From 048f479fc30ebf481d9f85ef0d7c1e907dc3f3a8 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Mon, 13 Sep 2021 12:11:45 +0200 Subject: [PATCH 1/6] cli: ignore some more ReDos vulnerabilities Signed-off-by: Patrik Oldsberg --- packages/cli/.snyk | 48 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/packages/cli/.snyk b/packages/cli/.snyk index 8fbbfa574c..119cb19e7e 100644 --- a/packages/cli/.snyk +++ b/packages/cli/.snyk @@ -7,4 +7,52 @@ ignore: reason: Developer tools are not a valid target for ReDoS attacks expires: 2022-03-06T17:18:55.019Z created: 2021-09-06T17:18:55.027Z + + SNYK-JS-ANSIREGEX-1583908: + - '*': + reason: Developer tools are not a valid target for ReDoS attacks + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z + + SNYK-JS-CSSWHAT-1298035: + - '*': + reason: Developer tools are not a valid target for ReDoS attacks + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z + + SNYK-JS-BROWSERSLIST-1090194: + - '*': + reason: Developer tools are not a valid target for ReDoS attacks + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z + + SNYK-JS-ISSVG-1243891: + - '*': + reason: Developer tools are not a valid target for ReDoS attacks + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z + + SNYK-JS-ISSVG-1085627: + - '*': + reason: Developer tools are not a valid target for ReDoS attacks + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z + + SNYK-JS-POSTCSS-1255640: + - '*': + reason: Developer tools are not a valid target for ReDoS attacks + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z + + SNYK-JS-POSTCSS-1090595: + - '*': + reason: Developer tools are not a valid target for ReDoS attacks + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z + + SNYK-JS-WS-1296835: + - '*': + reason: Developer tools are not a valid target for ReDoS attacks + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z patch: {} From 299966d9bf97c731276266d87bcec03379f67151 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Mon, 13 Sep 2021 12:19:55 +0200 Subject: [PATCH 2/6] yarn.lock: bump y18n Signed-off-by: Patrik Oldsberg --- yarn.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/yarn.lock b/yarn.lock index 1d408ff5ae..0856a88020 100644 --- a/yarn.lock +++ b/yarn.lock @@ -27739,14 +27739,14 @@ y18n@^3.2.1: integrity sha512-uGZHXkHnhF0XeeAPgnKfPv1bgKAYyVvmNL1xlKsPYZPaIHxGti2hHqvOCQv71XMsLxu1QjergkqogUnms5D3YQ== y18n@^4.0.0: - version "4.0.0" - resolved "https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz#95ef94f85ecc81d007c264e190a120f0a3c8566b" - integrity sha512-r9S/ZyXu/Xu9q1tYlpsLIsa3EeLXXk0VwlxqTcFRfg9EhMW+17kbt9G0NrgCmhGb5vT2hyhJZLfDGx+7+5Uj/w== + version "4.0.3" + resolved "https://registry.npmjs.org/y18n/-/y18n-4.0.3.tgz#b5f259c82cd6e336921efd7bfd8bf560de9eeedf" + integrity sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ== y18n@^5.0.5: - version "5.0.5" - resolved "https://registry.npmjs.org/y18n/-/y18n-5.0.5.tgz#8769ec08d03b1ea2df2500acef561743bbb9ab18" - integrity sha512-hsRUr4FFrvhhRH12wOdfs38Gy7k2FFzB9qgN9v3aLykRq0dRcdcpz5C9FxdS2NuhOrI/628b/KSTJ3rwHysYSg== + version "5.0.8" + resolved "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz#7f4934d0f7ca8c56f95314939ddcd2dd91ce1d55" + integrity sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA== yallist@^2.1.2: version "2.1.2" From 8fda212c48eaced6d695b1092985834f545b69da Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Mon, 13 Sep 2021 12:20:10 +0200 Subject: [PATCH 3/6] cli: ignore some prototype pollution vulnerabilities Signed-off-by: Patrik Oldsberg --- packages/cli/.snyk | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/packages/cli/.snyk b/packages/cli/.snyk index 119cb19e7e..612b4b0525 100644 --- a/packages/cli/.snyk +++ b/packages/cli/.snyk @@ -55,4 +55,16 @@ ignore: reason: Developer tools are not a valid target for ReDoS attacks expires: 2022-03-06T17:18:55.019Z created: 2021-09-06T17:18:55.027Z + + SNYK-JS-IMMER-1540542: + - '*': + reason: Prototype pollution is not an effective attack against a CLI as it already