Skip to content

Commit 3c8fb36

Browse files
charlypolyardatan
charlypoly
and
ardatan
authored
chore(deps): update @whatwg-node/fetch to fix vulnerability (ardatan#4605)
* chore(deps): update @whatwg-node/fetch to fix vulnerability * Create pink-ads-warn.md * Fix * Update changeset * Fix lint Co-authored-by: Arda TANRIKULU <ardatanrikulu@gmail.com>
1 parent fbb0709 commit 3c8fb36

File tree

10 files changed

+148
-47
lines changed

10 files changed

+148
-47
lines changed

‎.changeset/pink-ads-warn.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
'@graphql-tools/apollo-engine-loader': patch
3+
'@graphql-tools/github-loader': patch
4+
'@graphql-tools/url-loader': patch
5+
---
6+
7+
chore(deps): update @whatwg-node/fetch to fix vulnerability

‎packages/loaders/apollo-engine/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
},
5353
"dependencies": {
5454
"@graphql-tools/utils": "8.9.0",
55-
"@whatwg-node/fetch": "^0.0.2",
55+
"@whatwg-node/fetch": "^0.2.4",
5656
"sync-fetch": "0.4.1",
5757
"tslib": "^2.4.0"
5858
},

‎packages/loaders/github/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
"dependencies": {
5454
"@graphql-tools/utils": "8.9.0",
5555
"@graphql-tools/graphql-tag-pluck": "7.3.1",
56-
"@whatwg-node/fetch": "^0.0.2",
56+
"@whatwg-node/fetch": "^0.2.4",
5757
"sync-fetch": "0.4.1",
5858
"tslib": "^2.4.0"
5959
},

‎packages/loaders/url/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@
7070
"@graphql-tools/wrap": "8.5.1",
7171
"@n1ru4l/graphql-live-query": "^0.9.0",
7272
"@types/ws": "^8.0.0",
73-
"@whatwg-node/fetch": "^0.0.2",
73+
"@whatwg-node/fetch": "^0.2.4",
7474
"dset": "^3.1.2",
7575
"extract-files": "^11.0.0",
7676
"graphql-ws": "^5.4.1",

‎packages/loaders/url/src/event-stream/handleAsyncIterable.ts

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,11 @@
11
/* eslint-disable no-labels */
2+
import { TextDecoder } from '@whatwg-node/fetch';
23

3-
let decodeUint8Array: (uint8Array: Uint8Array) => string;
4-
5-
if (globalThis.Buffer) {
6-
decodeUint8Array = uint8Array => globalThis.Buffer.from(uint8Array).toString('utf-8');
7-
} else {
8-
const textDecoder = new TextDecoder();
9-
decodeUint8Array = uint8Array => textDecoder.decode(uint8Array, { stream: true });
10-
}
4+
const textDecoder = new TextDecoder('handleAsyncIterable');
115

126
export async function* handleAsyncIterable(asyncIterable: AsyncIterable<Uint8Array | string>) {
137
outer: for await (const chunk of asyncIterable) {
14-
const chunkStr = typeof chunk === 'string' ? chunk : decodeUint8Array(chunk);
8+
const chunkStr = typeof chunk === 'string' ? chunk : textDecoder.decode(chunk, { stream: true });
159
for (const part of chunkStr.split('\n\n')) {
1610
if (part) {
1711
const eventStr = part.split('event: ')[1];

‎packages/loaders/url/src/event-stream/handleEventStreamResponse.ts

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,20 @@ import { inspect, isAsyncIterable } from '@graphql-tools/utils';
33
import { handleAsyncIterable } from './handleAsyncIterable.js';
44
import { handleReadableStream } from './handleReadableStream.js';
55

