US-EPA-CAMD / easey-ui

Project Management repo for EPA Clean Air Markets Division (CAMD) Business Suite of applications
MIT License
0 stars 0 forks source link

Update the react-router-dom library to remove the polyfill.io term in the warning message (CAMPD 1.x) #6332

Open annalbrecht opened 4 months ago

annalbrecht commented 4 months ago

Recently, the Cloud.gov platform engineers scanned Cloud.gov to determine if any applications hosted in Cloud.gov were vulnerable to the polyfill.io attack (see https://fossa.com/blog/polyfill-supply-chain-attack-details-fixes/). The scan was performed by searching for the term "polyfill.io" in the application code deployed to platform. The ecmps-ui in the perf environment was flagged as having the vulnerability. After reviewing the finding and the code it appears that this term is used in a warning message produced by the react-router-dom library (see https://github.com/remix-run/react-router/issues/11733). Although the code is not vulnerable to this attack we should update the library to remove the reference to the polyfill.io website.

Need to update to at least version 6.24.1.

Testing should be done in the STAGING environment (https://campd-stg.app.cloud.gov/).

maxdiebold-erg commented 3 months ago

The easey-design-system has @storybook/router as a Dev dependency, which has react-router and react-router-dom as dependencies. As a dev dependency, however, it will not be bundled into easey-design-system builds, and so it will not be in easey-ecmps-ui or easey-campd-ui application code.

We may still want to update storybook in easey-design-system at a later time, but this involves two major versions so it will require more effort.

szintgraff commented 2 months ago

@maheese @ibarra-michelle @j-tafoya- From what I can tell, the best way to move forward here is to do the scan. Is there anything you would like to check before I move this to ready for deployment?