthorUsername: message.key.participantUsername!,\n\t\t\t\tparticipant: participant.lid,\n\t\t\t\tparticipantPn: participant.pn,\n\t\t\t\taction,\n\t\t\t\tmethod: method!\n\t\t\t})\n\t\t}\n\n\t\tconst participantsIncludesMe = () => participants.find(jid => areJidsSameUser(meId, jid.phoneNumber)) // ADD SUPPORT FOR LID\n\n\t\tswitch (message.messageStubType) {\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_CHANGE_NUMBER:\n\t\t\t\tparticipants = message.messageStubParameters.map((a: any) => JSON.parse(a as string)) || []\n\t\t\t\temitParticipantsUpdate('modify')\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_LEAVE:\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_REMOVE:\n\t\t\t\tparticipants = message.messageStubParameters.map((a: any) => JSON.parse(a as string)) || []\n\t\t\t\temitParticipantsUpdate('remove')\n\t\t\t\t// mark the chat read only if you left the group\n\t\t\t\tif (participantsIncludesMe()) {\n\t\t\t\t\tchat.readOnly = true\n\t\t\t\t}\n\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_ADD:\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_INVITE:\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_ADD_REQUEST_JOIN:\n\t\t\t\tparticipants = message.messageStubParameters.map((a: any) => JSON.parse(a as string)) || []\n\t\t\t\tif (participantsIncludesMe()) {\n\t\t\t\t\tchat.readOnly = false\n\t\t\t\t}\n\n\t\t\t\temitParticipantsUpdate('add')\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_DEMOTE:\n\t\t\t\tparticipants = message.messageStubParameters.map((a: any) => JSON.parse(a as string)) || []\n\t\t\t\temitParticipantsUpdate('demote')\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_PROMOTE:\n\t\t\t\tparticipants = message.messageStubParameters.map((a: any) => JSON.parse(a as string)) || []\n\t\t\t\temitParticipantsUpdate('promote')\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_CHANGE_ANNOUNCE:\n\t\t\t\tconst announceValue = message.messageStubParameters?.[0]\n\t\t\t\temitGroupUpdate({ announce: announceValue === 'true' || announceValue === 'on' })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_CHANGE_RESTRICT:\n\t\t\t\tconst restrictValue = message.messageStubParameters?.[0]\n\t\t\t\temitGroupUpdate({ restrict: restrictValue === 'true' || restrictValue === 'on' })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_CHANGE_SUBJECT:\n\t\t\t\tconst name = message.messageStubParameters?.[0]\n\t\t\t\tchat.name = name\n\t\t\t\temitGroupUpdate({ subject: name })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_CHANGE_DESCRIPTION:\n\t\t\t\tconst description = message.messageStubParameters?.[0]\n\t\t\t\tchat.description = description\n\t\t\t\temitGroupUpdate({ desc: description })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_CHANGE_INVITE_LINK:\n\t\t\t\tconst code = message.messageStubParameters?.[0]\n\t\t\t\temitGroupUpdate({ inviteCode: code })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_MEMBER_ADD_MODE:\n\t\t\t\tconst memberAddValue = message.messageStubParameters?.[0]\n\t\t\t\temitGroupUpdate({ memberAddMode: memberAddValue === 'all_member_add' })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_MEMBERSHIP_JOIN_APPROVAL_MODE:\n\t\t\t\tconst approvalMode = message.messageStubParameters?.[0]\n\t\t\t\temitGroupUpdate({ joinApprovalMode: approvalMode === 'on' })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_MEMBERSHIP_JOIN_APPROVAL_REQUEST_NON_ADMIN_ADD: // TODO: Add other events\n\t\t\t\tconst participant = JSON.parse(message.messageStubParameters?.