search

surveyjs / custom-widgets

The collection of custom widgets for SurveyJS: Survey Library and Survey Creator :package:
https://surveyjs.io
MIT License
79 stars 77 forks source link

Critical vulnerability in one of the dependencies of surveyjs-widgets@1.8.79 #344

Closed MohanaKV closed 6 months ago

MohanaKV commented 7 months ago

Our application leverages Surveyjs-widgets 1.8.79 and we are using Snyk as vulnerability scanner. "Easy-autocomplete" one of the dependencies of surveyjs-widges and it has been flagged as a dependency with critical vulnerability. We require your expert guidance to determine the next steps and mitigate this risk effectively.

https://snyk.io/advisor/npm-package/easy-autocomplete

Thanks

tsv2013 commented 7 months ago

@MohanaKV Unfortunately easy-anutocomplete widget is not updating any more. The last version 1.3.5 was released about 8 years ago.

As a workaround we can recomend you don't use the easy-autocomplete custom widget. You can use our dropdown quesions type (https://surveyjs.io/form-library/examples/create-dropdown-menu-in-javascript/reactjs) or the dataList property of a single input question type (https://surveyjs.io/form-library/documentation/api-reference/text-entry-question-model#dataList) to activate browser auto-suggestion values list.

The custom-widgets are planned to be obsoleted as soon as we'll implement mask functionality for our questions. Another reason to absolete custom widgets approach of functionality extension is that custom widgets are using the onAfterRender hook to apply their functionality. But the onAfterRender upproach to patch DOM elements is not "native" in most of modern UI frameworks like React, Angular and Vue.