🐛 [BUG]G2PLot使用的组件存在安全漏洞
- Dominant language
- TypeScript
- Stars
- 2.7k
- Forks
- 591
- PR merge metrics
- No merged PRs in 30d
Description
有些扫描工具可以扫描出一些安全漏洞,看组件库是否需要有调整,提供给你们分析处理。
漏洞编号:CVE-2021-3807|CNNVD-202109-1227|SZ-2021-33346
漏洞描述:Ansi-Regex是用于匹配ANSI 转义码的正则表达式。 ansi-regex 存在安全漏洞,该漏洞源于易受低效正则表达式复杂性的影响。
G2PLot使用位置:
g2plot@2.4.31->fmin@0.0.2->rollup@0.25.8->ansi-regex@2.1.1
g2plot@2.4.31->fmin@0.0.2->rollup@0.25.8->chalk@1.1.3->has-ansi@2.0.0->ansi-regex@2.1.1
g2plot@2.4.31->fmin@0.0.2->rollup@0.25.8->strip-ansi@3.0.1->ansi-regex@2.1.1
CVE-2021-3807(鼠标放到蓝色字上面会出现)提供了解决方案:使用ansi-regex@6.0.1及以上。

Contributor guide
Research direction
Start by tracing the reported G2Plot dependency paths through fmin, rollup, chalk, has-ansi, and strip-ansi to ansi-regex. Check the project’s dependency configuration and verify whether ansi-regex can be updated to 6.0.1 or later; done means the reported CVE is no longer present in the dependency scan.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rollup, typescript
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100