FormidableLabs / FormidableLabs/spectacle
"Regular Expression Denial of Service in trim" alert generated by Dependabot about Spectacle repository
- Dominant language
- TypeScript
- Stars
- 10.2k
- Forks
- 700
- PR merge metrics
- No merged PRs in 30d
Description
### Prerequisites
- [x] I have searched the open [issues](https://www.github.com/FormidableLabs/spectacle/issues) to make sure I'm not opening a duplicate issue
- [x] I have read through the [docs](https://www.formidable.com/open-source/spectacle/docs) before asking a question
- [x] I am using the latest version of Spectacle
### Describe Your Environment
**What version of Spectacle are you using?** (can be found by running `npm list --depth 0 spectacle`)
10.1.4
**What version of React are you using?** (can be found by running `npm list --depth 0 react`)
18.2.0
**What browser are you using?** (e.g., Chrome 105.0.5195.102, Safari 16.0)
Safari Version 16.4 (18615.1.26.11.23)
**What platform are you on?** (e.g., Windows, macOS, iOS, Android)
macOS
### Describe the Problem
1. Install Spectacle by running `npm add spectacle`.
2. Push code to GitHub.
3. Enable GitHub [Dependabot alerts](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/configuring-dependabot-alerts).
**Expected behavior:** [What you expect to happen]
I expect Dependabot to generate zero security alerts.
**Actual behavior:** [What actually happens]
Dependabot generates alert regarding Regular Expression Denial of Service in trim. The advisory is detailed here: https://github.com/advisories/GHSA-w5p7-h5w8-2hfq
### Additional Information
Seems like [version 8.0.3](https://github.com/remarkjs/remark/blob/remark-parse%408.0.3/packages/remark-parse/package.json) of `remark-parse` is the package that depends on the vulnerable 0.0.1 version of `trim`. Starting from [version 9.0.0](https://github.com/remarkjs/remark/blob/remark-parse%409.0.0/packages/remark-parse/package.json), `remark-parse` does not seem to depend on `trim` anymore.
Therefore the issue may be resolved by updating `remark-parse`. I can help to work on this.
Contributor guide
Assessment
This issue has not been assessed yet.