Skip to content

update util improvements#104

Merged
Mzack9999 merged 5 commits intomainfrom
update-utils-bug-fix
Mar 16, 2023
Merged

update util improvements#104
Mzack9999 merged 5 commits intomainfrom
update-utils-bug-fix

Conversation

@tarunKoyalwar
Copy link
Copy Markdown
Member

@tarunKoyalwar tarunKoyalwar commented Mar 14, 2023

Proposed Changes

  • fix GetUpdateCallback not using http timeout
  • Disable proxying upgrade traffic (i.e github get latest release , download binary etc)

@tarunKoyalwar tarunKoyalwar self-assigned this Mar 14, 2023
github-advanced-security[bot]
github-advanced-security bot found potential problems Mar 14, 2023
View reviewed changes
update/update.go
Transport: &http.Transport{
Proxy: http.ProxyFromEnvironment,
Proxy: http.ProxyFromEnvironment,
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},

Check failure

Code scanning / CodeQL

Disabled TLS certificate check

InsecureSkipVerify should not be used in production code.
@tarunKoyalwar tarunKoyalwar requested a review from Mzack9999 March 14, 2023 13:42
Mzack9999
Mzack9999 requested changes Mar 16, 2023
View reviewed changes
Copy link
Copy Markdown
Member

@Mzack9999 Mzack9999 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there is some leftover:

  • Unused code
  • Probably GH client should be used to download the binaries

@tarunKoyalwar
Copy link
Copy Markdown
Member Author

tarunKoyalwar commented Mar 16, 2023

@Mzack9999

  • github.Client does not provider a go to way download asset instead returns a download URL . we use http.Client which is configured with GITHUB_TOKEN if given to download asset . (the logic is based on current implementations of pdtm and nuclei)

@tarunKoyalwar tarunKoyalwar requested a review from Mzack9999 March 16, 2023 19:06
@Mzack9999 Mzack9999 merged commit 2c9818e into main Mar 16, 2023
@Mzack9999 Mzack9999 deleted the update-utils-bug-fix branch March 16, 2023 20:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Mzack9999 Mzack9999 Mzack9999 approved these changes

Assignees

@tarunKoyalwar tarunKoyalwar

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

update utils improvements

3 participants

@tarunKoyalwar @Mzack9999 @github-advanced-security