search

GSA / smartpay-training

Prototype for new GSA SmartPay training quizzes
8 stars 4 forks source link

Dependabot Alert: PostCSS line return parsing error #582

Open JennaySDavis opened 3 weeks ago

JennaySDavis commented 3 weeks ago

Severity - Moderate

An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.

This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.

JennaySDavis commented 3 weeks ago

On Feb 5, 2024, @john-labbate wrote on Ticket#401 (this ticket was converted to the Astro Upgrade) We cannot resolve the PostCSS Dependabot issues, linked below, because our systems rely on uswds-compile. We currently have the latest version(1.1.0) installed, which depends on the vulnerable version of PostCSS. The USWSDS package should be updated first, or we should move away from using it, but in the meantime, we will not be able to upgrade to a safe version.

In addition, Astro v2 depends on a vulnerable version of PostCSS. We would need to migrate to a newer version, requiring an overhaul since we are two full versions behind. We have spent about a week attempting this upgrade to Astro v4.

We do not currently have an accurate estimate of how long it will take to upgrade Astro as there are several unknowns around what is now preventing the upgraded version from working. Regardless, we will still need to resolve the dependency on USWDS-Compile before this vulnerability can be properly addressed.

On March 21, 2024, @CodyHinze wrote Proposed upgrading to Astro 4.x to correct this issue in addition to changing the base URL configuration to work on both Dev and Prod (cloud.gov).

john-labbate commented 3 weeks ago

The PostCSS version ^7.0.16 dependency is inherited from USWDS/Compile v1.1.0 => node_modules/gulp-sourcemaps v3.0.0 => @gulp-sourcemaps/identity-map": "^2.0.1 => "postcss": "^7.0.16". The latest version of USWDS/Compile and gulp-sourcemaps have not resolved this vulnerability within their codebases. As this is a dev-only, dependency that has not been deployed to production and its code is not under our control, we will not be resolving it at this time. If and when it is updated within USWDS/Compile codebase we will update the smartpay training solution to match.