safe-global / safe-client-gateway / 30002868743

88%

Build Type

push

github

Committed by web-flow

Commit Message

chore(deps): upgrade typeorm to 1.1.0 (#3290)

  - Upgrades typeorm from 0.3.28 to 1.1.0, the current stable release line.
  - Primary driver: an unpatched advisory affecting UpdateQueryBuilder/SoftDeleteQueryBuilder — the order argument passed to orderBy/addOrderBy on those builders is concatenated into generated SQL without validation, permitting blind SQL injection via the sort direction
  (SelectQueryBuilder.orderBy was already unaffected). Fixed upstream in 0.3.29/1.0.0.
    - Verified this was not currently exploitable in this codebase: this project only connects to Postgres (no MySQL/MariaDB driver, and the advisory is scoped to those), and the only orderBy/addOrderBy call in the codebase runs on a SelectQueryBuilder with a hardcoded literal, not user
  input. Upgrading anyway as defense-in-depth since it's a direct dependency of our ORM.
  - Went with 1.1.0 (latest) rather than the minimal 0.3.29 patch per request, picking up additional upstream fixes (aggregate-column resolution, an eager-loading bug that could overwrite manually-set relations, a migration query-runner leak, returning option for update/upsert).

Coverage Stats

3684 of 4428 branches covered (83.2%)

Branch coverage included in aggregate %.

5 of 5 new or added lines in 2 files covered. (100.0%)

2 existing lines in 2 files now uncovered.

9561 of 10623 relevant lines covered (90.0%)

489.56 hits per line