[0]) as LIDMapping\n\t\t\t\tconst action = message.messageStubParameters?.[1] as RequestJoinAction\n\t\t\t\tconst method = message.messageStubParameters?.[2] as RequestJoinMethod\n\t\t\t\temitGroupRequestJoin(participant, action, method)\n\t\t\t\tbreak\n\t\t}\n\t} /* else if(content?.pollUpdateMessage) {\n\t\tconst creationMsgKey = content.pollUpdateMessage.pollCreationMessageKey!\n\t\t// we need to fetch the poll creation message to get the poll enc key\n\t\t// TODO: make standalone, remove getMessage reference\n\t\t// TODO: Remove entirely\n\t\tconst pollMsg = await getMessage(creationMsgKey)\n\t\tif(pollMsg) {\n\t\t\tconst meIdNormalised = jidNormalizedUser(meId)\n\t\t\tconst pollCreatorJid = getKeyAuthor(creationMsgKey, meIdNormalised)\n\t\t\tconst voterJid = getKeyAuthor(message.key, meIdNormalised)\n\t\t\tconst pollEncKey = pollMsg.messageContextInfo?.messageSecret!\n\n\t\t\ttry {\n\t\t\t\tconst voteMsg = decryptPollVote(\n\t\t\t\t\tcontent.pollUpdateMessage.vote!,\n\t\t\t\t\t{\n\t\t\t\t\t\tpollEncKey,\n\t\t\t\t\t\tpollCreatorJid,\n\t\t\t\t\t\tpollMsgId: creationMsgKey.id!,\n\t\t\t\t\t\tvoterJid,\n\t\t\t\t\t}\n\t\t\t\t)\n\t\t\t\tev.emit('messages.update', [\n\t\t\t\t\t{\n\t\t\t\t\t\tkey: creationMsgKey,\n\t\t\t\t\t\tupdate: {\n\t\t\t\t\t\t\tpollUpdates: [\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\tpollUpdateMessageKey: message.key,\n\t\t\t\t\t\t\t\t\tvote: voteMsg,\n\t\t\t\t\t\t\t\t\tsenderTimestampMs: (content.pollUpdateMessage.senderTimestampMs! as Long).toNumber(),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t]\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t])\n\t\t\t} catch(err) {\n\t\t\t\tlogger?.warn(\n\t\t\t\t\t{ err, creationMsgKey },\n\t\t\t\t\t'failed to decrypt poll vote'\n\t\t\t\t)\n\t\t\t}\n\t\t} else {\n\t\t\tlogger?.warn(\n\t\t\t\t{ creationMsgKey },\n\t\t\t\t'poll creation message not found, cannot decrypt update'\n\t\t\t)\n\t\t}\n\t\t} */\n\n\tif (Object.keys(chat).length > 1) {\n\t\tev.emit('chats.update', [chat])\n\t}\n}" pre_fix = "const processMessage = async (\n\tmessage: WAMessage,\n\t{\n\t\tshouldProcessHistoryMsg,\n\t\tplaceholderResendCache,\n\t\tev,\n\t\tcreds,\n\t\tsignalRepository,\n\t\tkeyStore,\n\t\tlogger,\n\t\toptions,\n\t\tgetMessage\n\t}: ProcessMessageContext\n) => {\n\tconst meId = creds.me!.id\n\tconst { accountSettings } = creds\n\n\tconst chat: Partial = { id: jidNormalizedUser(getChatId(message.key)) }\n\tconst isRealMsg = isRealMessage(message)\n\n\tif (isRealMsg) {\n\t\tchat.messages = [{ message }]\n\t\tchat.conversationTimestamp = toNumber(message.messageTimestamp)\n\t\t// only increment unread count if not CIPHERTEXT and from another person\n\t\tif (shouldIncrementChatUnread(message)) {\n\t\t\tchat.unreadCount = (chat.unreadCount || 0) + 1\n\t\t}\n\t}\n\n\tconst content = normalizeMessageContent(message.message)\n\n\t// unarchive chat if it's a real message, or someone reacted to our message\n\t// and we've the unarchive chats setting on\n\tif ((isRealMsg || content?.reactionMessage?.key?.fromMe) && accountSettings?.unarchiveChats) {\n\t\tchat.archived = false\n\t\tchat.readOnly = false\n\t}\n\n\tconst protocolMsg = content?.protocolMessage\n\tif (protocolMsg) {\n\t\tswitch (protocolMsg.type) {\n\t\t\tcase proto.Message.ProtocolMessage.Type.HISTORY_SYNC_NOTIFICATION:\n\t\t\t\tconst histNotification = protocolMsg.historySyncNotification!