6-
export async function handleEventStreamResponse(response: Response): Promise<AsyncGenerator<ExecutionResult>> {
6+
export function isReadableStream(value: any): value is ReadableStream {
7+
return value && typeof value.getReader === 'function';
8+
}
9+
10+
export async function handleEventStreamResponse(response: Response): Promise<AsyncIterable<ExecutionResult>> {
711
// node-fetch returns body as a promise so we need to resolve it
812
const body = response.body;
913
if (body) {
14+
if (isReadableStream(body)) {
15+
return handleReadableStream(body);
16+
}
1017
if (isAsyncIterable<Uint8Array | string>(body)) {
1118
return handleAsyncIterable(body);
1219
}
13-
return handleReadableStream(body);
1420
}
1521
throw new Error('Response body is expected to be a readable stream but got; ' + inspect(body));
1622
}

‎packages/loaders/url/src/event-stream/handleReadableStream.ts

Lines changed: 44 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,49 @@
1-
/* eslint-disable no-labels */
1+
import { observableToAsyncIterable } from '@graphql-tools/utils';
2+
import { TextDecoder } from '@whatwg-node/fetch';
3+
import { ExecutionResult } from 'graphql';
24

3-
export async function* handleReadableStream(readableStream: ReadableStream<Uint8Array>) {
4-
const textDecoderStream = new TextDecoderStream();
5-
const decodedStream = readableStream.pipeThrough(textDecoderStream);
6-
const reader = decodedStream.getReader();
7-
outer: while (true) {
8-
const { value, done } = await reader.read();
9-
if (value) {
10-
for (const part of value.split('\n\n')) {
11-
if (part) {
12-
const eventStr = part.split('event: ')[1];
13-
const dataStr = part.split('data: ')[1];
14-
if (eventStr === 'complete') {
15-
break outer;
5+
const textDecoder = new TextDecoder('handleReadableStream');
6+
7+
export function handleReadableStream(readableStream: ReadableStream<Uint8Array>) {
8+
return observableToAsyncIterable<ExecutionResult>({
9+
subscribe: observer => {
10+
const reader = readableStream.getReader();
11+
let completed = false;
12+
function pump() {
13+
return reader.read().then(({ done, value }) => {
14+
if (completed) {
15+
return;
16+
}
17+
if (value) {
18+
const chunk = typeof value === 'string' ? value : textDecoder.decode(value, { stream: true });
19+
for (const part of chunk.split('\n\n')) {
20+
if (part) {
21+
const eventStr = part.split('event: ')[1];
22+
const dataStr = part.split('data: ')[1];
23+
if (eventStr === 'complete') {
24+
observer.complete();
25+
}
26+
if (dataStr) {
27+
const data = JSON.parse(dataStr);
28+
observer.next(data.payload || data);
29+
}
30+
}
31+
}
1632
}
17-
if (dataStr) {
18-
const data = JSON.parse(dataStr);
19-
yield data.payload || data;
33+
if (done) {
34+
observer.complete();
35+
} else {
36+
pump();
2037
}
21-
}
38+
});
2239
}
23-
}
24-
if (done) {
25-
break;
26-
}
27-
}
40+
pump();
41+
return {
42+
unsubscribe: () => {
43+
reader.cancel();
44+
completed = true;
45+
},
46+
};
47+
},
48+
});
2849
}

‎packages/loaders/url/tests/handleEventStreamResponse.test.ts

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,9 @@ describe('handleEventStreamResponse', () => {
1313
});
1414

1515
const response = new Response(readableStream);
16-
const generator = await handleEventStreamResponse(response);
17-
const { value } = await generator.next();
16+
const asyncIterable = await handleEventStreamResponse(response);
17+
const iterator = asyncIterable[Symbol.asyncIterator]();
18+
const { value } = await iterator.next();
1819

1920
expect(value).toMatchInlineSnapshot(`
2021
Object {
@@ -32,8 +33,9 @@ describe('handleEventStreamResponse', () => {
3233
},
3334
});
3435
const response = new Response(readableStream);
35-
const generator = await handleEventStreamResponse(response);
36-
const iteratorResult = await generator.next();
36+
const asyncIterable = await handleEventStreamResponse(response);
37+
const iterator = asyncIterable[Symbol.asyncIterator]();
38+
const iteratorResult = await iterator.next();
3739

