search

squidfunk / karma-viewport

A Karma plugin for testing responsive features and layout
MIT License
49 stars 14 forks source link

Log4js Vulnerability #659

Closed shirblc closed 2 years ago

shirblc commented 2 years ago

Description

Looks like the current version of karma-viewport depends on a vulnerable version of log4js. It also seems that karma-viewport depends on quite a few outdated packages. I know this isn’t production dependency so it’s probably not critical, but it would be really great to have updated sub-dependencies & dependencies… Is there any chance they (or at least log4js) can be upgraded, @squidfunk?

Expected behavior

To have non-vulnerable dependencies.

Actual behavior

There’s a vulnerable version of log4js.

Steps to reproduce the bug

  1. Install karma-viewport in a project. You’ll see the npm audit alert.

Package versions

System information

squidfunk commented 2 years ago

Thanks for reporting. I'm low on time, but I'm happy to collaborate on a PR if you want to help out. I can issue a new release after we upgraded the dependencies and fixed the vulnerabilities.

Edit: note that we need to make sure that the tests pass – they're currently commented out due to issues with Sauce Labs. Unit and integration tests should pass:

https://github.com/squidfunk/karma-viewport/blob/deb1a5f7aea7573513fc00b070132cf52d2650a8/package.json#L39-L40

shirblc commented 2 years ago

Yeah, sure, happy to help. I'll look at it now and hopefully PR later today.

Good to know about tests (was wondering about why they're commented out). I'll make sure the tests pass and I'll see if I can get it working without Sauce Labs (if that's okay). Was there a reason for choosing Sauce Labs? Not familiar with them so I don't know if there's an advantage to them or something special that they can do... Just wondering

squidfunk commented 2 years ago

Was there a reason for choosing Sauce Labs? Not familiar with them so I don't know if there's an advantage to them or something special that they can do... Just wondering

The reason to use SauceLabs (or BrowserStack) was to test on browsers that can't be run in headless mode like Internet Explorer 11, which karma-viewport actually supports. All browsers that are supported were listed in this configuration file. Since IE is history now, I'd say it's okay to replace SauceLabs with the headless strategy you implemented in #660.