\n\t\t\t\tconst process = shouldProcessHistoryMsg\n\t\t\t\tconst isLatest = !creds.processedHistoryMessages?.length\n\n\t\t\t\tlogger?.info(\n\t\t\t\t\t{\n\t\t\t\t\t\thistNotification,\n\t\t\t\t\t\tprocess,\n\t\t\t\t\t\tid: message.key.id,\n\t\t\t\t\t\tisLatest\n\t\t\t\t\t},\n\t\t\t\t\t'got history notification'\n\t\t\t\t)\n\n\t\t\t\tif (process) {\n\t\t\t\t\t// TODO: investigate\n\t\t\t\t\tif (histNotification.syncType !== proto.HistorySync.HistorySyncType.ON_DEMAND) {\n\t\t\t\t\t\tev.emit('creds.update', {\n\t\t\t\t\t\t\tprocessedHistoryMessages: [\n\t\t\t\t\t\t\t\t...(creds.processedHistoryMessages || []),\n\t\t\t\t\t\t\t\t{ key: message.key, messageTimestamp: message.messageTimestamp }\n\t\t\t\t\t\t\t]\n\t\t\t\t\t\t})\n\t\t\t\t\t}\n\n\t\t\t\t\tconst data = await downloadAndProcessHistorySyncNotification(histNotification, options, logger)\n\n\t\t\t\t\tif (data.lidPnMappings?.length) {\n\t\t\t\t\t\tlogger?.debug({ count: data.lidPnMappings.length }, 'processing LID-PN mappings from history sync')\n\t\t\t\t\t\tawait signalRepository.lidMapping\n\t\t\t\t\t\t\t.storeLIDPNMappings(data.lidPnMappings)\n\t\t\t\t\t\t\t.catch(err => logger?.warn({ err }, 'failed to store LID-PN mappings from history sync'))\n\t\t\t\t\t}\n\n\t\t\t\t\tawait storeTcTokensFromHistorySync(data.chats, signalRepository, keyStore, logger)\n\n\t\t\t\t\tev.emit('messaging-history.set', {\n\t\t\t\t\t\t...data,\n\t\t\t\t\t\tisLatest: histNotification.syncType !== proto.HistorySync.HistorySyncType.ON_DEMAND ? isLatest : undefined,\n\t\t\t\t\t\tchunkOrder: histNotification.chunkOrder,\n\t\t\t\t\t\tpeerDataRequestSessionId: histNotification.peerDataRequestSessionId\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.APP_STATE_SYNC_KEY_SHARE:\n\t\t\t\tconst keys = protocolMsg.appStateSyncKeyShare!.keys\n\t\t\t\tif (keys?.length) {\n\t\t\t\t\tlet newAppStateSyncKeyId = ''\n\t\t\t\t\tawait keyStore.transaction(async () => {\n\t\t\t\t\t\tconst newKeys: string[] = []\n\t\t\t\t\t\tfor (const { keyData, keyId } of keys) {\n\t\t\t\t\t\t\tconst strKeyId = Buffer.from(keyId!.keyId!).toString('base64')\n\t\t\t\t\t\t\tnewKeys.push(strKeyId)\n\n\t\t\t\t\t\t\tawait keyStore.set({ 'app-state-sync-key': { [strKeyId]: keyData! } })\n\n\t\t\t\t\t\t\tnewAppStateSyncKeyId = strKeyId\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tlogger?.info({ newAppStateSyncKeyId, newKeys }, 'injecting new app state sync keys')\n\t\t\t\t\t}, meId)\n\n\t\t\t\t\tev.emit('creds.update', { myAppStateKeyId: newAppStateSyncKeyId })\n\t\t\t\t} else {\n\t\t\t\t\tlogger?.info({ protocolMsg }, 'recv app state sync with 0 keys')\n\t\t\t\t}\n\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.REVOKE:\n\t\t\t\tev.emit('messages.update', [\n\t\t\t\t\t{\n\t\t\t\t\t\tkey: {\n\t\t\t\t\t\t\t...message.key,\n\t\t\t\t\t\t\tid: protocolMsg.key!.id\n\t\t\t\t\t\t},\n\t\t\t\t\t\tupdate: { message: null, messageStubType: WAMessageStubType.REVOKE, key: message.key }\n\t\t\t\t\t}\n\t\t\t\t])\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.EPHEMERAL_SETTING:\n\t\t\t\tObject.assign(chat, {\n\t\t\t\t\tephemeralSettingTimestamp: toNumber(message.messageTimestamp),\n\t\t\t\t\tephemeralExpiration: protocolMsg.ephemeralExpiration || null\n\t\t\t\t})\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE:\n\t\t\t\tconst response = protocolMsg.peerDataOperationRequestResponseMessage!