fix(16): fail closed on unparseable audit-waiver expiry date

2026-06-13 08:51:53 -04:00
parent 3e609b2550
commit bb1e97556d
2 changed files with 24 additions and 2 deletions
@@ -37,8 +37,13 @@ const BLOCKING_SEVERITIES = new Set(['high', 'critical']);
 export function isWaived(adv, allowlist) {
  const w = allowlist[adv.github_advisory_id];
  if (!w) return false;
-  // No expiry or future expiry → waived; past (or equal) expiry → NOT waived (re-blocks).
-  if (w.expires && Date.parse(w.expires) <= Date.now()) return false;
+  // No expiry → waived; future expiry → waived; past/equal expiry → NOT waived.
+  // An unparseable `expires` (typo) fails CLOSED: treated as expired so a malformed
+  // date can never grant an indefinite waiver (same failure class as CR-01).
+  if (w.expires) {
+    const ts = Date.parse(w.expires);
+    if (Number.isNaN(ts) || ts <= Date.now()) return false;
+  }
  return true;
 }