Upgrade to `firebase^9.0.2` in ./bots (#32218)

Summary:
Addresses the following couple security vulnerabilities.

- https://github.com/advisories/GHSA-9r2w-394v-53qc
- https://github.com/advisories/GHSA-qq89-hq3f-393p

Newer versions of the `firebase` dependency no longer depends on `tar`.

[Internal]

Pull Request resolved: https://github.com/facebook/react-native/pull/32218

Test Plan: See bots run on this pull request.

Reviewed By: sammy-SC

Differential Revision: D30969643

Pulled By: yungsters

fbshipit-source-id: 85c886ead7d8563dcaaef537f34bda57c7dc23a5

bots/datastore.js

@@ -9,12 +9,13 @@
 
 'use strict';
 
-const firebase = require('firebase/app');
-require('firebase/auth');
-require('firebase/firestore');
+const {initializeApp} = require('firebase/app');
+const {getAuth, signInWithEmailAndPassword} = require('firebase/auth');
+const firestore = require('firebase/firestore');
 
 /**
  * Initializes store, and optionally authenticates current user.
+ *
  * @param {string?} email
  * @param {string?} password
  * @returns {Promise<firebase.firestore.Firestore>} Reference to store instance
@@ -28,7 +29,7 @@ async function initializeStore(email, password) {
     'oFpeVe3g',
     'LceuC0Q',
   ].join('');
-  const app = firebase.initializeApp({
+  const firebaseApp = initializeApp({
     apiKey,
     authDomain: `${PROJECT_ID}.firebaseapp.com`,
     databaseURL: `https://${PROJECT_ID}.firebaseio.com`,
@@ -40,61 +41,70 @@ async function initializeStore(email, password) {
   });
 
   if (email && password) {
-    await app
-      .auth()
-      .signInWithEmailAndPassword(email, password)
-      .catch(error => console.log(error));
+    await signInWithEmailAndPassword(
+      getAuth(firebaseApp),
+      email,
+      password,
+    ).catch(error => console.log(error));
   }
 
-  return app.firestore();
+  return firestore.getFirestore(firebaseApp);
 }
 
 /**
  * Initializes 'binary-sizes' collection using the initial commit's data.
- * @param {firebase.firestore.Firestore} firestore Reference to store instance
+ *
+ * @param {firebase.firestore.Firestore} db Reference to store instance
  */
-function initializeBinarySizesCollection(firestore) {
-  return getBinarySizesCollection(firestore)
-    .doc('a15603d8f1ecdd673d80be318293cee53eb4475d')
-    .set({
-      'android-hermes-arm64-v8a': 0,
-      'android-hermes-armeabi-v7a': 0,
-      'android-hermes-x86': 0,
-      'android-hermes-x86_64': 0,
-      'android-jsc-arm64-v8a': 0,
-      'android-jsc-armeabi-v7a': 0,
-      'android-jsc-x86': 0,
-      'android-jsc-x86_64': 0,
-      'ios-universal': 0,
-      timestamp: new Date('Thu Jan 29 17:10:49 2015 -0800'),
-    });
+function initializeBinarySizesCollection(db) {
+  const collectionRef = getBinarySizesCollection(db);
+  const docRef = firestore.doc(
+    collectionRef,
+    'a15603d8f1ecdd673d80be318293cee53eb4475d',
+  );
+  firestore.setDoc(docRef, {
+    'android-hermes-arm64-v8a': 0,
+    'android-hermes-armeabi-v7a': 0,
+    'android-hermes-x86': 0,
+    'android-hermes-x86_64': 0,
+    'android-jsc-arm64-v8a': 0,
+    'android-jsc-armeabi-v7a': 0,
+    'android-jsc-x86': 0,
+    'android-jsc-x86_64': 0,
+    'ios-universal': 0,
+    timestamp: new Date('Thu Jan 29 17:10:49 2015 -0800'),
+  });
 }
 
 /**
  * Returns 'binary-sizes' collection.
- * @param {firebase.firestore.Firestore} firestore Reference to store instance
+ *
+ * @param {firebase.firestore.Firestore} db Reference to store instance
  */
-function getBinarySizesCollection(firestore) {
+function getBinarySizesCollection(db) {
   const BINARY_SIZES_COLLECTION = 'binary-sizes';
-  return firestore.collection(BINARY_SIZES_COLLECTION);
+  return firestore.collection(db, BINARY_SIZES_COLLECTION);
 }
 
 /**
  * Creates or updates the specified entry.
+ *
  * @param {firebase.firestore.CollectionReference<firebase.firestore.DocumentData>} collection
  * @param {string} sha The Git SHA used to identify the entry
  * @param {firebase.firestore.UpdateData} data The data to be inserted/updated
  * @returns {Promise<void>}
  */
-function createOrUpdateDocument(collection, sha, data) {
+function createOrUpdateDocument(collectionRef, sha, data) {
   const stampedData = {
     ...data,
-    timestamp: firebase.firestore.Timestamp.now(),
+    timestamp: firestore.Timestamp.now(),
   };
-  const docRef = collection.doc(sha);
-  return docRef.update(stampedData).catch(async error => {
+  const docRef = firestore.doc(collectionRef, sha);
+  return firestore.updateDoc(docRef, stampedData).catch(async error => {
     if (error.code === 'not-found') {
-      await docRef.set(stampedData).catch(setError => console.log(setError));
+      await firestore
+        .setDoc(docRef, stampedData)
+        .catch(setError => console.log(setError));
     } else {
       console.log(error);
     }
@@ -103,29 +113,44 @@ function createOrUpdateDocument(collection, sha, data) {
 
