-
Notifications
You must be signed in to change notification settings - Fork 42
Expand file tree
/
Copy pathosv-scanner.toml
More file actions
134 lines (114 loc) · 5.64 KB
/
Copy pathosv-scanner.toml
File metadata and controls
134 lines (114 loc) · 5.64 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
# OSV-Scanner config (.github/workflows/security.yml).
#
# The scan covers bun.lock — the BUILD-TIME dependency tree. Nothing in it
# reaches a user: the extension ships no npm runtime at all (a core project
# invariant — see CLAUDE.md), third-party runtime code lives in
# extension/vendor/ and is pinned separately by vendor.lock.json, and
# packaging/package.ts never resolves a node_modules path into an artifact.
# Its release-only cold-path compaction uses Bun's built-in parser and preserves
# vendored bytes. So an advisory here is a risk to the
# machine that BUILDS and SIGNS a release, not to an installed extension —
# which still matters (that machine handles the signing key), just with a
# different blast radius and a different set of realistic attackers.
#
# Every entry below is a triaged advisory in that build-time tree, reached
# only through the Firefox signing toolchain (web-ext → addons-linter →
# addons-scanner-utils). Most are unresolvable from here: web-ext is
# deliberately exact-pinned (packaging/sign.ts explains why — an unpinned
# `npx web-ext` on the release-critical path was itself the supply-chain
# risk we removed), and it pins several of these transitively at exact
# versions of its own (shell-quote 1.7.3, tmp 0.2.6). They clear when
# upstream ships a release that moves them, not before.
#
# ignoreUntil is load-bearing: these expire, the job goes red, and someone
# re-triages. An ignore list without an expiry is how a scanner quietly
# stops meaning anything. Anything NEW — a newly published advisory, or a
# dependency a PR adds — is not on this list and fails the job today.
#
# Re-triage checklist when these expire: `bun outdated`, check whether
# web-ext has released past 10.6.0, drop any entry that no longer appears
# in the scan, and extend only what genuinely still cannot move.
[[IgnoredVulns]]
id = "GHSA-3jxr-9vmj-r5cp"
ignoreUntil = 2026-11-01
reason = "brace-expansion, transitive glob dependency of the web-ext toolchain. Build-time only; never shipped."
[[IgnoredVulns]]
id = "GHSA-mh99-v99m-4gvg"
ignoreUntil = 2026-11-01
reason = "brace-expansion, transitive glob dependency of the web-ext toolchain. Build-time only; never shipped."
[[IgnoredVulns]]
id = "GHSA-rgw5-rvv9-x895"
ignoreUntil = 2026-11-01
reason = "brace-expansion, transitive glob dependency of the web-ext toolchain. Build-time only; never shipped."
[[IgnoredVulns]]
id = "GHSA-4c8g-83qw-93j6"
ignoreUntil = 2026-11-01
reason = "fast-uri, via addons-linter's JSON-schema validation. Build-time only; never shipped."
[[IgnoredVulns]]
id = "GHSA-7p8r-x3mc-p8w7"
ignoreUntil = 2026-11-01
reason = "fast-uri, via addons-linter's JSON-schema validation. Build-time only; never shipped."
[[IgnoredVulns]]
id = "GHSA-v2hh-gcrm-f6hx"
ignoreUntil = 2026-11-01
reason = "fast-uri, via addons-linter's JSON-schema validation. Build-time only; never shipped."
[[IgnoredVulns]]
id = "GHSA-5p2g-fcmc-qvqq"
ignoreUntil = 2026-09-15
reason = "image-size 2.0.2, exact-pinned by the latest addons-linter and with no patched upstream release. Our Bun patch disables the vulnerable HEIF/JXL parsers before calculation; regression tested. Build-time only; never shipped."
[[IgnoredVulns]]
id = "GHSA-w3rx-r6r6-pgpr"
ignoreUntil = 2026-09-15
reason = "image-size 2.0.2, exact-pinned by the latest addons-linter and with no patched upstream release. Our Bun patch disables the vulnerable ICNS parser before calculation; regression tested. Build-time only; never shipped."
# undici — web-ext's HTTP client for the AMO upload/poll. The closest thing
# here to a path that matters (it talks to a network service during signing),
# but it talks only to addons.mozilla.org over TLS, in a release job that is
# now bound to a protected environment.
[[IgnoredVulns]]
id = "GHSA-35p6-xmwp-9g52"
ignoreUntil = 2026-11-01
reason = "undici, via web-ext's AMO client. Build-time only; talks only to addons.mozilla.org."
[[IgnoredVulns]]
id = "GHSA-4cwx-7wf7-3272"
ignoreUntil = 2026-11-01
reason = "undici, via web-ext's AMO client. Build-time only; talks only to addons.mozilla.org."
[[IgnoredVulns]]
id = "GHSA-8xcm-r25x-g524"
ignoreUntil = 2026-11-01
reason = "undici, via web-ext's AMO client. Build-time only; talks only to addons.mozilla.org."
[[IgnoredVulns]]
id = "GHSA-g8m3-5g58-fq7m"
ignoreUntil = 2026-11-01
reason = "undici, via web-ext's AMO client. Build-time only; talks only to addons.mozilla.org."
[[IgnoredVulns]]
id = "GHSA-hm92-r4w5-c3mj"
ignoreUntil = 2026-11-01
reason = "undici, via web-ext's AMO client. Build-time only; talks only to addons.mozilla.org."
[[IgnoredVulns]]
id = "GHSA-jr45-8vmc-qm54"
ignoreUntil = 2026-11-01
reason = "undici, via web-ext's AMO client. Build-time only; talks only to addons.mozilla.org."
[[IgnoredVulns]]
id = "GHSA-m8rv-5g2x-5cg5"
ignoreUntil = 2026-11-01
reason = "undici, via web-ext's AMO client. Build-time only; talks only to addons.mozilla.org."
[[IgnoredVulns]]
id = "GHSA-p88m-4jfj-68fv"
ignoreUntil = 2026-11-01
reason = "undici, via web-ext's AMO client. Build-time only; talks only to addons.mozilla.org."
[[IgnoredVulns]]
id = "GHSA-pr7r-676h-xcf6"
ignoreUntil = 2026-11-01
reason = "undici, via web-ext's AMO client. Build-time only; talks only to addons.mozilla.org."
[[IgnoredVulns]]
id = "GHSA-v3r7-h72x-cjcm"
ignoreUntil = 2026-11-01
reason = "undici, via web-ext's AMO client. Build-time only; talks only to addons.mozilla.org."
[[IgnoredVulns]]
id = "GHSA-vmh5-mc38-953g"
ignoreUntil = 2026-11-01
reason = "undici, via web-ext's AMO client. Build-time only; talks only to addons.mozilla.org."
[[IgnoredVulns]]
id = "GHSA-vxpw-j846-p89q"
ignoreUntil = 2026-11-01
reason = "undici, via web-ext's AMO client. Build-time only; talks only to addons.mozilla.org."