-
Notifications
You must be signed in to change notification settings - Fork 327
R25 EA #4346
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
R25 EA #4346
Conversation
🦋 Changeset detectedLatest commit: 5d717ef The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
| apiKey, | ||
| ].join('\n') | ||
|
|
||
| const signature = CryptoJS.HmacSHA256(stringToSign, secret).toString(CryptoJS.enc.Hex) |
Check failure
Code scanning / CodeQL
Use of password hash with insufficient computational effort High
an access to apiKey
Password from
an access to API_KEY
Password from
an access to apiKey
Password from
an access to apiKey
Password from
an access to apiKey
Password from
an access to apiKey
Password from
an access to apiKey
Password from
an access to apiKey
Password from
an access to apiKey
Copilot Autofix
AI about 22 hours ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
My understanding is it doesn't like the use of apiKey in the HmacSHA256, but I'm not sure we have another option since the API requires this, right?
Worth reaching out to security team to sanity check though 🙏
packages/sources/r25/test/integration/__snapshots__/adapter.test.ts.snap
Outdated
Show resolved
Hide resolved
| expect(response.json()).toMatchSnapshot() | ||
| }) | ||
|
|
||
| it('should return error for invalid token', async () => { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
maybe worth expanding this for all of the documented error cases
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There are no documented error cases, but I added a test case for an invalid chainType, as well as invalid chainType and tokenName in the payload.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There are 8 documented error cases in the API doc in the ticket. Worth seeing if they're reproducible.
| apiKey, | ||
| ].join('\n') | ||
|
|
||
| const expectedSignature = CryptoJS.HmacSHA256(expectedStringToSign, secret).toString( |
Check failure
Code scanning / CodeQL
Use of password hash with insufficient computational effort High test
an access to apiKey
Copilot Autofix
AI about 22 hours ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
| * - timestamp: Current UTC timestamp in milliseconds | ||
| * - api_key: API key | ||
| */ | ||
| export const getRequestHeaders = ({ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
instead of this object{...} argument, can you try something like this
export const getRequestHeaders = (getRequestHeadersParams: GetRequestHeadersParams)...
// inside the function
const { method, path, etc, ... } = getRequestHeadersParams
Closes #OPDATA-5148
Description
This EA exposes nav endpoint that fetches latest NAV via R25’s REST API and returns a single numeric result with timestamps.
......
Changes
Steps to Test
navendpointexpected response
Quality Assurance
infra-k8sconfiguration file.adapter-secretsconfiguration file.test-payload.jsonfile with relevant requests.feature/x,chore/x,release/x,hotfix/x,fix/x) or is created from Jira.