microsoft/azure-pipelines-tasksPublic

NotificationsYou must be signed in to change notification settings
Fork2.7k
Star3.6k

Upgrading minimatch version to fix MSRC vulnerability issue#21035

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

rishabhmalikMS merged 13 commits intomasterfromusers/rishabhmalik/pkgVersionUpgrade

May 29, 2025

Merged

Upgrading minimatch version to fix MSRC vulnerability issue#21035

rishabhmalikMS merged 13 commits intomasterfromusers/rishabhmalik/pkgVersionUpgrade

May 29, 2025

Conversation

Copy link

Contributor

rishabhmalikMS commentedMay 20, 2025•
edited
Loading

Context

Upgrading minimatch version to fix MSRC vulnerability issue.
📌How to link to ADO Work Items
AB#2281543

Task Name

ExtractFilesV1, GulpV0, GulpV1, XamarinTestCloudV1

Description

A ReDoS vulnerability exists in the braceExpand function of the minimatch package, which can be exploited using crafted input patterns.
Fix: Upgrade minimatch to version 3.0.5 or later.
ICM link for reference:https://portal.microsofticm.com/imp/v5/incidents/details/31000000365389/summary

Key minimatch v4 changes:

** (globstar) now matches zero or more path segments (previously one or more). We already have pipeline tests using ** patterns, and these are passing, confirming our patterns work as expected with the new globstar behavior.
New option: allowWindowsEscape (not used in our code).
Fix bug with escaped '@' in patterns (Not related to our implementation)
nocase: true is always treated as "magic" (we only use nocase on Windows in our code, which is expected).
Internal marker exposure and improved pattern parsing (not relevant to our usage).

Canary runs
ExtractFiles:https://dev.azure.com/canarytest/PipelineTasks/_build/results?buildId=162239&view=results
GulpV0:https://dev.azure.com/canarytest/PipelineTasks/_build/results?buildId=162240&view=results
GulpV1:https://dev.azure.com/canarytest/PipelineTasks/_build/results?buildId=162241&view=results

Risk Assessment (Low / Medium / High)

Medium. Major version upgrade of minimatch package. Tested by running canary tests pipeline and unit tests for updated tests.

Unit Tests Added or Updated (Yes / No)

No new tests added

Additional Testing Performed

Tested by running canary tests pipeline and unit tests for updated tests

Documentation Changes Required (Yes / No)

Checklist

Related issue linked (if applicable)
Task version was bumped — seeversioning guide
Verified the task behaves as expected

rishabhmalikMS added2 commits

May 19, 2025 12:55

upgrading axios version for cg fix

d0b07cf

Upgrading minimatch versions

56076be

rishabhmalikMS requested review froma team andtarunramsinghani ascode owners

May 20, 2025 07:00

rishabhmalikMS added2 commits

May 20, 2025 12:45

updating task versions

2f4c7f8

minor update

bc15740

Copy link

ContributorAuthor

rishabhmalikMS commentedMay 20, 2025

/azp run

minor fix

463feea

rishabhmalikMS changed the title~~Users/rishabhmalik/pkg version upgrade~~Upgrading minimatch version to fix MSRC vulnerability issue

May 22, 2025

Merge branch 'master' into users/rishabhmalik/pkgVersionUpgrade

c0d2542

rishabhmalikMSenabled auto-merge (squash)

May 23, 2025 05:51

Copy link

Contributor

MantavyaDh commentedMay 23, 2025

Is there any specific reason we are updating to version 3.0.5, the latest version is 10.0.1
Can we have a look at this once.change log

Copy link

Collaborator

tarunramsinghani commentedMay 23, 2025

Please do share the canary pipeline links for the tasks changed.

rishabhmalikMS added5 commits

May 26, 2025 09:22

Merge branch 'master' into users/rishabhmalik/pkgVersionUpgrade

a93150e

minor fixes

42eae12

testing pattern check/matching with minimatch v9 as v10 is failing in…

1b31f04

… pattern matching in few cases

minor update

7db17be

minor update

874a386

Copy link

ContributorAuthor

rishabhmalikMS commentedMay 26, 2025

/azp run

Copy link

ContributorAuthor

rishabhmalikMS commentedMay 26, 2025

Is there any specific reason we are updating to version 3.0.5, the latest version is 10.0.1 Can we have a look at this once.change log

Latest versions are causing issues in pattern matching. Hence, we have use v4.

MantavyaDh reviewed

May 26, 2025

View reviewed changes

Tasks/GulpV1/package.json OutdatedShow resolvedHide resolved

rishabhmalikMS added2 commits

May 26, 2025 13:57

minor fixes

92521ce

Merge branch 'master' into users/rishabhmalik/pkgVersionUpgrade

855ac3a

Copy link

ContributorAuthor

rishabhmalikMS commentedMay 26, 2025

/azp run

Copy link

Collaborator

tarunramsinghani commentedMay 26, 2025

Since we hae updated Major version the Risk should not be Low, and it should atleast be medium, BTW did you check what other changes are there in V4 and validated the task code that the changes does not impact the functionality

Copy link

ContributorAuthor

rishabhmalikMS commentedMay 26, 2025

Since we hae updated Major version the Risk should not be Low, and it should atleast be medium, BTW did you check what other changes are there in V4 and validated the task code that the changes does not impact the functionality

Key minimatch v4 changes:

** (globstar) now matches zero or more path segments (previously one or more). We already have pipeline tests using ** patterns, and these are passing, confirming our patterns work as expected with the new globstar behavior.
New option: allowWindowsEscape (not used in our code).
Fix bug with escaped '@' in patterns (Not related to our implementation)
nocase: true is always treated as "magic" (we only use nocase on Windows in our code, which is expected).
Internal marker exposure and improved pattern parsing (not relevant to our usage).

Copy link

Contributor

sanjuyadav24 commentedMay 28, 2025

Hi@rishabhmalikMS
Few of the images skipped in test pipeline, could you please check and re-run the pipeline with all images

Copy link

Contributor

MantavyaDh commentedMay 28, 2025•
edited
Loading

Hi@rishabhmalikMS Few of the images skipped in test pipeline, could you please check and re-run the pipeline with all images

I investigated this, it is due to the variables missing those pools which are set in the pipelines,canary pipelines
And these have been skipped in past as well for these tasks. We need to update the variables in the master branch for the tasks that are skipping.

Copy link

Contributor

sanjuyadav24 commentedMay 29, 2025

Hi@rishabhmalikMS Few of the images skipped in test pipeline, could you please check and re-run the pipeline with all images
I investigated this, it is due to the variables missing those pools which are set in the pipelines,canary pipelines And these have been skipped in past as well for these tasks. We need to update the variables in the master branch for the tasks that are skipping.

okay, lets create a task to update these variables