Skip to content

fix(merge-allof-schema-properties): avoid file content disclosure#829

Merged
pyrooka merged 1 commit into
mainfrom
nb/fix-cwe-209
Jul 23, 2026
Merged

fix(merge-allof-schema-properties): avoid file content disclosure#829
pyrooka merged 1 commit into
mainfrom
nb/fix-cwe-209

Conversation

@pyrooka

@pyrooka pyrooka commented Jul 21, 2026

Copy link
Copy Markdown
Member

PR summary

Fixed a security vulnerability related to CWE-209
(Generation of Error Message Containing Sensitive Information)
in the merge-allof-schema-properties utility function.

PR Checklist

General checklist

Please make sure that your PR fulfills the following requirements:

  • The commit message follows the Angular Commit Message Guidelines.
  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been added / updated (for bug fixes / features)
  • Dependencies have been updated as needed
  • .secrets.baseline has been updated as needed
  • npm run update-utilities has been run if any files in packages/utilities/src have been updated

Checklist for adding a new validation rule:

  • Added new validation rule definition (packages/ruleset/src/rules/*.js, index.js)
  • If necessary, added new validation rule implementation (packages/ruleset/src/functions/*.js, updated index.js)
  • Added new rule to default configuration (packages/ruleset/src/ibm-oas.js)
  • Added tests for new rule (packages/ruleset/test/*.test.js)
  • Added docs for new rule (docs/ibm-cloud-rules.md)
  • Added scoring rubric entry for new rule (packages/validator/src/scoring-tool/rubric.js)

Fixed a security vulnerability related to CWE-209
(Generation of Error Message Containing Sensitive Information)
in the merge-allof-schema-properties utility function.

Signed-off-by: Norbert Biczo <pyrooka@users.noreply.github.com>
@pyrooka
pyrooka requested a review from Andris28 July 21, 2026 12:25

@Andris28 Andris28 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

@pyrooka
pyrooka merged commit 08f893e into main Jul 23, 2026
9 checks passed
@pyrooka
pyrooka deleted the nb/fix-cwe-209 branch July 23, 2026 09:57
pyrooka added a commit that referenced this pull request Jul 23, 2026
Fixed a security vulnerability related to CWE-209
(Generation of Error Message Containing Sensitive Information)
in the merge-allof-schema-properties utility function.

Signed-off-by: Norbert Biczo <pyrooka@users.noreply.github.com>
ibm-devx-sdk pushed a commit that referenced this pull request Jul 23, 2026
## @ibm-cloud/openapi-ruleset [1.33.12](https://github.com/IBM/openapi-validator/compare/@ibm-cloud/openapi-ruleset@1.33.11...@ibm-cloud/openapi-ruleset@1.33.12) (2026-07-23)

### Bug Fixes

* avoid file content disclosure when merging allOf schemas ([#829](#829)) ([d01b95b](d01b95b))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants