ProtonMail / WebClients

Monorepo hosting the proton web clients
GNU General Public License v3.0
4.5k stars 568 forks source link

Updated moment.js package.json version #108

Closed Streppel closed 6 years ago

Streppel commented 6 years ago

Short description of what this resolves:

Running dependency_spy on the project gave the following vulnerability:

    Vulnerable: moment/runtime:^2.19.0
        Title: Regular Expression Denial of Service (ReDoS)
        Severity: Low
        Source: https://snyk.io/vuln/npm:moment:20170905

So this updates the package json to the latest version available on npm.

The list spits out other vulnerabilities as well but some of them require major version upgrades, so I didn't touch them.

The full list follows:

npm: lockfile ~> package-lock.json
    Vulnerable: bootstrap/runtime:3.3.7
        Title: Cross Site Scripting (XSS) in data-target attribute
        Severity: Unknown
        Source: https://ossindex.net/resource/package/7012139565/vulnerabilities

        Title: Cross-Site Scripting (XSS)
        Severity: Medium
        Source: https://snyk.io/vuln/npm:bootstrap:20160627

    Vulnerable: braces/runtime:1.8.5
        Title: Regular Expression Denial of Service (ReDoS)
        Severity: Low
        Source: https://snyk.io/vuln/npm:braces:20180219

    Vulnerable: chownr/runtime:1.1.1
        Title: Time of Check Time of Use (TOCTOU)
        Severity: Medium
        Source: https://snyk.io/vuln/npm:chownr:20180731

    Vulnerable: emailjs-mime-parser/runtime:2.0.5
        Title: Denial of Service (DoS)
        Severity: High
        Source: https://snyk.io/vuln/npm:emailjs-mime-parser:20180625

npm: manifest ~> package.json
    Vulnerable: bootstrap/runtime:^3.3.7
        Title: Cross Site Scripting (XSS) in data-target attribute
        Severity: Unknown
        Source: https://ossindex.net/resource/package/7012139565/vulnerabilities

        Title: Cross-Site Scripting (XSS)
        Severity: Medium
        Source: https://snyk.io/vuln/npm:bootstrap:20160627

    Vulnerable: lodash/runtime:^4.17.4
        Title: Prototype Pollution
        Severity: Low
        Source: https://snyk.io/vuln/npm:lodash:20180130

    Vulnerable: webpack-dev-server/development:^3.1.3
        Title: Information Exposure
        Severity: Low
        Source: https://snyk.io/vuln/SNYK-JS-WEBPACKDEVSERVER-72405

Changes proposed in this pull request:

dhoko commented 6 years ago

Hey 👋

When you run npm install we already install the latest minor thx to this ^ ;)

Streppel commented 6 years ago

Oh, alright! I closed the PR :) thanks!