search

garris / BackstopJS

Catch CSS curve balls.
http://backstopjs.org
MIT License
6.66k stars 602 forks source link

Derived security vulnerability from `ip` package through `puppeteer` dependency #1542

Open AloisSeckar opened 4 months ago

AloisSeckar commented 4 months ago

Just noticed Dependabot's security alert in my project regarding SSRF vulnerability of ip 1.1.8. The dependency is being imported through puppeteer.

They already have issue in there, so I guess they will mitigate it sooner or later, although it looks the ip is currently not being developed. But once it is done, a new version of backstopjs will be required, so I am opening this to get attention.

Currently it is possible to shift back to version 6.2.2 which depends on older (and also unmaintained) version of pupetteer, but this is obviously not the ideal solution.

dgrebb commented 4 months ago

This can be manually fixed in package.json by overriding proxy-agent for now. When puppeteer does so in their dependencies, it will organically find its way into backstop.

For example:

  "pnpm": {
    "overrides": {
      "proxy-agent@<6.4.0": "^6.4.0"
    }
  }

Various audit utilities should pick up on the patch as well.

See overrides.

AloisSeckar commented 4 months ago

Thank you for quick solution