fix(security): vuln-scan false positive from declared semver range vs resolved version - #229
Merged
Wolfvin merged 1 commit intoJul 12, 2026
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
… range instead of resolved version _parse_bun_lock() collected packages from TWO sources: workspaces.dependencies (declared semver ranges from package.json, e.g. '^9.0.0') AND packages (resolved concrete versions from the lockfile, e.g. '9.0.2'). Both were fed into the same vulnerability-matching loop as if they were equally valid 'installed versions'. _compare_versions()'s _parse_ver() extracts leading digits per dot-separated segment via regex ^(\d+) — for '^9.0.0', the first segment '^9' has no leading digit (the caret isn't stripped), so it silently parses to 0. This makes '^9.0.0' compare as if it were '0.0.0', matching ANY '<X.Y.Z' vulnerable_range regardless of the real installed version. Found via real-codebase validation (Coretax-Auto-Downloader KDS backend): jsonwebtoken reported 'installed_version': '^9.0.0' against 'vulnerable_range': '<9.0.0' — 9.0.0 is not less than 9.0.0, so this was a false positive purely from checking the declared range string. Fix: only collect from the 'packages' (resolved) section — remove the workspaces.dependencies collection entirely, since it duplicates data already present (correctly, as concrete versions) in 'packages'. Verified: total vuln findings 22 -> 13, jsonwebtoken false positives (4) eliminated entirely.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found while auditing
security --check vuln-scanagainst KDS backend.jsonwebtokenwas flagged withinstalled_version: "^9.0.0"againstvulnerable_range: "<9.0.0"— but 9.0.0 is not less than 9.0.0, so this is a false positive. Root cause:_parse_bun_lock()collected packages fromworkspaces.dependencies(declared semver RANGES like^9.0.0) in addition topackages(resolved concrete versions)._compare_versions()'s digit-extraction regex silently parses^9as0(no leading digit), making^9.0.0compare as0.0.0— matching any<X.Y.Zrange regardless of actual installed version.Fix: remove the
workspaces.dependenciescollection — onlypackages(resolved) has concrete versions suitable for vulnerability matching.Verified: total findings 22 → 13, jsonwebtoken false positives (4) eliminated.