OpenAPITools / OpenAPITools/openapi-generator

[BUG][Security][Javascript][Typescript] NPM high severity vulnerabilities while running UTs

Open
#4,868 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue: Bug
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

Bug Report Checklist
  • Have you provided a full/minimal spec to reproduce the issue?
  • Have you validated the input using an OpenAPI validator (example)?
  • What's the version of OpenAPI Generator used?
  • Have you search for related issues/PRs?
  • What's the actual output vs expected output?
  • [Optional] Bounty to sponsor the fix (example)
Description

As part of running the unit tests for #4672, I saw the following message in the UT logs, and I am opening this issue to track the security vulnerability.

found 33 high severity vulnerabilities
run npm audit fix to fix them, or npm audit for details

It looks like openapitools is using a version of npm that has high vulnerabilities.

openapi-generator version

It was master on December 2, 2019.

OpenAPI declaration file content or url

The problem is reproducible out-of-the-box with the OAS files that are included in the OpenAPITool repo. It is a build tool chain issue.

Command line used for generation
Steps to reproduce
Related issues/PRs
Suggest a fix

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the unit-test dependency audit using the OpenAPI Generator repository's included OAS files and inspect the output of npm audit. Trace the build tool chain and its JavaScript/TypeScript dependencies, then verify that the reported high-severity vulnerabilities are resolved without breaking the unit tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js, typescript
Domain
build-system, security, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.