department-of-veterans-affairs / va.gov-team

Public resources for building on and in support of VA.gov. Visit complete Knowledge Hub:

https://depo-platform-documentation.scrollhelp.site/index.html

281 stars 197 forks source link

(HIGH) - semver-regex Regular Expression Denial of Service (ReDOS) #80584

Open pjhill opened 4 months ago

pjhill commented 4 months ago

Description

https://github.com/department-of-veterans-affairs/vets-website/security/dependabot/8

Acceptance Criteria

[ ] The denial of service issue with semver-regex has been resolved and dependabot is no longer flagging it

pjhill commented 4 months ago

The next available version of yo requires node v18 or greater. This is a bit of a sticky wicket.

pjhill commented 4 months ago

I had the idea to explicitly update semver-regex to the latest; however, that is not going to resolve the issue since walking backward through the dependencies reveals the following --

yo 4.3.1 --> yeoman-doctor ^5.0.0 --> bin-version-check ^4.0.0 --> bin-version ^3.0.0 --> find-versions ^3.0.0 --> semver-regex ^2.0.0

pjhill commented 4 months ago

Per a discussion with Curt, this was already on his radar. Curt's assessment is that the only way forward with this is to --

Either refactor yeoman out of the codebase
Fork latest yeoman and make it work with node 14

pjhill commented 4 months ago

Given this roadblock, we should probably upgrade the estimate from this from a 2 to something more like an 8.

JoeTice commented 4 months ago

For the moment, I'm adding the 'Blocked' label, and we can determine what we do next - which will either be exploring what Curt suggested, OR waiting for the roadblock to be cleared.