aquasecurity / aquasecurity/cloudsploit

Update mocha to v.10.2.0

Open
#1,552 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

`mocha` `5.1.0 - 9.2.1`
Depends on vulnerable versions of `yargs-unparser <=1.6.3`
which depends on vulnerable versions of `flat` `<5.0.1`
`flat` vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-2j2x-2gpw-g8fm

Upgrading `mocha` will also help upgrade `minimatch`
`minimatch <3.0.5` which has ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3

Contributor guide

Open the contributing guide

Research direction

Start by locating the project's mocha dependency and the associated dependency metadata. Update mocha to v10.2.0, then verify that the vulnerable yargs-unparser/flat and minimatch versions are no longer included and that the existing JavaScript tests still pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.