asyncapi / asyncapi/parser-js

[BUG] `@asyncapi/multi-parser` still depending on vulnerable version of `jsonpath-plus`

Open
#1,065 16 comments 7 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
144
Forks
144
Avg merge
6m
Merged PRs (30d)
11

Description

### Describe the bug.

There is a vulnerability in `jsonpath-plus` on versions earlier than `10.0.7`.
You already merged these two PRs (#1058, #1062), making the `@asyncapi/parser` package migrate to a safe version.
However, the `@asyncapi/multi-parser` package still depends on versions of `@asyncapi/multi-parser` (`parserapiv1` as well as `parserapiv2`) that use older versions of `jsonpath-plus` (`7.2.0`).

Would it be possible to release patches for `2.1.0` and `3.0.0-next-major-spec.8` of `@asyncapi/parser` that use the safe version of `jsonpath-plus` and then make `@asyncapi/multi-parser` use these versions?

### Expected behavior

`@asyncapi/multi-parser` should only rely on `jsonpath-plus@>10.0.7`

### Screenshots

Here the (relevant) output of `npm why jsonpath-plus` after running `npm install @asyncapi/multi-parser` on a blank npm package:

```
jsonpath-plus@7.2.0
node_modules/parserapiv1/node_modules/jsonpath-plus
jsonpath-plus@"^7.2.0" from parserapiv1@2.1.2
node_modules/parserapiv1
parserapiv1@"npm:@asyncapi/parser@^2.1.0" from @asyncapi/multi-parser@2.2.0
node_modules/@asyncapi/multi-parser
@asyncapi/multi-parser@"^2.2.0" from the root project

jsonpath-plus@7.2.0
node_modules/parserapiv2/node_modules/jsonpath-plus
jsonpath-plus@"^7.2.0" from parserapiv2@3.0.0-next-major-spec.8
node_modules/parserapiv2
parserapiv2@"npm:@asyncapi/parser@3.0.0-next-major-spec.8" from @asyncapi/multi-parser@2.2.0
node_modules/@asyncapi/multi-parser
@asyncapi/multi-parser@"^2.2.0" from the root project
```

### How to Reproduce

Install `@asyncapi/multi-parser` and find the versions of `jsonpath-plus` that got installed.

### 🥦 Browser

None

### 👀 Have you checked for similar open issues?

- [X] I checked and didn't find similar issue

### 🏢 Have you read the Contributing Guidelines?

- [X] I have read the [Contributing Guidelines](https://github.com/asyncapi/.github/blob/master/CONTRIBUTING.md)

### Are you willing to work on this issue ?

None

Contributor guide

Open the contributing guide

Research direction

Install @asyncapi/multi-parser in a blank package and run npm why jsonpath-plus to reproduce the vulnerable dependency tree. Inspect the parserapiv1 and parserapiv2 package dependencies and the @asyncapi/multi-parser version references; done means both paths resolve jsonpath-plus to a version above 10.0.7 and patched parser releases are used.

Written by the indexing model from the issue text.

Assessment

Tech stack
nodejs, typescript
Domain
security, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.