\n\t\t\t\tif (response) {\n\t\t\t\t\t// TODO: IMPLEMENT HISTORY SYNC ETC (sticker uploads etc.).\n\t\t\t\t\tconst peerDataOperationResult = response.peerDataOperationResult || []\n\t\t\t\t\tfor (const result of peerDataOperationResult) {\n\t\t\t\t\t\tconst retryResponse = result?.placeholderMessageResendResponse\n\t\t\t\t\t\t//eslint-disable-next-line max-depth\n\t\t\t\t\t\tif (!retryResponse?.webMessageInfoBytes) {\n\t\t\t\t\t\t\tcontinue\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t//eslint-disable-next-line max-depth\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tconst webMessageInfo = proto.WebMessageInfo.decode(retryResponse.webMessageInfoBytes)\n\t\t\t\t\t\t\tconst msgId = webMessageInfo.key?.id\n\t\t\t\t\t\t\t// Retrieve cached original message data (preserves LID details,\n\t\t\t\t\t\t\t// timestamps, etc. that the phone may omit in its PDO response)\n\t\t\t\t\t\t\tconst cachedData = msgId ? await placeholderResendCache?.get | true>(msgId) : undefined\n\t\t\t\t\t\t\t//eslint-disable-next-line max-depth\n\t\t\t\t\t\t\tif (msgId) {\n\t\t\t\t\t\t\t\tawait placeholderResendCache?.del(msgId)\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\tlet finalMsg: WAMessage\n\t\t\t\t\t\t\t//eslint-disable-next-line max-depth\n\t\t\t\t\t\t\tif (cachedData && typeof cachedData === 'object') {\n\t\t\t\t\t\t\t\t// Apply decoded message content onto cached metadata (preserves LID etc.)\n\t\t\t\t\t\t\t\tcachedData.message = webMessageInfo.message\n\t\t\t\t\t\t\t\t//eslint-disable-next-line max-depth\n\t\t\t\t\t\t\t\tif (webMessageInfo.messageTimestamp) {\n\t\t\t\t\t\t\t\t\tcachedData.messageTimestamp = webMessageInfo.messageTimestamp\n\t\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\t\tfinalMsg = cachedData as WAMessage\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\tfinalMsg = webMessageInfo as WAMessage\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\tlogger?.debug({ msgId, requestId: response.stanzaId }, 'received placeholder resend')\n\n\t\t\t\t\t\t\tev.emit('messages.upsert', {\n\t\t\t\t\t\t\t\tmessages: [finalMsg],\n\t\t\t\t\t\t\t\ttype: 'notify',\n\t\t\t\t\t\t\t\trequestId: response.stanzaId!\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t} catch (err) {\n\t\t\t\t\t\t\tlogger?.warn({ err, stanzaId: response.stanzaId }, 'failed to decode placeholder resend response')\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.MESSAGE_EDIT:\n\t\t\t\tev.emit('messages.update', [\n\t\t\t\t\t{\n\t\t\t\t\t\t// flip the sender / fromMe properties because they're in the perspective of the sender\n\t\t\t\t\t\tkey: { ...message.key, id: protocolMsg.key?.id },\n\t\t\t\t\t\tupdate: {\n\t\t\t\t\t\t\tmessage: {\n\t\t\t\t\t\t\t\teditedMessage: {\n\t\t\t\t\t\t\t\t\tmessage: protocolMsg.editedMessage\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tmessageTimestamp: protocolMsg.timestampMs\n\t\t\t\t\t\t\t\t? Math.floor(toNumber(protocolMsg.timestampMs) / 1000)\n\t\t\t\t\t\t\t\t: message.messageTimestamp\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t])\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.GROUP_MEMBER_LABEL_CHANGE:\n\t\t\t\tconst labelAssociationMsg = protocolMsg.memberLabel\n\t\t\t\tif (labelAssociationMsg?.label) {\n\t\t\t\t\tev.emit('group.member-tag.update', {\n\t\t\t\t\t\tgroupId: chat.id!,\n\t\t\t\t\t\tlabel: labelAssociationMsg.label,\n\t\t\t\t\t\tparticipant: message.key.participant!,\n\t\t\t\t\t\tparticipantAlt: message.key.participantAlt!,\n\t\t\t\t\t\tmessageTimestamp: Number(message.messageTimestamp)\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tbreak\n\t\t\tcase proto.Message.ProtocolMessage.Type.LID_MIGRATION_MAPPING_SYNC:\n\t\t\t\tconst encodedPayload = protocolMsg.lidMigrationMappingSyncMessage?.encodedMappingPayload!