FormidableLabs / FormidableLabs/spectacle

"Regular Expression Denial of Service in trim" alert generated by Dependabot about Spectacle repository

Open
#1,281 1 comment 0 reactions 0 assignees View on GitHub
🤖 Dependencies
Dominant language
TypeScript
Stars
10.2k
Forks
700
PR merge metrics
No merged PRs in 30d

Description

### Prerequisites

- [x] I have searched the open [issues](https://www.github.com/FormidableLabs/spectacle/issues) to make sure I'm not opening a duplicate issue
- [x] I have read through the [docs](https://www.formidable.com/open-source/spectacle/docs) before asking a question
- [x] I am using the latest version of Spectacle

### Describe Your Environment

**What version of Spectacle are you using?** (can be found by running `npm list --depth 0 spectacle`)

10.1.4

**What version of React are you using?** (can be found by running `npm list --depth 0 react`)

18.2.0

**What browser are you using?** (e.g., Chrome 105.0.5195.102, Safari 16.0)

Safari Version 16.4 (18615.1.26.11.23)

**What platform are you on?** (e.g., Windows, macOS, iOS, Android)

macOS

### Describe the Problem

1. Install Spectacle by running `npm add spectacle`.
2. Push code to GitHub.
3. Enable GitHub [Dependabot alerts](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/configuring-dependabot-alerts).

**Expected behavior:** [What you expect to happen]

I expect Dependabot to generate zero security alerts.

**Actual behavior:** [What actually happens]

Dependabot generates alert regarding Regular Expression Denial of Service in trim. The advisory is detailed here: https://github.com/advisories/GHSA-w5p7-h5w8-2hfq

### Additional Information

Seems like [version 8.0.3](https://github.com/remarkjs/remark/blob/remark-parse%408.0.3/packages/remark-parse/package.json) of `remark-parse` is the package that depends on the vulnerable 0.0.1 version of `trim`. Starting from [version 9.0.0](https://github.com/remarkjs/remark/blob/remark-parse%409.0.0/packages/remark-parse/package.json), `remark-parse` does not seem to depend on `trim` anymore.

Therefore the issue may be resolved by updating `remark-parse`. I can help to work on this.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.