It has vulnerability #1

Questão nova

Ghost · 2018-05-17T03:45:19Z

Ghost comentou

2018-05-17 03:45:19 +00:00

npm audit

                       === npm audit security report ===

# Run  npm install testcafe@15.1.317522  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Out-of-bounds Read                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ atob                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ testcafe                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ testcafe > testcafe-hammerhead > css > source-map-resolve >  │
│               │ atob                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/646                       │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Out-of-bounds Read                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ atob                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.1.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ testcafe-hammerhead                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ testcafe-hammerhead > css > source-map-resolve > atob        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/646                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

[!] 2 vulnerabilities found - Packages audited: 3352 (55 dev, 0 optional)
    Severity: 2 Moderate

`npm audit` ``` === npm audit security report === # Run npm install testcafe@15.1.317522 to resolve 1 vulnerability SEMVER WARNING: Recommended action is a potentially breaking change ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ Moderate │ Out-of-bounds Read │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ atob │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ testcafe │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ testcafe > testcafe-hammerhead > css > source-map-resolve > │ │ │ atob │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/646 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ┌──────────────────────────────────────────────────────────────────────────────┐ │ Manual Review │ │ Some vulnerabilities require your attention to resolve │ │ │ │ Visit https://go.npm.me/audit-guide for additional guidance │ └──────────────────────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ Moderate │ Out-of-bounds Read │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ atob │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=2.1.0 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ testcafe-hammerhead │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ testcafe-hammerhead > css > source-map-resolve > atob │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://nodesecurity.io/advisories/646 │ └───────────────┴──────────────────────────────────────────────────────────────┘ [!] 2 vulnerabilities found - Packages audited: 3352 (55 dev, 0 optional) Severity: 2 Moderate ```

coolaj86 comentou

2018-05-17 08:16:22 +00:00

Proprietário(a)

Unless there's a vulnerability in node's Buffer itself, I don't see how I could be introducing a vulnerability:

"use strict";

function atob(str) {
  return Buffer.from(str, 'base64').toString('binary');
}

module.exports = atob.atob = atob;

And what's the recommendation? I suppose I could test that 'str' is a string and not ~~a number (not allowed anyway)~~ an array?

Unless there's a vulnerability in node's Buffer itself, I don't see how I could be introducing a vulnerability: ``` "use strict"; function atob(str) { return Buffer.from(str, 'base64').toString('binary'); } module.exports = atob.atob = atob; ``` And what's the recommendation? I suppose I could test that 'str' is a string and not ~~a number (not allowed anyway)~~ an array?

coolaj86 comentou

2018-05-17 08:20:49 +00:00

Proprietário(a)

Actually, the advisory you linked to (https://nodesecurity.io/advisories/646) says that there is no vulnerability in the current version.

All you have to do is update to v2.1.0

I believe that was to address a security issue with node's deprecated buffer constructor, not this module itself.

Thanks for the report. I'll go ahead and close this, but let me know if you think something else should be changed.

Actually, the advisory you linked to (https://nodesecurity.io/advisories/646) says that there is no vulnerability in the current version. All you have to do is update to v2.1.0 I believe that was to address a security issue with node's deprecated buffer constructor, not this module itself. Thanks for the report. I'll go ahead and close this, but let me know if you think something else should be changed.

coolaj86 encerrou esta questão

2018-05-17 08:20:49 +00:00

Ghost comentou

2018-05-17 09:08:40 +00:00

Autor(a)

Thank you for replying.

I updated by npm install atob@2.1.1.
The Issue was close but the Warning not resolved.

Thank you for replying. I updated by `npm install atob@2.1.1`. The Issue was close but the Warning not resolved.

coolaj86 comentou

2018-05-17 10:14:35 +00:00

Proprietário(a)

One of these modules is the one that has the older version:

testcafe > testcafe-hammerhead > css > source-map-resolve

It's probably source-map-resolve.

One of these modules is the one that has the older version: ``` testcafe > testcafe-hammerhead > css > source-map-resolve ``` It's probably `source-map-resolve`.

Inicie a sessão para participar neste diálogo.

2 Participantes

Notificações

Data de vencimento

Sem data de vencimento definida.

Dependências

Não estão definidas dependências.

Referência: coolaj86/atob.js#1