\n\t\t\t\tconst { pnToLidMappings, chatDbMigrationTimestamp } =\n\t\t\t\t\tproto.LIDMigrationMappingSyncPayload.decode(encodedPayload)\n\t\t\t\tlogger?.debug({ pnToLidMappings, chatDbMigrationTimestamp }, 'got lid mappings and chat db migration timestamp')\n\t\t\t\tconst pairs = []\n\t\t\t\tfor (const { pn, latestLid, assignedLid } of pnToLidMappings) {\n\t\t\t\t\tconst lid = latestLid || assignedLid\n\t\t\t\t\tpairs.push({ lid: `${lid}@lid`, pn: `${pn}@s.whatsapp.net` })\n\t\t\t\t}\n\n\t\t\t\tawait signalRepository.lidMapping.storeLIDPNMappings(pairs)\n\t\t\t\tif (pairs.length) {\n\t\t\t\t\tfor (const { pn, lid } of pairs) {\n\t\t\t\t\t\tawait signalRepository.migrateSession(pn, lid)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t}\n\t} else if (content?.reactionMessage) {\n\t\tconst reaction: proto.IReaction = {\n\t\t\t...content.reactionMessage,\n\t\t\tkey: message.key\n\t\t}\n\t\tev.emit('messages.reaction', [\n\t\t\t{\n\t\t\t\treaction,\n\t\t\t\tkey: content.reactionMessage?.key!\n\t\t\t}\n\t\t])\n\t} else if (content?.encEventResponseMessage) {\n\t\tconst encEventResponse = content.encEventResponseMessage\n\t\tconst creationMsgKey = encEventResponse.eventCreationMessageKey!\n\n\t\t// we need to fetch the event creation message to get the event enc key\n\t\tconst eventMsg = await getMessage(creationMsgKey)\n\t\tif (eventMsg) {\n\t\t\ttry {\n\t\t\t\tconst meIdNormalised = jidNormalizedUser(meId)\n\n\t\t\t\t// all jids need to be PN\n\t\t\t\tconst eventCreatorKey = creationMsgKey.participant || creationMsgKey.remoteJid!\n\t\t\t\tconst eventCreatorPn = isLidUser(eventCreatorKey)\n\t\t\t\t\t? await signalRepository.lidMapping.getPNForLID(eventCreatorKey)\n\t\t\t\t\t: eventCreatorKey\n\t\t\t\tconst eventCreatorJid = getKeyAuthor(\n\t\t\t\t\t{ remoteJid: jidNormalizedUser(eventCreatorPn!), fromMe: meIdNormalised === eventCreatorPn },\n\t\t\t\t\tmeIdNormalised\n\t\t\t\t)\n\n\t\t\t\tconst responderJid = getKeyAuthor(message.key, meIdNormalised)\n\t\t\t\tconst eventEncKey = eventMsg?.messageContextInfo?.messageSecret\n\n\t\t\t\tif (!eventEncKey) {\n\t\t\t\t\tlogger?.warn({ creationMsgKey }, 'event response: missing messageSecret for decryption')\n\t\t\t\t} else {\n\t\t\t\t\tconst responseMsg = decryptEventResponse(encEventResponse, {\n\t\t\t\t\t\teventEncKey,\n\t\t\t\t\t\teventCreatorJid,\n\t\t\t\t\t\teventMsgId: creationMsgKey.id!,\n\t\t\t\t\t\tresponderJid\n\t\t\t\t\t})\n\n\t\t\t\t\tconst eventResponse = {\n\t\t\t\t\t\teventResponseMessageKey: message.key,\n\t\t\t\t\t\tsenderTimestampMs: responseMsg.timestampMs!,\n\t\t\t\t\t\tresponse: responseMsg\n\t\t\t\t\t}\n\n\t\t\t\t\tev.emit('messages.update', [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tkey: creationMsgKey,\n\t\t\t\t\t\t\tupdate: {\n\t\t\t\t\t\t\t\teventResponses: [eventResponse]\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t])\n\t\t\t\t}\n\t\t\t} catch (err) {\n\t\t\t\tlogger?.warn({ err, creationMsgKey }, 'failed to decrypt event response')\n\t\t\t}\n\t\t} else {\n\t\t\tlogger?.warn({ creationMsgKey }, 'event creation message not found, cannot decrypt response')\n\t\t}\n\t} else if (message.messageStubType) {\n\t\tconst jid = message.key?.remoteJid!