Nia Crawl: Ex8 PR Draft - #1110
Closed
ngodugu-marklogic wants to merge 42 commits into
Closed
Conversation
MLE-26608 - merge release changes into develop
This reverts commit 5518e9c.
This reverts commit 23d8bbd.
This reverts commit 70f361b.
Bumped minimatch, and added a force on serialize-javascript (used by mocha) and underscore (used by jsdoc).
Adds explicit top-level permissions: contents: read to limit the default GITHUB_TOKEN scope for all jobs. Individual jobs that need write access (copyright-validation) already declare their own permissions block which overrides the default. This follows the principle of least privilege recommended in GitHub's PwnRequest security guidance.
…sions PDP-1182 SECCMP-1797: Add top-level permissions to restrict default token
…rom-develop PDP-1182: Remove per-repo pr-workflow.yaml
* MLE-28498 Permission fixes This contains permission fixes for testing as a result of the 11.3.5 changes. * MLE-28498 transform test fixes Updated transforms tests to expect rest-transform-user as a result of 11.3.5 changes from ML-28684. * MLE-28498 dmsdk fixes Copilot fix for flakey dmsdk tests * MLE-28498 Skip optic-fromDocs tests for < 12.1 After confirming with the MarkLogic Server team, op:from-docs is only supported in MLS 12.1 since it is a new feature. I have added a skip for anything lower than MLS 12.1
* MLE-27883 adapt cts.param in the Optic API for MLS 12.1 * MLE-27883 update Copyright * MLE-27883 fix to traverse the exported plan to verify the cts namespace
* MLE-28335 added fragment option in fromSearch - Add 'fragment' option support to fromSearch() for MLS 12.1+ - Valid values: 'document' (default), 'properties', 'locks', 'any' - Client-side validation in PlanSearchOption (plan-builder-base.js) - Updated JSDoc for fromSearch() in plan-builder-generated.js - Added xdmp-lock-acquire/release privileges to rest-evaluator role in both test-setup-users.js and rest-evaluator.json (Gradle config) - Added fragment option integration tests to test-basic/plan-search.js (TC0-TC5, gated on serverVersion >= 12.1) * MLE-28336 updated Copyright * MLE-28335 update fromSearchDocs with fragment option * MLE-28335 resolve npm audit vulnerabilities (0 remaining) Security fixes: - sanitize-html: 2.17.0 → ^2.17.4 (critical XSS via xmp passthrough, GHSA-rpr9-rxv7-x643) - brace-expansion override: 2.0.2 → 5.0.6 (DoS via zero-step sequence, GHSA-f886-m6hf-6m8v) - serialize-javascript override: 7.0.4 → 7.0.5 (CPU exhaustion DoS, GHSA-qj8w-gfj5-8c6v) - diff override: added 9.0.0 (DoS in parsePatch/applyPatch for mocha 11.4+, GHSA-73rr-hh4g-fpgx) - fast-uri, flatted, lodash, picomatch, postcss updated via npm audit fix * MLE-28335 update scheduled trigger for regressions * MLE-28335 skip cts.param integration tests for server < 12.1 * MLE-28335 fix to use the correct optic test database testconfig.restWriterConnection
* MLE-28583 xdmp.uriContentType and xdmp.uriFormat test fix xdmp.uriContentType and xdmp.uriFormat are no longer callable and these tests should only run on ML11 or lower * MLE-28583 transform user test fix The previous change was a regression fixed by the ML server team and the test has been updated to reflect the correct behavior
* MLE-29694 update qs to 6.15.2 * MLE-29694 fixed flaky fragment option tests for fromSearch * MLE-29694 fixed flaky fragment option tests * MLE-29694 fixed typo in comment
* MLE-30684 Switch to Harness Artifact Registry * MLE-30684 npm audit non blocking in Jenkins
* MLE-30686 Bump form-data Bump form-data from version 4.0.4 -> 4.0.6 to fix vulnerability * MLE-30964 Bump markdown-it override Bump markdown-it override from 14.1.1 -> 14.2.0
…t-cts-query MLE-29889 param binding accept cts query
…ccessToken (#1091) * MLE-30256 Encode accessTokenDuration Before URL Interpolation in getAccessToken
* MLE-30257 Replace encodeURI With encodeURIComponent --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
MLE-30265 add warning for BASIC auth without SSL
MLE-30268 crypto.pseudoRandomBytes -> crypto.randomBytes
MLE-30967 Update CODEOWNERS
* MLE-31133 bump brace-expansion * MLE-31135 bump fast-uri
MLE-30263: Fix Uncaught Exception in getAccessToken Error Handler
Add comprehensive security documentation to www-authenticate-patched modules explaining protocol-mandated MD5 usage per RFC 2617/7616. Changes: - md5.js: Add security notice with RFC references and warnings - user-credentials.js: Add JSDoc for digest() function - www-authenticate.js: Add module-level security notice Security Finding Triage: - CodeQL Alert #20 (CWE-327): Triaged - Protocol-Required - CodeQL Alert #4 (CWE-916): Triaged - Protocol-Required - Risk: ACCEPTED (mitigated by HTTPS/TLS in production) MD5 cannot be replaced without breaking HTTP Digest Authentication compatibility per RFC 2617 Section 3.2.2. Passwords are NOT stored, only hashed transiently for challenge-response authentication. Documentation prevents misuse for password storage or token generation by providing clear warnings and guidance on secure alternatives (bcrypt, scrypt, Argon2id for passwords; SHA-256, SHA-3 for hashing). Issue: #1109
Add ESLint guardrails and security documentation to prevent MD5 misuse outside HTTP Digest Authentication context. Changes: - eslint.config.js: Add no-restricted-modules rule to block MD5 imports - lib/www-authenticate-patched/README.md: Add security triage documentation - lib/www-authenticate-patched/md5.js: Change @Private to @internal JSDoc tag Fixes: - Major Issue #1: ESLint rule prevents external MD5 imports (AC-002) - Major Issue #2: README.md documents security rationale (AC-005) - Minor Issue #3: @internal tag better conveys security boundary The ESLint rule blocks imports like: require('lib/www-authenticate-patched/md5') require('./lib/www-authenticate-patched/md5.js') But allows internal use via relative paths: require('./md5') // From within www-authenticate-patched/ Security Finding Triage: - CodeQL Alert #20 (CWE-327): Triaged - Protocol-Required - CodeQL Alert #4 (CWE-916): Triaged - Protocol-Required - Defense-in-depth: Documentation + Technical enforcement Issue: #1109 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ngodugu-marklogic
requested review from
anu3990
and removed request for
anu3990
August 13, 2026 20:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Exercise 8 draft PR for Nia workflow validation.