|
8 | 8 | checkoutOnSecurityReleaseBranch, |
9 | 9 | NEXT_SECURITY_RELEASE_REPOSITORY, |
10 | 10 | validateDate, |
11 | | - getSummary, |
12 | 11 | commitAndPushVulnerabilitiesJSON, |
13 | 12 | NEXT_SECURITY_RELEASE_FOLDER |
14 | 13 | } from './security-release/security-release.js'; |
@@ -84,6 +83,7 @@ export default class SecurityBlog { |
84 | 83 | const releaseDate = new Date(content.releaseDate); |
85 | 84 | const template = this.getSecurityPostReleaseTemplate(); |
86 | 85 | const data = { |
| 86 | + // TODO: read from pre-sec-release |
87 | 87 | annoucementDate: await this.getAnnouncementDate(cli), |
88 | 88 | releaseDate: this.formatReleaseDate(releaseDate), |
89 | 89 | affectedVersions: this.getAffectedVersions(content), |
@@ -205,46 +205,25 @@ export default class SecurityBlog { |
205 | 205 | const reports = content.reports; |
206 | 206 | let template = ''; |
207 | 207 | for (const report of reports) { |
208 | | - let cveId = report.cve_ids?.join(', '); |
| 208 | + const cveId = report.cveIds?.join(', '); |
209 | 209 | if (!cveId) { |
210 | | - // ask for the CVE ID |
211 | | - // it should have been created with the step `--request-cve` |
212 | | - cveId = await this.cli.prompt(`What is the CVE ID for vulnerability https://hackerone.com/reports/${report.id} ${report.title}?`, { |
213 | | - questionType: 'input', |
214 | | - defaultAnswer: 'TBD' |
215 | | - }); |
216 | | - report.cve_ids = [cveId]; |
217 | | - content[kChanged] = true; |
| 210 | + this.cli.error(`CVE ID for vulnerability ${report.link} ${report.title} not found`); |
| 211 | + process.exit(1); |
218 | 212 | } |
219 | 213 | template += `## ${report.title} (${cveId}) - (${report.severity.rating})\n\n`; |
220 | 214 | if (!report.summary) { |
221 | | - const fetchIt = await this.cli.prompt(`Summary missing for vulnerability https://hackerone.com/reports/${report.id} ${report.title}.\ |
222 | | - Do you want to try fetch it from HackerOne??`, { |
223 | | - questionType: 'confirm', |
224 | | - defaultAnswer: true |
225 | | - }); |
226 | | - |
227 | | - if (fetchIt) { |
228 | | - report.summary = await getSummary(report.id, this.req); |
229 | | - content[kChanged] = true; |
230 | | - } |
231 | | - |
232 | | - if (!report.summary) { |
233 | | - this.cli.error(`Summary missing for vulnerability https://hackerone.com/reports/${report.id} ${report.title}. Please create it before continuing.`); |
234 | | - process.exit(1); |
235 | | - } |
| 215 | + this.cli.error(`Summary missing for vulnerability ${report.link} ` + |
| 216 | + `${report.title}. Please create it before continuing.`); |
| 217 | + process.exit(1); |
236 | 218 | } |
| 219 | + |
237 | 220 | template += `${report.summary}\n\n`; |
238 | 221 | const releaseLines = report.affectedVersions.join(', '); |
239 | 222 | template += `Impact:\n\n- This vulnerability affects all users\ |
240 | 223 | in active release lines: ${releaseLines}\n\n`; |
241 | 224 | if (!report.patchAuthors) { |
242 | | - const author = await this.cli.prompt(`Who fixed vulnerability https://hackerone.com/reports/${report.id} ${report.title}? If multiple use & as separator`, { |
243 | | - questionType: 'input', |
244 | | - defaultAnswer: 'TBD' |
245 | | - }); |
246 | | - report.patchAuthors = author.split('&').map((p) => p.trim()); |
247 | | - content[kChanged] = true; |
| 225 | + this.cli.error(`Missing patch author for vulnerability ${report.link} ${report.title}`); |
| 226 | + process.exit(1); |
248 | 227 | } |
249 | 228 | template += `Thank you, to ${report.reporter} for reporting this vulnerability\ |
250 | 229 | and thank you ${report.patchAuthors.join(' and ')} for fixing it.\n\n`; |
|
0 commit comments