Skip to content

Conversation

@harr1424
Copy link
Contributor

@harr1424 harr1424 commented Oct 9, 2025

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-25525?atlOrigin=eyJpIjoiOTZlZWM3ODQyNjEwNDUzMzlmZTE5MTcxMGQ4ZmUwOTMiLCJwIjoiaiJ9

📔 Objective

The system service provider aggregates several services into a single injectable type. This type isn’t compatible with Angular injection, has objects like the extension registry that aren’t properly configurable, and introduces multiple instances of itself.

Revise the system service provider to fix these issues.

Move the LogProvider and SemanticLogger to @bitwarden/logging

Preserve the observable in BitwardenClient

Write a facade over ConfigService and PlatformUtilsService that consolidates environmental awareness.

Consider introducing a “capabilities” abstraction for this.

The extension system provides an example of how the APIs may evolve.

The algorithm metadata provides an example of how capabilities can be surfaced.

Replace the SystemServiceProvider type with something that better composes with DI.

Try and move all of libs/common/src/tools/log into @bitwarden/logging

📝 Important Notes

This PR is intended to simplify the process of reviewing a larger effort by extracting files that involved only logging changes into a dedicated PR.

Once the changes in this PR are completed, the original PR linked above will be used to review broader changes related to upgrading SystemServiceProvider to a new service focused on environmental awareness that works with Angular dependency injection.

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

• build will fail, some logging related changes were tightly coupled with new EnvService
• files involving new EnvService are not included in this PR
• files involving BOTH logging and EnvService are not included in this PR
@harr1424
Copy link
Contributor Author

harr1424 commented Oct 9, 2025

PR out of sync with branch and not reflecting most recent commit - closing to re-open

@harr1424 harr1424 closed this Oct 9, 2025
@sonarqubecloud
Copy link

sonarqubecloud bot commented Oct 9, 2025

@github-actions
Copy link
Contributor

github-actions bot commented Oct 9, 2025

Logo
Checkmarx One – Scan Summary & Detailse0af6df6-5250-404e-9c85-c9036add9ce6

New Issues (3)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
HIGH CVE-2025-10501 Npm-electron-38.2.0
detailsRecommended version: 38.2.1
Description: Use After Free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HT...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: 9kosKBk8sYUVqOfQDEOqlTAuEIFBXgNB8u6dHBou250%3D
Vulnerable Package
HIGH CVE-2025-10502 Npm-electron-38.2.0
detailsRecommended version: 38.2.1
Description: Heap Buffer Overflow in 'ANGLE' in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via malic...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: %2FdvGJCkK0oq3qSowqqHviCLo8kv4bGQhNd%2F3LGN7P9Q%3D
Vulnerable Package
HIGH CVE-2025-58754 Npm-axios-1.10.0
detailsRecommended version: 1.12.0
Description: Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to version 1.12.0 runs on Node.js and is given a URL with the "d...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: sRVAANAbrTYMqkRoSGVIGbC8CW%2BSprQf3iBWuXqM%2BMM%3D
Vulnerable Package

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants