search

NJAldwin / eleventy-plugin-gen-favicons

Favicon generator plugin for eleventy
MIT License
15 stars 4 forks source link

known issue: high severity vulnerabilities tracing to `jpeg-js` #2

Closed changethe closed 1 year ago

changethe commented 2 years ago

first of all: thanks a lot for this plugin!

when installing it via npm, it gives a warning for 6 high severity vulnerabilities.

i'll probably use it anyway, but maybe it would be a good idea to fix them at some stage :)

NJAldwin commented 2 years ago

Thanks for the note! When I wrote this, there were no vulnerabilities, but it looks like jpeg-js (from png-to-ico) now has an infinite loop vulnerability.

This should not be unsafe for running this plugin, as the plugin is only active at build time, so it wouldn't cause a DoS on a website.

Regardless, I will look into fixing this shortly. Thanks again for raising it.

$ npm install --save-dev eleventy-plugin-gen-favicons                                                                                                                                                                                     [19:07:01]

added 118 packages, and audited 119 packages in 15s

9 packages are looking for funding
  run `npm fund` for details

6 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.

$ npm audit                                                                                                                                                                                                                               [19:07:28]
# npm audit report

jpeg-js  <0.4.4
Severity: high
Infinite loop in jpeg-js - https://github.com/advisories/GHSA-xvf7-4v9q-58w6
No fix available
node_modules/jpeg-js
  @jimp/jpeg  <=0.12.0 || >=0.16.1
  Depends on vulnerable versions of jpeg-js
  node_modules/@jimp/jpeg
    @jimp/types  <=0.11.1-canary.891.908.0 || >=0.16.1
    Depends on vulnerable versions of @jimp/jpeg
    node_modules/@jimp/types
      jimp  0.3.6-alpha.5 - 0.11.1-canary.891.908.0 || >=0.16.1
      Depends on vulnerable versions of @jimp/types
      node_modules/jimp
        png-to-ico  >=2.0.1
        Depends on vulnerable versions of jimp
        node_modules/png-to-ico
          eleventy-plugin-gen-favicons  *
          Depends on vulnerable versions of png-to-ico
          node_modules/eleventy-plugin-gen-favicons

6 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.
NJAldwin commented 2 years ago

There is a related issue in the png-to-ico project: https://github.com/steambap/png-to-ico/issues/19

and the related issue in jimp: https://github.com/oliver-moran/jimp/issues/1088

It sounds like the png-to-ico library has not been updated yet, so I can't simply bump the version.

However, as the author confirms there, only the png part of the library is used, so hopefully the library is not susceptible to this issue.

I will investigate whether I can manually force a different version of jpeg-js, or maybe at least swap out jimp-compact as described in the issue above. Ideally, this would be fixed by the jimp project updating to a newer version of jpeg-js. Not sure what the timeline is on that :( .

NJAldwin commented 1 year ago

png-to-ico has been updated. I will release a new version picking that up this week.

https://github.com/steambap/png-to-ico/pull/21

NJAldwin commented 1 year ago

I have released version 1.1.1 which now shows no vulnerabilities (commit c4c9572f9d7d46427d631682faac5c7d251bcdf9 ). Thanks again!