hacker07/NeoTachyon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: prerm stop-before-rt_tables, BusyBox awk, js-yaml vuln

Browse Source 
- service/package.uc: call INIT_PATH stop before process-killing in
  prerm_cleanup so the routing table entry is still visible when the
  service shuts down (fixes test: 'prerm must stop Tachyon before
  removing its routing table name')
- service/package.uc: replace awk regex with | alternation and \/
  escaping with grep -E / grep -F; BusyBox awk does not support |
  in regex literals and silently mishandles \/ — fixes awk syntax
  errors in CI (both prerm_cleanup and postinst_restore)
- fe-app-tachyon: pin js-yaml to ^5.2.1 via overrides to fix the
  quadratic O(n^2) !!omap resolution DoS (same root cause as
  CVE-2026-59870 / GHSA-724g-mxrg-4qvm, never backported to 3.x/4.x)
- fe-app-tachyon: npm audit fix for brace-expansion and nanoid vulns
This commit is contained in:
Dushnilin
2026-08-09 12:34:58 +03:00
parent 95cfe7914f
commit 676ee2041b
3 changed files with 28 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fe-app-tachyon/package-lock.json
Generated
+16 -16
View File
@@ -1811,9 +1811,9 @@
}
},
"node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
"version": "2.1.2",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
"integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
"integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -2085,9 +2085,9 @@
}
},
"node_modules/brace-expansion": {
"version": "1.1.16",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
"integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
"version": "1.1.18",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
"integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -2830,9 +2830,9 @@
}
},
"node_modules/glob/node_modules/brace-expansion": {
"version": "2.1.2",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
"integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
"integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -3013,9 +3013,9 @@
"license": "MIT"
},
"node_modules/js-yaml": {
"version": "4.3.0",
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
"integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
"version": "5.2.3",
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz",
"integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==",
"dev": true,
"funding": [
{
@@ -3032,7 +3032,7 @@
"argparse": "^2.0.1"
},
"bin": {
"js-yaml": "bin/js-yaml.js"
"js-yaml": "bin/js-yaml.mjs"
}
},
"node_modules/jsesc": {
@@ -3519,9 +3519,9 @@
"optional": true
},
"node_modules/nanoid": {
"version": "3.3.16",
"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
"integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
"version": "3.3.18",
"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
"integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
"dev": true,
"funding": [
{
fe-app-tachyon/package.json
+3 -2
View File
@@ -1,4 +1,4 @@
{
{
"name": "fe-app-tachyon",
"version": "1.2.47",
"license": "MIT",
@@ -37,6 +37,7 @@
"vitest": "^4.1.10"
},
"overrides": {
"postcss": "8.5.23"
"postcss": "8.5.23",
"js-yaml": "^5.2.1"
}
}
tachyon/files/usr/lib/service/package.uc
+9 -3
View File
@@ -131,13 +131,17 @@ function prerm_cleanup(action) {
remember_upgrade_state(action);
if (!PACKAGE_TEST_MODE) {
// Stop the service first so it can clean up while the routing table entry is still present.
command_success_from_args([INIT_PATH, "stop"]);
// Kill the WAN hotplug monitor and all init.d/tachyon processes that
// continuously re-spawn flock -w 1000 waiters (the root cause of deadlocks).
system("ps 2>/dev/null | awk '/99-tachyon-wan|init\.d\/tachyon/{print $1}' | while read _pid; do kill -9 \"$_pid\" 2>/dev/null; done; true");
// Use grep -E for alternation: BusyBox awk does not support | in regex literals.
system("ps 2>/dev/null | grep -E '99-tachyon-wan|init[.]d/tachyon' | awk '{print $1}' | while read _pid; do kill -9 \"$_pid\" 2>/dev/null; done; true");
// Kill any remaining flock -w 1000 waiters.
system("ps 2>/dev/null | awk '/flock 1000/{print $1}' | while read _pid; do kill -9 \"$_pid\" 2>/dev/null; done; true");
// Kill the tachyon service processes directly (no init.d, no flock).
system("ps 2>/dev/null | awk '/\/usr\/bin\/tachyon/{print $1}' | while read _pid; do kill \"$_pid\" 2>/dev/null; done; true");
// Use grep -F: BusyBox awk mangles \/ escaping inside regex literals.
system("ps 2>/dev/null | grep -F '/usr/bin/tachyon' | awk '{print $1}' | while read _pid; do kill \"$_pid\" 2>/dev/null; done; true");
restore_dnsmasq_if_needed();
remove_managed_sing_box();
}
@@ -152,7 +156,9 @@ function postinst_restore() {
// Kill any flock waiters and init.d/tachyon processes that appeared since
// prerm ran. procd continuously re-triggers retry_start_on_wan_up which
// spawns new flock -w 1000 waiters.
system("ps 2>/dev/null | awk '/\\/etc\\/init.d\\/tachyon|flock 1000|99-tachyon-wan/{print $1}' | while read _pid; do kill -9 \"$_pid\" 2>/dev/null; done; true");
// Use grep -E for alternation and grep -F for path: BusyBox awk mangles | and \/ in regex literals.
system("ps 2>/dev/null | grep -E '99-tachyon-wan|flock 1000' | awk '{print $1}' | while read _pid; do kill -9 \"$_pid\" 2>/dev/null; done; true");
system("ps 2>/dev/null | grep -F '/etc/init.d/tachyon' | awk '{print $1}' | while read _pid; do kill -9 \"$_pid\" 2>/dev/null; done; true");
// Use BIN_PATH start (lifecycle.uc) instead of INIT_PATH start (rc.common).
// init.d/tachyon start goes through rc.common which uses flock -w 1000 and
// will deadlock if ANY other init.d/tachyon process holds the procd lock.