chore: opensheetmusicdisplay / osmd-audio-player の依存パッケージにセキュリティ脆弱性 (tar, jszip)
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- javascript
- Domain
- security
Research direction
Start by running yarn audit and tracing the reported tar and jszip paths through opensheetmusicdisplay and osmd-audio-player. Investigate the upstream opensheetmusicdisplay dependency, then assess the proposed fork, build, and publication path; done means this repository uses updated packages meeting tar >=7.5.7 and jszip >=3.8.0.
Written by the indexing model from the issue text.
Description
概要
opensheetmusicdisplay および osmd-audio-player の依存パッケージに脆弱性のあるバージョンが含まれている。
yarn audit で 35 件の脆弱性が検出されている（High: 26, Moderate: 9）。
脆弱なパッケージ
tar (High)
- パス:
opensheetmusicdisplay > gl > node-gyp > tar,opensheetmusicdisplay > gl > node-gyp > make-fetch-happen > cacache > tar - 脆弱性: Arbitrary File Creation/Overwrite via Hardlink Path Traversal, Symlink Poisoning via Insufficient Path Sanitization
- 修正バージョン:
>=7.5.7
jszip (Moderate)
- パス:
opensheetmusicdisplay > jszip,osmd-audio-player > opensheetmusicdisplay > jszip - 脆弱性: Path Traversal via
loadAsync - 修正バージョン:
>=3.8.0
対応方針
本リポジトリ側では直接修正できない（上流パッケージの transitive dependency）。
時間があるときに以下を検討する:
opensheetmusicdisplay本家をフォークして依存パッケージを更新- 更新済みパッケージとしてビルド・公開
- 本リポジトリの依存を更新済みフォーク版に差し替え
備考
tarの脆弱性はgl(OpenGL binding) 経由のnode-gyp由来で、ブラウザ向けビルドではランタイムリスクは低いjszipはブラウザでも使われるためパストラバーサルのリスクがある
- Dominant language
- Vue
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Similar issues
-
area/auth bug comp/agent P3 platform/discord type/security
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
NousResearch/hermes-agent#117848 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
getgrav/grav-plugin-api#45 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sisaku-security/sisakulint#647 ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
yunaremaia/driftcheck#246 ·
-
bug good-first-issue
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
yunaremaia/taintrace#110 ·