antvis / antvis/G2Plot

🐛 [BUG]G2PLot使用的组件存在安全漏洞

Open
#3,595 0 comments 0 reactions 0 assignees View on GitHub
Bug
Dominant language
TypeScript
Stars
2.7k
Forks
591
PR merge metrics
No merged PRs in 30d

Description

有些扫描工具可以扫描出一些安全漏洞,看组件库是否需要有调整,提供给你们分析处理。
漏洞编号:CVE-2021-3807|CNNVD-202109-1227|SZ-2021-33346
漏洞描述:Ansi-Regex是用于匹配ANSI 转义码的正则表达式。 ansi-regex 存在安全漏洞,该漏洞源于易受低效正则表达式复杂性的影响。
G2PLot使用位置:
g2plot@2.4.31->fmin@0.0.2->rollup@0.25.8->ansi-regex@2.1.1
g2plot@2.4.31->fmin@0.0.2->rollup@0.25.8->chalk@1.1.3->has-ansi@2.0.0->ansi-regex@2.1.1
g2plot@2.4.31->fmin@0.0.2->rollup@0.25.8->strip-ansi@3.0.1->ansi-regex@2.1.1
CVE-2021-3807(鼠标放到蓝色字上面会出现)提供了解决方案:使用ansi-regex@6.0.1及以上。
![image](https://github.com/antvis/G2Plot/assets/8774851/f09ea725-f00e-4a83-8cb2-a6ef8b124fe6)

Contributor guide

Open the contributing guide

Research direction

Start by tracing the reported G2Plot dependency paths through fmin, rollup, chalk, has-ansi, and strip-ansi to ansi-regex. Check the project’s dependency configuration and verify whether ansi-regex can be updated to 6.0.1 or later; done means the reported CVE is no longer present in the dependency scan.

Written by the indexing model from the issue text.

Assessment

Tech stack
rollup, typescript
Domain
build-system, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.