3840
expect(iteratorResult).toMatchInlineSnapshot(`
3941
Object {

‎packages/loaders/url/tests/url-loader.spec.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -840,7 +840,7 @@ input TestInput {
840840
const secondResult = await iterator.next();
841841
expect(secondResult.value).toStrictEqual(sentDatas[1]);
842842
// Stop the request
843-
await iterator.return!().catch(() => null);
843+
await iterator.return?.();
844844
const doneResult = await iterator.next();
845845
expect(doneResult).toStrictEqual({ done: true, value: undefined });
846846
expect(await serverResponseEnded$!).toBe(true);

‎yarn.lock

Lines changed: 76 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3031,6 +3031,33 @@
30313031
resolved "https://registry.yarnpkg.com/@opentelemetry/api/-/api-1.0.2.tgz#921e1f2b2484b762d77225a8a25074482d93fccf"
30323032
integrity sha512-DCF9oC89ao8/EJUqrp/beBlDR8Bp2R43jqtzayqCoomIvkwTuPfLcHdVhIGRR69GFlkykFjcDW+V92t0AS7Tww==
30333033

3034+
"@peculiar/asn1-schema@^2.1.6":
3035+
version "2.2.0"
3036+
resolved "https://registry.yarnpkg.com/@peculiar/asn1-schema/-/asn1-schema-2.2.0.tgz#d8a54527685c8dee518e6448137349444310ad64"
3037+
integrity sha512-1ENEJNY7Lwlua/1wvzpYP194WtjQBfFxvde2FlzfBFh/ln6wvChrtxlORhbKEnYswzn6fOC4c7HdC5izLPMTJg==
3038+
dependencies:
3039+
asn1js "^3.0.5"
3040+
pvtsutils "^1.3.2"
3041+
tslib "^2.4.0"
3042+
3043+
"@peculiar/json-schema@^1.1.12":
3044+
version "1.1.12"
3045+
resolved "https://registry.yarnpkg.com/@peculiar/json-schema/-/json-schema-1.1.12.tgz#fe61e85259e3b5ba5ad566cb62ca75b3d3cd5339"
3046+
integrity sha512-coUfuoMeIB7B8/NMekxaDzLhaYmp0HZNPEjYRm9goRou8UZIC3z21s0sL9AWoCw4EG876QyO3kYrc61WNF9B/w==
3047+
dependencies:
3048+
tslib "^2.0.0"
3049+
3050+
"@peculiar/webcrypto@^1.4.0":
3051+
version "1.4.0"
3052+
resolved "https://registry.yarnpkg.com/@peculiar/webcrypto/-/webcrypto-1.4.0.tgz#f941bd95285a0f8a3d2af39ccda5197b80cd32bf"
3053+
integrity sha512-U58N44b2m3OuTgpmKgf0LPDOmP3bhwNz01vAnj1mBwxBASRhptWYK+M3zG+HBkDqGQM+bFsoIihTW8MdmPXEqg==
3054+
dependencies:
3055+
"@peculiar/asn1-schema" "^2.1.6"
3056+
"@peculiar/json-schema" "^1.1.12"
3057+
pvtsutils "^1.3.2"
3058+
tslib "^2.4.0"
3059+
webcrypto-core "^1.7.4"
3060+
30343061
"@percy/config@^1.0.0-beta.36":
30353062
version "1.0.5"
30363063
resolved "https://registry.yarnpkg.com/@percy/config/-/config-1.0.5.tgz#a479e5ead928820da4deb1d33575690009f13747"
@@ -4195,17 +4222,19 @@
41954222
"@webassemblyjs/ast" "1.11.1"
41964223
"@xtuc/long" "4.2.2"
41974224

