search

Crunch-io / nightwatch-vrt

Visual Regression Testing tools for nightwatch.js
MIT License
64 stars 20 forks source link

Regular Expression Denial of Service - url-regex vulnerability #37

Open justinlazaro-iselect opened 4 years ago

justinlazaro-iselect commented 4 years ago

Hi got issue in Regular Expression Denial of Service - url-regex vulnerability, any action on this? thanks

Hopefully someone can update in this

https://github.com/oliver-moran/jimp/issues/926

humphreyn commented 3 years ago

The url-regex vulnerability in question (see details here : https://www.npmjs.com/advisories/1550 ) stems from the package "url-regex" which is a dependency of jimp v0.2.28 and lower.

Later versions of jimp no longer have that dependency, thus fixing it should only need upgrading jimp to the latest version unless there is some deprecated functionality required by nightwatch-vrt.

As @justinlazaro-iselect has requested could someone look into this? It has become a major issue for us since the release of npm v6.* which now runs an npm audit on npm install, as npm audit will return a non zero exit code for any vulnerability. Non zero exit codes can and does break our CI pipeline. We could configure npm audit to ignore vulnerabilities but this is a HIGH vulnerability and thus really needs to be fixed.