Skip to content

refactor: node imports, and secure zip extraction (file: scripts\fetch-asyncapi-example.js)#1972

Open
DarshanCode2005 wants to merge 8 commits intoasyncapi:masterfrom
DarshanCode2005:refactor/fetch-asyncapi-example
Open

refactor: node imports, and secure zip extraction (file: scripts\fetch-asyncapi-example.js)#1972
DarshanCode2005 wants to merge 8 commits intoasyncapi:masterfrom
DarshanCode2005:refactor/fetch-asyncapi-example

Conversation

@DarshanCode2005
Copy link
Contributor

@DarshanCode2005 DarshanCode2005 commented Jan 14, 2026

Addresses: #1881

Summary

This PR modernizes the example-fetching script and fixes a ZIP extraction security issue. (file: scripts\fetch-asyncapi-example.js)

Changes

  • Added node: prefixed imports for Node.js built-in modules
  • Fixed a ZIP Slip (path traversal) vulnerability when extracting archive entries

@changeset-bot
Copy link

changeset-bot bot commented Jan 14, 2026

⚠️ No Changeset found

Latest commit: befcb39

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@DarshanCode2005 DarshanCode2005 changed the title refactor: use top-level await, node imports, and secure zip extraction refactor: node imports, and secure zip extraction (file: scripts\fetch-asyncapi-example.js) Jan 14, 2026
@DarshanCode2005
Copy link
Contributor Author

@Shurtu-gal sir, @AayushSaini101 sir,
Could you please review the improvements made in fetch-asyncapi-example.js?
There is still one SonarCloud issue remaining that suggests removing the Promise in favor of top-level await. Applying that change would require converting the file (or module) to ESM, which breaks the current CommonJS setup and existing builds. For this reason, I believe this specific issue should be ignored. Apart from this, all SonarCloud other problems in the file have been addressed.
I have included below the link to the related SonarCloud findings for you to refer to.
https://sonarcloud.io/project/issues?fileUuids=AZA0tMV-KSpUHBkKhrAA&issueStatuses=OPEN%2CCONFIRMED&id=asyncapi_cli

Thank you!

@AayushSaini101
Copy link
Collaborator

/u

@sonarqubecloud
Copy link

sonarqubecloud bot commented Feb 6, 2026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: To Triage

Development

Successfully merging this pull request may close these issues.

3 participants