Open erhathaway opened 4 years ago
I hear you. The build process is the worst on mobile out of our apps, and could do with an improved configuration and update procedure.
The issue I see is primarily one of effort - I don't have the time to perform regular maintenance for updates to React Native (the main culprit). The prototype pollution stuff will never fully disappear so I'd worry less about that. Not all vulnerabilities present in package reporting tools are relevant to the application itself. Agreed on the postinstall point, though this too is difficult to avoid as it requires very thorough grooming of packages that don't require postinstall scripts. Right now React-native needs several to be configured correctly.
The prototype pollution stuff will never fully disappear so I'd worry less about that.
This is a dangerous thing to say, it should disappear. Prototype pollution makes it so a bug in one package can spread to the whole codebase, so it's something I'd rather not see in a security/privacy focused app.
(how is it that in 2020 people still use lodash
is beyond my comprehension, and it's usually lodash
that's the problem)
I can provide a PR for this (and re-do it periodically after new RN drops if you don't have the time), but sadly I don't see any tests in this project, so making sure everything works may take some time. As for postinstall (or any scripts at all) when you can't disable them: I'd suggest auditing any that are there at the moment, pinning packages that have them and re-audit on each upgrade.
Describe the issue you're having
Multiple security issues exist
What OS version are you using
Irrelevant b/c I ran a security scanner on the dependencies. Not related to OS
What device are you using
Irrelevant b/c I ran a security scanner on the dependencies. Not related to device.
Findings:
Using snyk on the master branch exposed multiple security issues:
Suggested Actions
I highly suggest the team integrate security scanners into the CI / build pipeline. I was also unable to find the build pipeline. Post-install scripts are a common attack vector. These should also be disabled for all production builds.