\n\t\t//let actor = whatsappID (message.participant)\n\t\tlet participants: GroupParticipant[]\n\t\tconst emitParticipantsUpdate = (action: ParticipantAction) =>\n\t\t\tev.emit('group-participants.update', {\n\t\t\t\tid: jid,\n\t\t\t\tauthor: message.key.participant!,\n\t\t\t\tauthorPn: message.key.participantAlt!,\n\t\t\t\tauthorUsername: message.key.participantUsername!,\n\t\t\t\tparticipants,\n\t\t\t\taction\n\t\t\t})\n\t\tconst emitGroupUpdate = (update: Partial) => {\n\t\t\tev.emit('groups.update', [\n\t\t\t\t{\n\t\t\t\t\tid: jid,\n\t\t\t\t\t...update,\n\t\t\t\t\tauthor: message.key.participant ?? undefined,\n\t\t\t\t\tauthorPn: message.key.participantAlt,\n\t\t\t\t\tauthorUsername: message.key.participantUsername\n\t\t\t\t}\n\t\t\t])\n\t\t}\n\n\t\tconst emitGroupRequestJoin = (participant: LIDMapping, action: RequestJoinAction, method: RequestJoinMethod) => {\n\t\t\tev.emit('group.join-request', {\n\t\t\t\tid: jid,\n\t\t\t\tauthor: message.key.participant!,\n\t\t\t\tauthorPn: message.key.participantAlt!,\n\t\t\t\tauthorUsername: message.key.participantUsername!,\n\t\t\t\tparticipant: participant.lid,\n\t\t\t\tparticipantPn: participant.pn,\n\t\t\t\taction,\n\t\t\t\tmethod: method!\n\t\t\t})\n\t\t}\n\n\t\tconst participantsIncludesMe = () => participants.find(jid => areJidsSameUser(meId, jid.phoneNumber)) // ADD SUPPORT FOR LID\n\n\t\tswitch (message.messageStubType) {\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_CHANGE_NUMBER:\n\t\t\t\tparticipants = message.messageStubParameters.map((a: any) => JSON.parse(a as string)) || []\n\t\t\t\temitParticipantsUpdate('modify')\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_LEAVE:\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_REMOVE:\n\t\t\t\tparticipants = message.messageStubParameters.map((a: any) => JSON.parse(a as string)) || []\n\t\t\t\temitParticipantsUpdate('remove')\n\t\t\t\t// mark the chat read only if you left the group\n\t\t\t\tif (participantsIncludesMe()) {\n\t\t\t\t\tchat.readOnly = true\n\t\t\t\t}\n\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_ADD:\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_INVITE:\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_ADD_REQUEST_JOIN:\n\t\t\t\tparticipants = message.messageStubParameters.map((a: any) => JSON.parse(a as string)) || []\n\t\t\t\tif (participantsIncludesMe()) {\n\t\t\t\t\tchat.readOnly = false\n\t\t\t\t}\n\n\t\t\t\temitParticipantsUpdate('add')\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_DEMOTE:\n\t\t\t\tparticipants = message.messageStubParameters.map((a: any) => JSON.parse(a as string)) || []\n\t\t\t\temitParticipantsUpdate('demote')\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_PARTICIPANT_PROMOTE:\n\t\t\t\tparticipants = message.messageStubParameters.map((a: any) => JSON.parse(a as string)) || []\n\t\t\t\temitParticipantsUpdate('promote')\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_CHANGE_ANNOUNCE:\n\t\t\t\tconst announceValue = message.messageStubParameters?.[0]\n\t\t\t\temitGroupUpdate({ announce: announceValue === 'true' || announceValue === 'on' })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_CHANGE_RESTRICT:\n\t\t\t\tconst restrictValue = message.messageStubParameters?.