optimism icon indicating copy to clipboard operation
optimism copied to clipboard

feat(ctp): merge with contracts-governance

Open smartcontracts opened this issue 3 years ago • 4 comments

Description Removes the contracts-governance package and merges the remaining scripts, contracts, and tests into contracts-periphery.

smartcontracts avatar Sep 16 '22 18:09 smartcontracts

🦋 Changeset detected

Latest commit: f1ed9c06dec77cc279de0796cb5eebe187f34263

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
Name Type
@eth-optimism/contracts-periphery Patch
@eth-optimism/drippie-mon Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

changeset-bot[bot] avatar Sep 16 '22 18:09 changeset-bot[bot]

This PR changes implementation code, but doesn't include a changeset. Did you forget to add one?

mergify[bot] avatar Sep 16 '22 18:09 mergify[bot]

Semgrep found 10 detect-non-literal-fs-filename findings:

  • packages/contracts-periphery/scripts/governance/create-airdrop-json.ts: L14, L28, L38
  • packages/contracts-periphery/scripts/governance/create-distributor-json.ts: L16, L61
  • packages/contracts-periphery/scripts/governance/deploy-distributor.ts: L24
  • packages/contracts-periphery/scripts/governance/generate-merkle-root.ts: L15, L24
  • packages/contracts-periphery/scripts/governance/multi-send.ts: L21
  • packages/contracts-periphery/scripts/governance/test-claims.ts: L19

Detected function args enter fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated.

⚪️ This finding does not block your pull request.
🙈 From javascript.lang.security.audit.detect-non-literal-fs-filename.detect-non-literal-fs-filename.

semgrep-app[bot] avatar Sep 16 '22 18:09 semgrep-app[bot]

Hey @smartcontracts! This PR has merge conflicts. Please fix them before continuing review.

mergify[bot] avatar Sep 18 '22 13:09 mergify[bot]

Hey @smartcontracts! This PR has merge conflicts. Please fix them before continuing review.

mergify[bot] avatar Sep 23 '22 17:09 mergify[bot]

Closing. Going to do this later.

smartcontracts avatar Sep 27 '22 17:09 smartcontracts