OfficeDev / OfficeDev/Excel-Custom-Functions

Module 'request' (used in test) is depreicated and has a vulnerability

Open
#391 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Needs: triage :mag:
Dominant language
TypeScript
Stars
333
Forks
69
Avg merge
3d 15h
Merged PRs (30d)
3

Description

Prerequisites

Please answer the following questions before submitting an issue.
YOU MAY DELETE THE PREREQUISITES SECTION.

  • I am running the latest version of Node and the tools
  • I checked the documentation and found no answer
  • I checked to make sure that this issue has not already been filed

Expected behavior

No vulnerabilities reported by npm install or npm audit

Current behavior

npm install or audit reports a vulnerablility with tough-cookie by way of the 'request' module used for testing. We should use a different module since 'requrest' is deperciated (and 4 years old). See https://github.com/request/request/issues/3143 for alternatives

Steps to Reproduce

run 'npm audit'

Context

  • Operating System: Win32
  • Node version: v18
  • Office version: n/a
  • Tool version: n/a

Failure Logs

npm audit report

axios 0.8.1 - 1.5.1
Severity: moderate
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
fix available via npm audit fix --force
Will install office-addin-debugging@4.3.9, which is a breaking change
node_modules/axios
@microsoft/teams-manifest <=0.1.2
Depends on vulnerable versions of axios
node_modules/@microsoft/teams-manifest
@microsoft/teamsfx-api <=0.22.6
Depends on vulnerable versions of @microsoft/teams-manifest
Depends on vulnerable versions of axios
node_modules/@microsoft/teamsfx-api
@microsoft/teamsfx-cli *
Depends on vulnerable versions of @microsoft/teamsfx-api
Depends on vulnerable versions of @microsoft/teamsfx-core
node_modules/@microsoft/teamsfx-cli
office-addin-dev-settings >=1.11.0
Depends on vulnerable versions of @microsoft/teamsfx-cli
node_modules/office-addin-dev-settings
office-addin-debugging >=4.3.10
Depends on vulnerable versions of office-addin-dev-settings
node_modules/office-addin-debugging
@microsoft/teamsfx-core <=2.0.6
Depends on vulnerable versions of @microsoft/teamsfx-api
Depends on vulnerable versions of axios
node_modules/@microsoft/teamsfx-core

request *
Severity: moderate
Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6
Depends on vulnerable versions of tough-cookie
No fix available
node_modules/request

tough-cookie <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
No fix available
node_modules/tough-cookie

9 moderate severity vulnerabilities

To address issues that do not require attention, run:
npm audit fix

To address all issues possible (including breaking changes), run:
npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Locate the package manifest and test setup that include the request module, then run npm install and npm audit to reproduce the reported vulnerability. Done means replacing the deprecated testing dependency and confirming that the request-related audit findings no longer appear.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, typescript
Domain
security, testing
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.