[0]\n\t\t\t\temitGroupUpdate({ restrict: restrictValue === 'true' || restrictValue === 'on' })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_CHANGE_SUBJECT:\n\t\t\t\tconst name = message.messageStubParameters?.[0]\n\t\t\t\tchat.name = name\n\t\t\t\temitGroupUpdate({ subject: name })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_CHANGE_DESCRIPTION:\n\t\t\t\tconst description = message.messageStubParameters?.[0]\n\t\t\t\tchat.description = description\n\t\t\t\temitGroupUpdate({ desc: description })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_CHANGE_INVITE_LINK:\n\t\t\t\tconst code = message.messageStubParameters?.[0]\n\t\t\t\temitGroupUpdate({ inviteCode: code })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_MEMBER_ADD_MODE:\n\t\t\t\tconst memberAddValue = message.messageStubParameters?.[0]\n\t\t\t\temitGroupUpdate({ memberAddMode: memberAddValue === 'all_member_add' })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_MEMBERSHIP_JOIN_APPROVAL_MODE:\n\t\t\t\tconst approvalMode = message.messageStubParameters?.[0]\n\t\t\t\temitGroupUpdate({ joinApprovalMode: approvalMode === 'on' })\n\t\t\t\tbreak\n\t\t\tcase WAMessageStubType.GROUP_MEMBERSHIP_JOIN_APPROVAL_REQUEST_NON_ADMIN_ADD: // TODO: Add other events\n\t\t\t\tconst participant = JSON.parse(message.messageStubParameters?.[0]) as LIDMapping\n\t\t\t\tconst action = message.messageStubParameters?.[1] as RequestJoinAction\n\t\t\t\tconst method = message.messageStubParameters?.[2] as RequestJoinMethod\n\t\t\t\temitGroupRequestJoin(participant, action, method)\n\t\t\t\tbreak\n\t\t}\n\t} /* else if(content?.pollUpdateMessage) {\n\t\tconst creationMsgKey = content.pollUpdateMessage.pollCreationMessageKey!\n\t\t// we need to fetch the poll creation message to get the poll enc key\n\t\t// TODO: make standalone, remove getMessage reference\n\t\t// TODO: Remove entirely\n\t\tconst pollMsg = await getMessage(creationMsgKey)\n\t\tif(pollMsg) {\n\t\t\tconst meIdNormalised = jidNormalizedUser(meId)\n\t\t\tconst pollCreatorJid = getKeyAuthor(creationMsgKey, meIdNormalised)\n\t\t\tconst voterJid = getKeyAuthor(message.key, meIdNormalised)\n\t\t\tconst pollEncKey = pollMsg.messageContextInfo?.messageSecret!\n\n\t\t\ttry {\n\t\t\t\tconst voteMsg = decryptPollVote(\n\t\t\t\t\tcontent.pollUpdateMessage.vote!,\n\t\t\t\t\t{\n\t\t\t\t\t\tpollEncKey,\n\t\t\t\t\t\tpollCreatorJid,\n\t\t\t\t\t\tpollMsgId: creationMsgKey.id!,\n\t\t\t\t\t\tvoterJid,\n\t\t\t\t\t}\n\t\t\t\t)\n\t\t\t\tev.emit('messages.update', [\n\t\t\t\t\t{\n\t\t\t\t\t\tkey: creationMsgKey,\n\t\t\t\t\t\tupdate: {\n\t\t\t\t\t\t\tpollUpdates: [\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\tpollUpdateMessageKey: message.key,\n\t\t\t\t\t\t\t\t\tvote: voteMsg,\n\t\t\t\t\t\t\t\t\tsenderTimestampMs: (content.pollUpdateMessage.senderTimestampMs! as Long).toNumber(),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t]\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t])\n\t\t\t} catch(err) {\n\t\t\t\tlogger?.warn(\n\t\t\t\t\t{ err, creationMsgKey },\n\t\t\t\t\t'failed to decrypt poll vote'\n\t\t\t\t)\n\t\t\t}\n\t\t} else {\n\t\t\tlogger?.warn(\n\t\t\t\t{ creationMsgKey },\n\t\t\t\t'poll creation message not found, cannot decrypt update'\n\t\t\t)\n\t\t}\n\t\t} */\n\n\tif (Object.keys(chat).length > 1) {\n\t\tev.emit('chats.update', [chat])\n\t}\n}" repo = "whiskeysockets/baileys" url = "https://github.com/WhiskeySockets/Baileys.git" [[case]] advisory = "GHSA-vvvv-983w-r7pv" advisory_text = "@workos/authkit-session has an Open Redirect via state-derived redirect target\n\nAn open redirect vulnerability exists in `AuthService.handleCallback` due to insufficient validation of the `returnPathname` value derived from the OAuth `state` parameter.