executes arbitrary code + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z + + SNYK-JS-SETVALUE-1540541: + - '*': + reason: Prototype pollution is not an effective attack against a CLI as it already executes arbitrary code + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z patch: {} From 0db5cce1630d41cd091db9efba812706eb0090be Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Mon, 13 Sep 2021 12:38:11 +0200 Subject: [PATCH 4/6] yarn.lock: bump thenify Signed-off-by: Patrik Oldsberg --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 0856a88020..f7f8f57fc0 100644 --- a/yarn.lock +++ b/yarn.lock @@ -25750,9 +25750,9 @@ thenify-all@^1.0.0: thenify ">= 3.1.0 < 4" "thenify@>= 3.1.0 < 4": - version "3.3.0" - resolved "https://registry.npmjs.org/thenify/-/thenify-3.3.0.tgz#e69e38a1babe969b0108207978b9f62b88604839" - integrity sha1-5p44obq+lpsBCCB5eLn2K4hgSDk= + version "3.3.1" + resolved "https://registry.npmjs.org/thenify/-/thenify-3.3.1.tgz#8932e686a4066038a016dd9e2ca46add9838a95f" + integrity sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw== dependencies: any-promise "^1.0.0" From f848618987a4bd2ead210b757a92102a32230390 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Mon, 13 Sep 2021 12:51:09 +0200 Subject: [PATCH 5/6] test-utils: ignore some vulnerabilities Signed-off-by: Patrik Oldsberg --- packages/test-utils/.snyk | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 packages/test-utils/.snyk diff --git a/packages/test-utils/.snyk b/packages/test-utils/.snyk new file mode 100644 index 0000000000..7737037634 --- /dev/null +++ b/packages/test-utils/.snyk @@ -0,0 +1,17 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.22.1 +# ignores vulnerabilities until expiry date; change duration by modifying expiry date +ignore: + SNYK-JS-ANSIREGEX-1583908: + - '*': + reason: Self-inflicted ReDos in tests is not an issue + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z + + SNYK-JS-XMLDOM-1534562: + - 'msw@0.29.0 > @mswjs/interceptors@0.10.0 > xmldom@0.6.0': + reason: Self-inflicted XML injection attacks in tests is not an issue + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z + +patch: {} From a76040bc5c21466caa7d3e87c0d783869433a89f Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Mon, 13 Sep 2021 12:58:42 +0200 Subject: [PATCH 6/6] yarn.lock: bump strip-ansi and ansi-regex Signed-off-by: Patrik Oldsberg --- yarn.lock | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/yarn.lock b/yarn.lock index f7f8f57fc0..a050671f5c 100644 --- a/yarn.lock +++ b/yarn.lock @@ -8297,10 +8297,10 @@ ansi-regex@^5.0.0: resolved "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz#388539f55179bf39339c81af30a654d69f87cb75" integrity sha512-bY6fj56OUQ0hU1KjFNDQuJFezqKdrAyFdIevADiqrWHwSlbmBNMHp5ak2f40Pm8JTFyM2mqxkG6ngkHO11f/lg== -ansi-regex@^6.0.0: - version "6.0.0" - resolved "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.0.0.tgz#ecc7f5933cbe5ac7b33e209a5ff409ab1669c6b2" - integrity sha512-tAaOSrWCHF+1Ear1Z4wnJCXA9GGox4K6Ic85a5qalES2aeEwQGr7UC93mwef49536PkCYjzkp0zIxfFvexJ6zQ== +ansi-regex@^6.0.1: + version "6.0.1" + resolved "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.0.1.tgz#3183e38fae9a65d7cb5e53945cd5897d0260a06a" + integrity sha512-n5M855fKb2SsfMIiFFoVrABHJC8QtHwVx+mHWP3QcEqBHYienj5dHSgjbxtC0WEZXYt4wcD6zrQElDPhFuZgfA== ansi-styles@^2.2.1: version "2.2.1" @@ -25090,11 +25090,11 @@ strip-ansi@^4.0.0: ansi-regex "^3.0.0" strip-ansi@^7.0.0: - version "7.0.0" - resolved "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.0.0.tgz#1dc49b980c3a4100366617adac59327eefdefcb0" - integrity sha512-UhDTSnGF1dc0DRbUqr1aXwNoY3RgVkSWG8BrpnuFIxhP57IqbS7IRta2Gfiavds4yCxc5+fEAVVOgBZWnYkvzg== + version "7.0.1" + resolved "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.0.1.tgz#61740a08ce36b61e50e65653f07060d000975fb2" + integrity sha512-cXNxvT8dFNRVfhVME3JAe98mkXDYN2O1l7jmcwMnOslDeESg1rF/OZMtK0nRAhiari1unG5cD4jG3rapUAkLbw== dependencies: - ansi-regex "^6.0.0" + ansi-regex "^6.0.1" strip-bom@^2.0.0: version "2.0.0"