4198-
"@whatwg-node/fetch@^0.0.2":
4199-
version "0.0.2"
4200-
resolved "https://registry.yarnpkg.com/@whatwg-node/fetch/-/fetch-0.0.2.tgz#4242c4e36714b5018ccac0ab76f4ab5a208fbc1c"
4201-
integrity sha512-qiZn8dYRg0POzUvmHBs7blLxl6DPL+b+Z0JUsGaj7/8PFe2BJG9onrUVX6OWh6Z9YhcYw8yu+wtCAme5ZMiCKQ==
4225+
"@whatwg-node/fetch@^0.2.4":
4226+
version "0.2.4"
4227+
resolved "https://registry.yarnpkg.com/@whatwg-node/fetch/-/fetch-0.2.4.tgz#2290257d089cf3b85bcb59f4b0c2429512833d18"
4228+
integrity sha512-/bCrTp7TYUiP37hFjBb6aIAxS3VR2jSTxKArrV8UVwKeqP2yxadmgJDPBO8lQYDKvnVVf8ipP8rCu/jUMSR0kQ==
42024229
dependencies:
4230+
"@peculiar/webcrypto" "^1.4.0"
42034231
abort-controller "^3.0.0"
42044232
busboy "^1.6.0"
4233+
event-target-polyfill "^0.0.3"
42054234
form-data-encoder "^1.7.1"
42064235
formdata-node "^4.3.1"
42074236
node-fetch "^2.6.7"
4208-
undici "5.5.1"
4237+
undici "^5.8.0"
42094238
web-streams-polyfill "^3.2.0"
42104239

42114240
"@wry/context@^0.6.0":
@@ -4616,6 +4645,15 @@ asap@~2.0.3:
46164645
resolved "https://registry.yarnpkg.com/asap/-/asap-2.0.6.tgz#e50347611d7e690943208bbdafebcbc2fb866d46"
46174646
integrity sha1-5QNHYR1+aQlDIIu9r+vLwvuGbUY=
46184647

4648+
asn1js@^3.0.1, asn1js@^3.0.5:
4649+
version "3.0.5"
4650+
resolved "https://registry.yarnpkg.com/asn1js/-/asn1js-3.0.5.tgz#5ea36820443dbefb51cc7f88a2ebb5b462114f38"
4651+
integrity sha512-FVnvrKJwpt9LP2lAMl8qZswRNm3T4q9CON+bxldk2iwk3FFpuwhx2FfinyitizWHsVYyaY+y5JzDR0rCMV5yTQ==
4652+
dependencies:
4653+
pvtsutils "^1.3.2"
4654+
pvutils "^1.1.3"
4655+
tslib "^2.4.0"
4656+
46194657
assign-symbols@^1.0.0:
46204658
version "1.0.0"
46214659
resolved "https://registry.yarnpkg.com/assign-symbols/-/assign-symbols-1.0.0.tgz#59667f41fadd4f20ccbc2bb96b8d4f7f78ec0367"
@@ -6894,6 +6932,11 @@ etag@~1.8.1:
68946932
resolved "https://registry.yarnpkg.com/etag/-/etag-1.8.1.tgz#41ae2eeb65efa62268aebfea83ac7d79299b0887"
68956933
integrity sha1-Qa4u62XvpiJorr/qg6x9eSmbCIc=
68966934

6935+
event-target-polyfill@^0.0.3:
6936+
version "0.0.3"
6937+
resolved "https://registry.yarnpkg.com/event-target-polyfill/-/event-target-polyfill-0.0.3.tgz#ed373295f3b257774b5d75afb2599331d9f3406c"
6938+
integrity sha512-ZMc6UuvmbinrCk4RzGyVmRyIsAyxMRlp4CqSrcQRO8Dy0A9ldbiRy5kdtBj4OtP7EClGdqGfIqo9JmOClMsGLQ==
6939+
68976940
event-target-shim@^5.0.0:
68986941
version "5.0.1"
68996942
resolved "https://registry.yarnpkg.com/event-target-shim/-/event-target-shim-5.0.1.tgz#5d4d3ebdf9583d63a5333ce2deb7480ab2b05789"
@@ -11407,6 +11450,18 @@ purgecss@^4.0.3:
1140711450
postcss "^8.3.5"
1140811451
postcss-selector-parser "^6.0.6"
1140911452

