garris / garris/BackstopJS

High Advisory On npm audit

Open
#1,219 6 comments 5 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
7.2k
Forks
621
PR merge metrics
No merged PRs in 30d

Description

### Details of Audit

On 17th August 2020, there was been a security issue that was raised with `url-regex`. Details are as follows:

```
High Regular Expression Denial of Service

Package url-regex

Patched in No patch available

Dependency of backstopjs [dev]

Path backstopjs > merge-img > jimp > url-regex

More info https://npmjs.com/advisories/1550
```

Unfortunately, backstopjs is last in the queue for updates as awaiting for the following to be completed:

https://github.com/oliver-moran/jimp/issues/926
https://github.com/preco21/merge-img/issues/15

## Replication Steps

Run npm audit
Notice the "high" severity vulnerability

Contributor guide

Open the contributing guide

Research direction

Run npm audit and inspect the dependency path backstopjs > merge-img > jimp > url-regex. Read npm advisory 1550 and the linked jimp issue 926 and merge-img issue 15 to determine whether upstream changes are available. Done means the high-severity url-regex advisory is no longer reported for backstopjs.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.