Skip to content

Conversation

@DarshanCode2005
Copy link
Contributor

@DarshanCode2005 DarshanCode2005 commented Jan 14, 2026

Addresses: #1881

Summary

This PR modernizes the example-fetching script and fixes a ZIP extraction security issue. (file: scripts\fetch-asyncapi-example.js)

Changes

  • Added node: prefixed imports for Node.js built-in modules
  • Fixed a ZIP Slip (path traversal) vulnerability when extracting archive entries

@changeset-bot
Copy link

changeset-bot bot commented Jan 14, 2026

⚠️ No Changeset found

Latest commit: ac160af

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@sonarqubecloud
Copy link

@DarshanCode2005 DarshanCode2005 changed the title refactor: use top-level await, node imports, and secure zip extraction refactor: node imports, and secure zip extraction (file: scripts\fetch-asyncapi-example.js) Jan 14, 2026
@DarshanCode2005
Copy link
Contributor Author

@Shurtu-gal sir, @AayushSaini101 sir,
Could you please review the improvements made in fetch-asyncapi-example.js?
There is still one SonarCloud issue remaining that suggests removing the Promise in favor of top-level await. Applying that change would require converting the file (or module) to ESM, which breaks the current CommonJS setup and existing builds. For this reason, I believe this specific issue should be ignored. Apart from this, all SonarCloud other problems in the file have been addressed.
I have included below the link to the related SonarCloud findings for you to refer to.
https://sonarcloud.io/project/issues?fileUuids=AZA0tMV-KSpUHBkKhrAA&issueStatuses=OPEN%2CCONFIRMED&id=asyncapi_cli

Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: To Triage

Development

Successfully merging this pull request may close these issues.

1 participant