 /**
  * Returns the latest document in collection.
+ *
  * @param {firebase.firestore.CollectionReference<firebase.firestore.DocumentData>} collection
  * @returns {Promise<firebase.firestore.DocumentData | undefined>}
  */
-function getLatestDocument(collection) {
-  return collection
-    .orderBy('timestamp', 'desc')
-    .limit(1)
-    .get()
-    .then(snapshot => {
-      if (snapshot.empty) {
-        return undefined;
-      }
-
-      const doc = snapshot.docs[0];
-      return {
-        ...doc.data(),
-        commit: doc.id,
-      };
-    })
-    .catch(error => {
-      console.log(error);
+async function getLatestDocument(collectionRef) {
+  try {
+    const querySnapshot = await firestore.getDocs(
+      firestore.query(
+        collectionRef,
+        firestore.orderBy('timestamp', 'desc'),
+        firestore.limit(1),
+      ),
+    );
+    if (querySnapshot.empty) {
       return undefined;
-    });
+    }
+
+    const doc = querySnapshot.docs[0];
+    return {
+      ...doc.data(),
+      commit: doc.id,
+    };
+  } catch (error) {
+    console.log(error);
+    return undefined;
+  }
+}
+
+/**
+ * Terminates the supplied store.
+ *
+ * Documentation says that we don't need to call `terminate()` but the script
+ * will just hang around until the connection times out if we don't.
+ *
+ * @param {Promise<firebase.firestore.Firestore>} db
+ */
+async function terminateStore(db) {
+  await firestore.terminate(db);
 }
 
 /**
@@ -136,10 +161,8 @@ function getLatestDocument(collection) {
  *     const binarySizes = datastore.getBinarySizesCollection(store);
  *     console.log(await getLatestDocument(binarySizes));
  *     console.log(await createOrUpdateDocument(binarySizes, 'some-id', {data: 0}));
+ *     terminateStore(store);
  *
- *     // Documentation says that we don't need to call `terminate()` but the script
- *     // will just hang around until the connection times out if we don't.
- *     firestore.terminate();
  */
 module.exports = {
   initializeStore,
@@ -147,4 +170,5 @@ module.exports = {
   getBinarySizesCollection,
   createOrUpdateDocument,
   getLatestDocument,
+  terminateStore,
 };

bots/package.json

@@ -10,6 +10,6 @@
   },
   "dependencies": {
     "@octokit/rest": "^16.43.0",
-    "firebase": "^7.10.0"
+    "firebase": "^9.0.2"
   }
 }

bots/report-bundle-size.js

@@ -112,9 +112,7 @@ async function reportSizeStats(stats, replacePattern) {
     createOrUpdateComment(comment, replacePattern);
   }
 
-  // Documentation says that we don't need to call `terminate()` but the script
-  // will just hang around until the connection times out if we don't.
-  store.terminate();
+  await datastore.terminateStore(store);
 }
 
 /**
@@ -146,10 +144,10 @@ function android_getApkSize(engine, arch) {
  * Reports app bundle size.
  * @param {string} target
  */
-function report(target) {
+async function report(target) {
   switch (target) {
     case 'android':
-      reportSizeStats(
+      await reportSizeStats(
         {
           'android-hermes-arm64-v8a': android_getApkSize('hermes', 'arm64-v8a'),
           'android-hermes-armeabi-v7a': android_getApkSize(
@@ -168,7 +166,7 @@ function report(target) {
       break;
 
     case 'ios':
-      reportSizeStats(
+      await reportSizeStats(
         {
           'ios-universal': getFileSize(
             'packages/rn-tester/build/Build/Products/Release-iphonesimulator/RNTester.app/RNTester',
@@ -181,10 +179,14 @@ function report(target) {
     default: {
       const path = require('path');
       console.log(`Syntax: ${path.basename(process.argv[1])} [android | ios]`);
+      process.exitCode = 2;
       break;
     }
   }
 }
 
 const {[2]: target} = process.argv;
-report(target);
+report(target).catch(error => {
+  console.error(error);
+  process.exitCode = 1;
+});

scripts/circleci/report-bundle-size.sh

@@ -11,7 +11,7 @@ case $1 in
     GITHUB_PR_NUMBER="${CIRCLE_PR_NUMBER:-${CIRCLE_PULL_REQUEST##*/}}" \
     GITHUB_REF=${CIRCLE_BRANCH} \
     GITHUB_SHA=${CIRCLE_SHA1} \
-    node bots/report-bundle-size.js "$1"
+    exec node bots/report-bundle-size.js "$1"
     ;;
   *)
     echo "Syntax: $0 [android | ios]"