OpenAPITools / OpenAPITools/openapi-generator
[BUG][Security][Javascript][Typescript] NPM high severity vulnerabilities while running UTs
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 26.8k
- Forks
- 7.7k
- PR merge metrics
- PR metrics pending
Description
Bug Report Checklist
- Have you provided a full/minimal spec to reproduce the issue?
- Have you validated the input using an OpenAPI validator (example)?
- What's the version of OpenAPI Generator used?
- Have you search for related issues/PRs?
- What's the actual output vs expected output?
- [Optional] Bounty to sponsor the fix (example)
Description
As part of running the unit tests for #4672, I saw the following message in the UT logs, and I am opening this issue to track the security vulnerability.
found 33 high severity vulnerabilities
run npm audit fix to fix them, or npm audit for details
It looks like openapitools is using a version of npm that has high vulnerabilities.
openapi-generator version
It was master on December 2, 2019.
OpenAPI declaration file content or url
The problem is reproducible out-of-the-box with the OAS files that are included in the OpenAPITool repo. It is a build tool chain issue.
Command line used for generation
Steps to reproduce
Related issues/PRs
Suggest a fix
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the unit-test dependency audit using the OpenAPI Generator repository's included OAS files and inspect the output of npm audit. Trace the build tool chain and its JavaScript/TypeScript dependencies, then verify that the reported high-severity vulnerabilities are resolved without breaking the unit tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js, typescript
- Domain
- build-system, security, testing-qa
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100