[CVE] Fix CVE-2024-21538 issue

.cypress/fixtures/jaeger-sample.txt

@@ -47,4 +47,4 @@
 {"index":{"_id": "4mTeXHIBnsBqmoqSL5kS"}}
 { "traceID": "10086a977fa5e33e", "spanID": "395e8bc2ec308935", "flags": 1, "operationName": "HTTP GET", "references": [ { "refType": "CHILD_OF", "traceID": "10086a977fa5e33e", "spanID": "63079f6f3d73249c" } ], "startTime": 1590695963737008, "startTimeMillis": 1590695963737, "duration": 49448, "tags": [ { "key": "span.kind", "type": "string", "value": "client" }, { "key": "component", "type": "string", "value": "net/http" }, { "key": "http.method", "type": "string", "value": "GET" }, { "key": "http.url", "type": "string", "value": "http://0.0.0.0:8083/route?dropoff=211%2C653&pickup=902%2C494" }, { "key": "http.url", "type": "string", "value": "0.0.0.0:8083" }, { "key": "net/http.reused", "type": "bool", "value": "true" }, { "key": "net/http.was_idle", "type": "bool", "value": "true" }, { "key": "http.status_code", "type": "int64", "value": "200" }, { "key": "internal.span.format", "type": "string", "value": "proto" } ], "logs": [ { "timestamp": 1590695963737030, "fields": [ { "key": "event", "type": "string", "value": "GetConn" } ] }, { "timestamp": 1590695963737041, "fields": [ { "key": "event", "type": "string", "value": "GotConn" } ] }, { "timestamp": 1590695963737072, "fields": [ { "key": "event", "type": "string", "value": "WroteHeaders" } ] }, { "timestamp": 1590695963737075, "fields": [ { "key": "event", "type": "string", "value": "WroteRequest" } ] }, { "timestamp": 1590695963786418, "fields": [ { "key": "event", "type": "string", "value": "GotFirstResponseByte" } ] }, { "timestamp": 1590695963786442, "fields": [ { "key": "event", "type": "string", "value": "PutIdleConn" } ] }, { "timestamp": 1590695963786455, "fields": [ { "key": "event", "type": "string", "value": "ClosedBody" } ] } ], "process": { "serviceName": "frontend", "tags": [ { "key": "jaeger.version", "type": "string", "value": "Go-2.22.1" }, { "key": "hostname", "type": "string", "value": "26863aca8ad6" }, { "key": "ip", "type": "string", "value": "172.18.0.4" }, { "key": "client-uuid", "type": "string", "value": "23de000d43e9c751" } ] } }
 {"index":{"_id": "5GTeXHIBnsBqmoqSL5kS"}}
-{ "traceID": "10086a977fa5e33e", "spanID": "001413cc09ae3346", "flags": 1, "operationName": "HTTP GET", "references": [ { "refType": "CHILD_OF", "traceID": "10086a977fa5e33e", "spanID": "72f2b6b3b8a6e686" } ], "startTime": 1590695963766142, "startTimeMillis": 1590695963766, "duration": 37221, "tags": [ { "key": "span.kind", "type": "string", "value": "client" }, { "key": "component", "type": "string", "value": "net/http" }, { "key": "http.method", "type": "string", "value": "GET" }, { "key": "http.url", "type": "string", "value": "http://0.0.0.0:8083/route?dropoff=211%2C653&pickup=427%2C876" }, { "key": "http.url", "type": "string", "value": "0.0.0.0:8083" }, { "key": "net/http.reused", "type": "bool", "value": "true" }, { "key": "net/http.was_idle", "type": "bool", "value": "true" }, { "key": "http.status_code", "type": "int64", "value": "200" }, { "key": "internal.span.format", "type": "string", "value": "proto" } ], "logs": [ { "timestamp": 1590695963766174, "fields": [ { "key": "event", "type": "string", "value": "GetConn" } ] }, { "timestamp": 1590695963766185, "fields": [ { "key": "event", "type": "string", "value": "GotConn" } ] }, { "timestamp": 1590695963766203, "fields": [ { "key": "event", "type": "string", "value": "WroteHeaders" } ] }, { "timestamp": 1590695963766207, "fields": [ { "key": "event", "type": "string", "value": "WroteRequest" } ] }, { "timestamp": 1590695963803291, "fields": [ { "key": "event", "type": "string", "value": "GotFirstResponseByte" } ] }, { "timestamp": 1590695963803348, "fields": [ { "key": "event", "type": "string", "value": "PutIdleConn" } ] }, { "timestamp": 1590695963803362, "fields": [ { "key": "event", "type": "string", "value": "ClosedBody" } ] } ], "process": { "serviceName": "frontend", "tags": [ { "key": "jaeger.version", "type": "string", "value": "Go-2.22.1" }, { "key": "hostname", "type": "string", "value": "26863aca8ad6" }, { "key": "ip", "type": "string", "value": "172.18.0.4" }, { "key": "client-uuid", "type": "string", "value": "23de000d43e9c751" } ] } }
+{ "traceID": "10086a977fa5e33e", "spanID": "001413cc09ae3346", "flags": 1, "operationName": "HTTP GET", "references": [ { "refType": "CHILD_OF", "traceID": "10086a977fa5e33e", "spanID": "72f2b6b3b8a6e686" } ], "startTime": 1590695963766142, "startTimeMillis": 1590695963766, "duration": 37221, "tags": [ { "key": "span.kind", "type": "string", "value": "client" }, { "key": "component", "type": "string", "value": "net/http" }, { "key": "http.method", "type": "string", "value": "GET" }, { "key": "http.url", "type": "string", "value": "http://0.0.0.0:8083/route?dropoff=211%2C653&pickup=427%2C876" }, { "key": "http.url", "type": "string", "value": "0.0.0.0:8083" }, { "key": "net/http.reused", "type": "bool", "value": "true" }, { "key": "net/http.was_idle", "type": "bool", "value": "true" }, { "key": "http.status_code", "type": "int64", "value": "200" }, { "key": "internal.span.format", "type": "string", "value": "proto" } ], "logs": [ { "timestamp": 1590695963766174, "fields": [ { "key": "event", "type": "string", "value": "GetConn" } ] }, { "timestamp": 1590695963766185, "fields": [ { "key": "event", "type": "string", "value": "GotConn" } ] }, { "timestamp": 1590695963766203, "fields": [ { "key": "event", "type": "string", "value": "WroteHeaders" } ] }, { "timestamp": 1590695963766207, "fields": [ { "key": "event", "type": "string", "value": "WroteRequest" } ] }, { "timestamp": 1590695963803291, "fields": [ { "key": "event", "type": "string", "value": "GotFirstResponseByte" } ] }, { "timestamp": 1590695963803348, "fields": [ { "key": "event", "type": "string", "value": "PutIdleConn" } ] }, { "timestamp": 1590695963803362, "fields": [ { "key": "event", "type": "string", "value": "ClosedBody" } ] } ], "process": { "serviceName": "frontend", "tags": [ { "key": "jaeger.version", "type": "string", "value": "Go-2.22.1" }, { "key": "hostname", "type": "string", "value": "26863aca8ad6" }, { "key": "ip", "type": "string", "value": "172.18.0.4" }, { "key": "client-uuid", "type": "string", "value": "23de000d43e9c751" } ] } }