\n\nThe `state` parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker. The handleCallback function decodes and returns returnPathname without enforcing restrictions on origin or scheme. As a result, attacker-controlled values (e.g., `https://evil.com/`, `//evil.com`, or similar variants) may be returned to the application.\n\nIf this value is used directly in a redirect (e.g., via an HTTP `Location` header, framework redirect helpers, or client-side navigation), it may cause the user to be redirected to an external, attacker-controlled site.\n\n**Security Impact**\nThis issue may be used to facilitate phishing or user redirection attacks by leveraging the trust of the originating domain. For example, an attacker could craft a link that directs a user through a legitimate authentication flow and then redirects them to an external site.\n\nThe severity depends on how `returnPathname` is used by the application. Exploitation requires:\n\n* The application to use `returnPathname` as a redirect target, and\n* The absence of downstream validation or allowlisting\n\nThis vulnerability does not enable authentication bypass, token disclosure, or direct account compromise on its own, but may increase the effectiveness of social engineering attacks when combined with user interaction.\n\n**Vulnerability Type**\nCWE-601: URL Redirection to Untrusted Site (Open Redirect)\n\n**Patches**\nPatched in https://github.com/workos/authkit-session/releases/tag/v0.5.1" commit = "f56e1d6214a93160759e5677b7a3d772b244db39" cwe = "CWE-601" family = "untrusted_destination" function = "constantTimeEqual" function_lines = [[38, 43]] id = "workos-authkit-session-399c57ce0227249e" language = "typescript" method = "fix_site" parent = "64e82e3bb217e24d8b5a5a7f8e9606bda91b1c78" path = "src/utils.ts" post_fix = "export function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i]! ^ b[i]!;\n return diff === 0;\n}\n\n/**\n * Normalize an untrusted return-path candidate (e.g. decoded from OAuth\n * state) to a same-origin relative URL. The returned value always begins\n * with exactly one `/`, safe to emit directly as a `Location` header.\n *\n * Parsing against a throwaway origin lets the WHATWG URL parser strip any\n * smuggled host, scheme, backslash, tab, or newline; the leading-slash\n * normalization defuses `//evil.com`-style protocol-relative redirects\n * (CWE-601). `fallback` is sanitized by the same pipeline so a hostile\n * fallback can't reopen the hole.\n */" pre_fix = "export function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i]! ^ b[i]!;\n return diff === 0;\n}" repo = "workos/authkit-session" url = "https://github.com/workos/authkit-session.git"

${period}

${period}

${seriesName}

${seriesName}

${deviceName}

${deviceName}

' . $attr['trans'] . '

' . $attr['trans'] . '

\n * {title}\n * {subtitle}\n *
\n *

foo	bar
a	1
b	2
c	2

	\n ...
	\n ...
	\n ...
	\n ...

foo	bar
a	1
b	2
c	2

	\n ...
	\n ...
	\n ...
	\n ...

${period}

${period}

${seriesName}

${seriesName}

${deviceName}

${deviceName}

' . $attr['trans'] . '

' . $attr['trans'] . '

\n * {title}\n * {subtitle}\n * \n *

\n * {title}\n * {subtitle}\n *
\n *