LinusU / LinusU/wext-shipit

Prototype Pollution introduced due to vulnerable minimist version

Open
#17 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
134
Forks
14
PR merge metrics
No merged PRs in 30d

Description

`npm audit` reports the following:

```

=== npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.2.1 <1.0.0 || >=1.2.3 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @wext/shipit [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @wext/shipit > web-ext > chrome-launcher > mkdirp > minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1179 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.2.1 <1.0.0 || >=1.2.3 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @wext/shipit [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @wext/shipit > web-ext > mkdirp > minimist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1179 │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 2 low severity vulnerabilities in 13241 scanned packages
2 vulnerabilities require manual review. See the full report for details.
```

This is caused by depending on an old version of web-ext. Unfortunately, a newer web-ext version is not yet released (but fixed in their master).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the npm audit report and trace the listed minimist paths through web-ext, chrome-launcher, mkdirp, and @wext/shipit. Check the current web-ext dependency and its upstream master fix; done means the dependency tree uses a patched minimist version and npm audit no longer reports these vulnerabilities.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.