MMT-3831: MMT React Vulnerabilities July 2024

[tle1989]

Overview

What is the feature?

MMT React Vulnerabilities Reported by Snyk (high & fixable) on July 18, 2024 CWE-1333: fast-xml-parser CWE-1333: micromatch

https://app.snyk.io/org/esdis-cumulus-core-gibs-cmr-etc./project/74c1d039-9245-4c53-8786-e8cd1c1713d0

What is the Solution?

Update fast-xml-parser to 4.2.5 Update micromatch to 4.0.6

By adding to package.json

"overrides": { "fast-xml-parser": "4.4.1", "micromatch": "^4.0.4" }

Then run $npm install

Will fix these 2 vulnerabilities on this branch MMT-3831

What areas of the application does this impact?

Affect versions of fast-xml-parser, and micromatch packages are vulnerable to Regular Expression Denial of Service (ReDoS)

Testing

Reproduction steps

• Environment for testing: React local Env
• Collection to test with:

BEFORE THE FIX On branch MMT-3390 Run npm audit

Note that dicer, request, tough-cookie vulnerabilities currently have no fix available

No fix available for this one GHSA-977x-g7h5-7qgw

AFTER THE FIX Pull branch MMT-3831 Run npm audit

We currently still have No fix available for dicer, request, tough-cookie vulnerabilities, but ast-xml-parser, micromatch to 4.0.6 are being fixed according to the AC of the ticket

AFTER THE FIX Pull branch MMT-3831 Run npm audit

We currently still have No fix available for dicer, request, tough-cookie vulnerabilities, but ast-xml-parser, micromatch to 4.0.6 are being fixed according to the AC of the ticket

AFTER THE FIX Pull branch MMT-3831 Run npm audit

Checklist

• [ ] I have added automated tests that prove my fix is effective or that my feature works
• [ ] New and existing unit tests pass locally with my changes
• [ ] I have performed a self-review of my own code
• [ ] I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [ ] My changes generate no new warnings

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 97.72%. Comparing base (925bba2) to head (e13ea78). Report is 2 commits behind head on MMT-3390.

Additional details and impacted files

```diff @@ Coverage Diff @@ ## MMT-3390 #1278 +/- ## ========================================= Coverage 97.72% 97.72% ========================================= Files 359 359 Lines 5404 5416 +12 Branches 1114 1133 +19 ========================================= + Hits 5281 5293 +12 Misses 122 122 Partials 1 1 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.