.github/workflows/cypress-e2e-gantt-chart-test.yml

@@ -130,14 +130,14 @@ jobs:
         working-directory: OpenSearch-Dashboards/plugins/dashboards-visualizations
 
       - name: Capture failure screenshots
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: cypress-screenshots-${{ matrix.os }}
           path: OpenSearch-Dashboards/plugins/dashboards-visualizations/.cypress/screenshots
 
       - name: Capture test video
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: cypress-videos-${{ matrix.os }}

.github/workflows/ftr-e2e-gantt-chart-test.yml

@@ -141,14 +141,14 @@ jobs:
         working-directory: opensearch-dashboards-functional-test
 
       - name: Capture failure screenshots
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: cypress-screenshots-${{ matrix.os }}
           path: opensearch-dashboards-functional-test/cypress/screenshots
 
       - name: Capture test video
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@v4
         if: failure()
         with:
           name: cypress-videos-${{ matrix.os }}

.github/workflows/test-and-build-workflow.yml

@@ -59,7 +59,7 @@ jobs:
           mv ./build/*.zip ./build/${{ env.PLUGIN_NAME }}-${{ env.OPENSEARCH_PLUGIN_VERSION }}.zip
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@v4
         with:
           name: gantt-chart-ubuntu
           path: ./OpenSearch-Dashboards/plugins/dashboards-visualizations/build
@@ -123,7 +123,7 @@ jobs:
           mv ./build/*.zip ./build/${{ env.PLUGIN_NAME }}-${{ env.OPENSEARCH_PLUGIN_VERSION }}.zip
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@v4
         with:
           name: gantt-chart-windows
           path: ./OpenSearch-Dashboards/plugins/dashboards-visualizations/build
@@ -184,7 +184,7 @@ jobs:
           mv ./build/*.zip ./build/${{ env.PLUGIN_NAME }}-${{ env.OPENSEARCH_PLUGIN_VERSION }}.zip
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v1
+        uses: actions/upload-artifact@v4
         with:
           name: gantt-chart-macos
           path: ./OpenSearch-Dashboards/plugins/dashboards-visualizations/build

DEVELOPER_GUIDE.md

@@ -4,8 +4,8 @@ So you want to contribute code to this project? Excellent! We're glad you're her
 
 ### Setup
 
-1. Download OpenSearch for the version that matches the [OpenSearch Dashboards version specified in package.json](gantt-chart/package.json#L5).
-1. Download the OpenSearch Dashboards source code for the [version specified in package.json](gantt-chart/package.json#L5) you want to set up.
+1. Download OpenSearch for the version that matches the [OpenSearch Dashboards version specified in package.json](package.json#L3).
+1. Download the OpenSearch Dashboards source code for the [version specified in package.json](package.json#L3) you want to set up.
 
 1. Change your node version to the version specified in `.node-version` inside the OpenSearch Dashboards root directory.
 1. cd into the OpenSearch Dashboards source code directory.

package.json

@@ -32,6 +32,7 @@
     "glob-parent": "^6.0.1",
     "tough-cookie": "^4.1.3",
     "semver": "^7.5.2",
-    "@cypress/request": "^3.0.0"
+    "@cypress/request": "^3.0.0",
+    "cross-spawn": "^7.0.5"
   }
 }

yarn.lock

@@ -459,21 +459,10 @@ [email protected]:
   resolved "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.2.tgz#b5fd54220aa2bc5ab57aab7140c940754503c1a7"
   integrity sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ==
 
-cross-spawn@^6.0.5:
-  version "6.0.5"
-  resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-6.0.5.tgz#4a5ec7c64dfae22c3a14124dbacdee846d80cbc4"
-  integrity sha512-eTVLrBSt7fjbDygz805pMnstIs2VTBNkRm0qxZd+M7A5XDdxVRWO5MxGBXZhjY4cqLYLdtrGqRf8mBPmzwSpWQ==
-  dependencies:
-    nice-try "^1.0.4"
-    path-key "^2.0.1"
-    semver "^5.5.0"
-    shebang-command "^1.2.0"
-    which "^1.2.9"
-
-cross-spawn@^7.0.0:
-  version "7.0.3"
-  resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.3.tgz#f73a85b9d5d41d045551c177e2882d4ac85728a6"
-  integrity sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==
+cross-spawn@^6.0.5, cross-spawn@^7.0.0, cross-spawn@^7.0.5:
+  version "7.0.6"
+  resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.6.tgz#8a58fe78f00dcd70c370451759dfbfaf03e8ee9f"
+  integrity sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==
   dependencies:
     path-key "^3.1.0"
     shebang-command "^2.0.0"
@@ -1304,11 +1293,6 @@ natural-compare@^1.4.0:
   resolved "https://registry.yarnpkg.com/natural-compare/-/natural-compare-1.4.0.tgz#4abebfeed7541f2c27acfb29bdbbd15c8d5ba4f7"
   integrity sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==
 
