search

OpusCapita / filemanager

React based FileManager for browser ( + FS REST API for Node.js and Express)
https://demo.core.dev.opuscapita.com/filemanager/master/?currentComponentName=FileManager&maxContainerWidth=100%25&showSidebar=false
Apache License 2.0
566 stars 122 forks source link

Various vulnerabilities from low to high severity #283

Closed SurealCereal closed 3 years ago

SurealCereal commented 4 years ago

I am getting warnings from npm install via npm audit: Besides those, there are also deprecation warnings, like core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.

@opuscapita/filemanager-server: ^1.1.1 - 8 vulnerabilities (3 low, 1 moderate, 4 high) @opuscapita/react-filemanager: ^1.1.1 - 2 high severity vulnerabilities @opuscapita/react-filemanager-connector-node-v1 - 0 vulnerabilities

In the meantime I am using npm-force-resolutions to get around them:

  "resolutions": {
    "helmet-csp": "^2.10.0",
    "lodash": "^4.17.15",
    "minimist": "^1.2.5"
  },
GuyPaddock commented 4 years ago

We're using the following resolutions here:

  "resolutions": {
    "lodash": "^4.17.19",
    "node-fetch": "^2.6.1"
  },
furick1 commented 3 years ago

Within packages/client-react/package.json there is a reference to lodash 4.17.10. Please update to .11.

Vulnerable module: | lodash Introduced through: | @opuscapita/react-filemanager@1.1.4 › lodash@4.17.10 Fixed in: | 4.17.11 Vulnerable Function: lodash.hasUnicodeWord

Description: lodash is a modern JavaScript utility library delivering modularity, performance, & extras.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). It parses dates using regex strings, which may cause a slowdown of 2 seconds per 50k characters.

estambakio-sc commented 3 years ago

Lodash updated in #311, changes are released in 1.1.7. Other dependencies mentioned in first comment are not reported by dependabot as vulnerabilities, therefore these are not updated in scope of this issue.