11453+
pvtsutils@^1.3.2:
11454+
version "1.3.2"
11455+
resolved "https://registry.yarnpkg.com/pvtsutils/-/pvtsutils-1.3.2.tgz#9f8570d132cdd3c27ab7d51a2799239bf8d8d5de"
11456+
integrity sha512-+Ipe2iNUyrZz+8K/2IOo+kKikdtfhRKzNpQbruF2URmqPtoqAs8g3xS7TJvFF2GcPXjh7DkqMnpVveRFq4PgEQ==
11457+
dependencies:
11458+
tslib "^2.4.0"
11459+
11460+
pvutils@^1.1.3:
11461+
version "1.1.3"
11462+
resolved "https://registry.yarnpkg.com/pvutils/-/pvutils-1.1.3.tgz#f35fc1d27e7cd3dfbd39c0826d173e806a03f5a3"
11463+
integrity sha512-pMpnA0qRdFp32b1sJl1wOJNxZLQ2cbQx+k6tjNtZ8CpvVhNqEPRgivZ2WOUev2YMajecdH7ctUPDvEe87nariQ==
11464+
1141011465
qs@6.10.3:
1141111466
version "6.10.3"
1141211467
resolved "https://registry.yarnpkg.com/qs/-/qs-6.10.3.tgz#d6cde1b2ffca87b5aa57889816c5f81535e22e8e"
@@ -13483,6 +13538,11 @@ undici@5.5.1:
1348313538
resolved "https://registry.yarnpkg.com/undici/-/undici-5.5.1.tgz#baaf25844a99eaa0b22e1ef8d205bffe587c8f43"
1348413539
integrity sha512-MEvryPLf18HvlCbLSzCW0U00IMftKGI5udnjrQbC5D4P0Hodwffhv+iGfWuJwg16Y/TK11ZFK8i+BPVW2z/eAw==
1348513540

13541+
undici@^5.8.0:
13542+
version "5.8.0"
13543+
resolved "https://registry.yarnpkg.com/undici/-/undici-5.8.0.tgz#dec9a8ccd90e5a1d81d43c0eab6503146d649a4f"
13544+
integrity sha512-1F7Vtcez5w/LwH2G2tGnFIihuWUlc58YidwLiCv+jR2Z50x0tNXpRRw7eOIJ+GvqCqIkg9SB7NWAJ/T9TLfv8Q==
13545+
1348613546
unicode-canonical-property-names-ecmascript@^2.0.0:
1348713547
version "2.0.0"
1348813548
resolved "https://registry.yarnpkg.com/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.0.tgz#301acdc525631670d39f6146e0e77ff6bbdebddc"
@@ -13943,6 +14003,17 @@ web-streams-polyfill@^3.2.0:
1394314003
resolved "https://registry.yarnpkg.com/web-streams-polyfill/-/web-streams-polyfill-3.2.0.tgz#a6b74026b38e4885869fb5c589e90b95ccfc7965"
1394414004
integrity sha512-EqPmREeOzttaLRm5HS7io98goBgZ7IVz79aDvqjD0kYXLtFZTc0T/U6wHTPKyIjb+MdN7DFIIX6hgdBEpWmfPA==
1394514005

14006+
webcrypto-core@^1.7.4:
14007+
version "1.7.5"
14008+
resolved "https://registry.yarnpkg.com/webcrypto-core/-/webcrypto-core-1.7.5.tgz#c02104c953ca7107557f9c165d194c6316587ca4"
14009+
integrity sha512-gaExY2/3EHQlRNNNVSrbG2Cg94Rutl7fAaKILS1w8ZDhGxdFOaw6EbCfHIxPy9vt/xwp5o0VQAx9aySPF6hU1A==
14010+
dependencies:
14011+
"@peculiar/asn1-schema" "^2.1.6"
14012+
"@peculiar/json-schema" "^1.1.12"
14013+
asn1js "^3.0.1"
14014+
pvtsutils "^1.3.2"
14015+
tslib "^2.4.0"
14016+
1394614017
webidl-conversions@^3.0.0:
1394714018
version "3.0.1"
1394814019
resolved "https://registry.yarnpkg.com/webidl-conversions/-/webidl-conversions-3.0.1.tgz#24534275e2a7bc6be7bc86611cc16ae0a5654871"

0 commit comments

Comments
 (0)