-nice-try@^1.0.4:
-  version "1.0.5"
-  resolved "https://registry.yarnpkg.com/nice-try/-/nice-try-1.0.5.tgz#a3378a7696ce7d223e88fc9b764bd7ef1089e366"
-  integrity sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ==
-
 npm-run-path@^4.0.0:
   version "4.0.1"
   resolved "https://registry.yarnpkg.com/npm-run-path/-/npm-run-path-4.0.1.tgz#b7ecd1e5ed53da8e37a55e1c2269e0b97ed748ea"
@@ -1381,11 +1365,6 @@ path-is-absolute@^1.0.0:
   resolved "https://registry.yarnpkg.com/path-is-absolute/-/path-is-absolute-1.0.1.tgz#174b9268735534ffbc7ace6bf53a5a9e1b5c5f5f"
   integrity sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==
 
-path-key@^2.0.1:
-  version "2.0.1"
-  resolved "https://registry.yarnpkg.com/path-key/-/path-key-2.0.1.tgz#411cadb574c5a140d3a4b1910d40d80cc9f40b40"
-  integrity sha512-fEHGKCSmUSDPv4uoj8AlD+joPlq3peND+HRYyxFz4KPw4z926S/b8rIuFs2FYJg3BwsxJf6A9/3eIdLaYC+9Dw==
-
 path-key@^3.0.0, path-key@^3.1.0:
   version "3.1.1"
   resolved "https://registry.yarnpkg.com/path-key/-/path-key-3.1.1.tgz#581f6ade658cbba65a0d3380de7753295054f375"
@@ -1570,32 +1549,20 @@ safe-buffer@^5.0.1, safe-buffer@^5.1.2:
   resolved "https://registry.yarnpkg.com/safer-buffer/-/safer-buffer-2.1.2.tgz#44fa161b0187b9549dd84bb91802f9bd8385cd6a"
   integrity sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==
 
-semver@^5.5.0, semver@^6.1.2, semver@^7.5.2, semver@^7.5.3:
+semver@^6.1.2, semver@^7.5.2, semver@^7.5.3:
   version "7.5.4"
   resolved "https://registry.yarnpkg.com/semver/-/semver-7.5.4.tgz#483986ec4ed38e1c6c48c34894a9182dbff68a6e"
   integrity sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==
   dependencies:
     lru-cache "^6.0.0"
 
-shebang-command@^1.2.0:
-  version "1.2.0"
-  resolved "https://registry.yarnpkg.com/shebang-command/-/shebang-command-1.2.0.tgz#44aac65b695b03398968c39f363fee5deafdf1ea"
-  integrity sha512-EV3L1+UQWGor21OmnvojK36mhg+TyIKDh3iFBKBohr5xeXIhNBcx8oWdgkTEEQ+BEFFYdLRuqMfd5L84N1V5Vg==
-  dependencies:
-    shebang-regex "^1.0.0"
-
 shebang-command@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/shebang-command/-/shebang-command-2.0.0.tgz#ccd0af4f8835fbdc265b82461aaf0c36663f34ea"
   integrity sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==
   dependencies:
     shebang-regex "^3.0.0"
 
-shebang-regex@^1.0.0:
-  version "1.0.0"
-  resolved "https://registry.yarnpkg.com/shebang-regex/-/shebang-regex-1.0.0.tgz#da42f49740c0b42db2ca9728571cb190c98efea3"
-  integrity sha512-wpoSFAxys6b2a2wHZ1XpDSgD7N9iVjg29Ph9uV/uaP9Ex/KXlkTZTeddxDPSYQpgvzKLGJke2UU0AzoGCjNIvQ==
-
 shebang-regex@^3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/shebang-regex/-/shebang-regex-3.0.0.tgz#ae16f1644d873ecad843b0307b143362d4c42172"
@@ -1862,13 +1829,6 @@ [email protected]:
     core-util-is "1.0.2"
     extsprintf "^1.2.0"
 
-which@^1.2.9:
-  version "1.3.1"
-  resolved "https://registry.yarnpkg.com/which/-/which-1.3.1.tgz#a45043d54f5805316da8d62f9f50918d3da70b0a"
-  integrity sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==
-  dependencies:
-    isexe "^2.0.0"
-
 which@^2.0.1:
   version "2.0.2"
   resolved "https://registry.yarnpkg.com/which/-/which-2.0.2.tgz#7c6a8dd0a636a0327e10b59c9286eee93f3f51b1"