adobe / adobe/aio-lib-photoshop-api

Update dependencies with vulnerabilities

Open
#39 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
27
Forks
14
PR merge metrics
No merged PRs in 30d

Description

Hi there!

Thanks for the nice npm package to use the Photoshop API, it really made my current automisation task easier.

When working with the package I realized that it uses some outdated npm dependencies. Especially the `swagger-client` has already some newer versions available that fix vulnerabilities. It should be safe to at least update its version from `3.9.6` to the current version `3.19.10`. This would already fix a lot of reported vulnerabilities. Here is a part of the report:

```
# npm audit report

cross-fetch <=2.2.5 || 3.0.0 - 3.1.4 || 3.2.0-alpha.0 - 3.2.0-alpha.2
Severity: high
Incorrect Authorization in cross-fetch - https://github.com/advisories/GHSA-7gc6-qh9x-w6h8
Depends on vulnerable versions of node-fetch
No fix available
node_modules/swagger-client/node_modules/cross-fetch
swagger-client 3.0.1 - 3.11.1
Depends on vulnerable versions of cross-fetch
Depends on vulnerable versions of fast-json-patch
node_modules/swagger-client
@adobe/aio-lib-photoshop-api *
Depends on vulnerable versions of swagger-client
node_modules/@adobe/aio-lib-photoshop-api

fast-json-patch <3.1.1
Severity: high
Starcounter-Jack JSON-Patch Prototype Pollution vulnerability - https://github.com/advisories/GHSA-8gh8-hqwg-xf34
No fix available
node_modules/fast-json-patch

node-fetch <=2.6.6
Severity: high
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor - https://github.com/advisories/GHSA-r683-j2x4-v87g
The `size` option isn't honored after following a redirect in node-fetch - https://github.com/advisories/GHSA-w7rc-rwvf-8q5r
No fix available
node_modules/swagger-client/node_modules/node-fetch
```

Contributor guide

Open the contributing guide

Research direction

Start with the npm dependency manifest and lockfile, then run npm audit to reproduce the reported vulnerabilities. Update the declared swagger-client dependency from 3.9.6 toward 3.19.10, check compatibility with the package, and confirm the audit results and existing tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
api, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.