code4romania/covid-19-jurnal-medical

Update yargs-parser version

Open

#429 opened on May 22, 2020

View on GitHubContributor guide
 (1 comment) (0 reactions) (1 assignee)C# (50 forks)auto 404
apibughelp wanted

Repository metrics

Stars
 (14 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.

Parsing the argument --foo.proto.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.

A. frontend node-sass > sass-graph > yargs > yargs-parser B. frontend react-scripts > webpack-dev-server > yargs > yargs-parser

Contributor guide

Research direction
Update the yargs parser dependency to a patched version in the package.json files of the frontend subprojects (node sass and react scripts). The vulnerability is prototype pollution when parsing arguments. Ensure all occurrences are updated and test that the fix works.
Tech stack
nodejs
Domain
frontend
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Gitnpm
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
80