You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cordova.apache.org by GitBox <gi...@apache.org> on 2020/03/30 15:52:24 UTC
[GitHub] [cordova-android] ThonyBG opened a new issue #935: Prototype
pollution in dot-prop
ThonyBG opened a new issue #935: Prototype pollution in dot-prop
URL: https://github.com/apache/cordova-android/issues/935
# Bug Report
I would like to report a parameter pollution in dot-prop
It allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation (DoS, access to sensitive data, RCE).
## Problem
cordova-android 8.1.0 has a dependency of compare-func that has an outdated dependency of dot-prop 3.0.0, this version of dot-prop was reported with a security issue "Prototype pollution"
### What is expected to happen?
Do not use libraries with security issues
### What does actually happen?
cordova-android is firing security issue in all scans such as Black Duck, snyk
## Information
Related issue reports:
https://hackerone.com/reports/719856
https://www.openhub.net/p/737898
https://snyk.io/test/npm/dot-prop/3.0.0
### Command or Code
### Environment, Platform, Device
### Version information
cordova-android 8-1-0
## Checklist
- [ x] I searched for existing GitHub issues
- [ x] I updated all Cordova tooling to most recent version
- [ x] I included all the necessary information above
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org
[GitHub] [cordova-android] ThonyBG commented on issue #935: Prototype
pollution in dot-prop
Posted by GitBox <gi...@apache.org>.
ThonyBG commented on issue #935: Prototype pollution in dot-prop
URL: https://github.com/apache/cordova-android/issues/935#issuecomment-606856092
> Yes, https://github.com/stevemao/compare-func/blob/master/package.json#L33 `compare-func` is using a flexible version, so as long as `dot-prop` has a fix inside `3.x.x` version, clearing out the node modules and reinstalling should address the security vulnerability.
>
> But I agree, we can probably just remove the `compare-func` dependency, doing this with the native `sort` method isn't all that difficult...
Remove node_modules is not a possibility to who has a security scan running as step into theirs ci/cd pipeline. Even when circleci is running in a docker, and it's installing all dependecies from scrach all security scanners detec this vulnerability
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org
[GitHub] [cordova-android] breautek commented on issue #935: Prototype
pollution in dot-prop
Posted by GitBox <gi...@apache.org>.
breautek commented on issue #935: Prototype pollution in dot-prop
URL: https://github.com/apache/cordova-android/issues/935#issuecomment-606092166
Yes, https://github.com/stevemao/compare-func/blob/master/package.json#L33 `compare-func` is using a flexible version, so as long as `dot-prop` has a fix inside `3.x.x` version, clearing out the node modules and reinstalling should address the security vulnerability.
But I agree, we can probably just remove the `compare-func` dependency, doing this with the native `sort` method isn't all that difficult...
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org
[GitHub] [cordova-android] breautek commented on issue #935: Prototype
pollution in dot-prop
Posted by GitBox <gi...@apache.org>.
breautek commented on issue #935: Prototype pollution in dot-prop
URL: https://github.com/apache/cordova-android/issues/935#issuecomment-606089321
Installing cordova-android does not yield any security vulnerabilities for me. In my experience this is caused by having a sub-dependency installed at some point, and they don't get updated, even if you reinstall `cordova-android`.
I'd try doing the following in your app:
```bash
rm package-lock.json
rm -r node_modules
npm install
```
This should cause all your dependencies to install using the latest satisfactory versions across your dependency tree.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org
[GitHub] [cordova-android] breautek closed issue #935: Prototype pollution
in dot-prop
Posted by GitBox <gi...@apache.org>.
breautek closed issue #935: Prototype pollution in dot-prop
URL: https://github.com/apache/cordova-android/issues/935
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org
[GitHub] [cordova-android] breautek edited a comment on issue #935:
Prototype pollution in dot-prop
Posted by GitBox <gi...@apache.org>.
breautek edited a comment on issue #935: Prototype pollution in dot-prop
URL: https://github.com/apache/cordova-android/issues/935#issuecomment-606089321
Installing cordova-android does not yield any security vulnerabilities for me (assuming they are reported to NPM?). In my experience this is caused by having a sub-dependency installed at some point, and they don't get updated, even if you reinstall `cordova-android`.
I'd try doing the following in your app:
```bash
rm package-lock.json
rm -r node_modules
npm install
```
This should cause all your dependencies to install using the latest satisfactory versions across your dependency tree.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org
[GitHub] [cordova-android] timbru31 commented on issue #935: Prototype
pollution in dot-prop
Posted by GitBox <gi...@apache.org>.
timbru31 commented on issue #935: Prototype pollution in dot-prop
URL: https://github.com/apache/cordova-android/issues/935#issuecomment-606089914
Snyk does report it though: https://snyk.io/test/npm/cordova-android/8.1.0
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org
[GitHub] [cordova-android] timbru31 commented on issue #935: Prototype
pollution in dot-prop
Posted by GitBox <gi...@apache.org>.
timbru31 commented on issue #935: Prototype pollution in dot-prop
URL: https://github.com/apache/cordova-android/issues/935#issuecomment-606088598
Thanks for the report.
I'd vote to replace the outdated, unmaintained compare-func dependency and rewrite the one and only usage:
https://github.com/apache/cordova-android/blob/de105e8651bcd8227bc2acdb91a21a14d2dc59c7/bin/templates/cordova/lib/builders/ProjectBuilder.js#L36-L48
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cordova.apache.org
For additional commands, e-mail: commits-help@cordova.apache.org