Angular-cli: Cross-Site Scripting dependency of serialize-javascript

[nyc-cr2]

🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑

Hi all,

Looks like there's an npm audit issue dependant on serialize-javascript. Currently the dependency is set to v 1.9.1, seems to be resolved in >=2.1.1

Any eta on if we can update the dependency?

RE: https://npmjs.com/advisories/1426

Moderate Cross-Site Scripting
Package serialize-javascript
Patched in >=2.1.1
Dependency of @angular-devkit/build-angular [dev]
Path @angular-devkit/build-angular > copy-webpack-plugin > serialize-javascript

More info https://npmjs.com/advisories/1426

Please read https://angular.io/guide/security#report-issues on how to disclose security related issues.

🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑🛑

[Nikhilkapoor20]

any update on this ?

[alan-agius4]

There is a PR to address this already https://github.com/angular/angular-cli/issues/16414

[belyan]

This issue is blocking our development. Needs fix ASAP.

[clydin]

Please also note that the security vulnerability specifically mentions that it does not affect Node.js applications.

[theodorejb]

@alan-agius4 It looks like the actual PR that addresses this is #16404.

[Sneh1999]

one fix is that you add it to your resolutions in package.json

 "resolutions": {
    "serialize-javascript": "^2.1.1"
  }

and then possibly:

rm -r node_modules
npx npm-force-resolutions
npm install

worked for me

[mariana-btg]

one fix is that you add it to your resolutions in package.json

 "resolutions": {
    "serialize-javascript": "^2.1.1"
  }

and then possibly:

rm -r node_modules
npx npm-force-resolutions
npm install

worked for me

Tested and working! Thank you

[jonathanengelbert]

one fix is that you add it to your resolutions in package.json

 "resolutions": {
    "serialize-javascript": "^2.1.1"
  }

and then possibly:

rm -r node_modules
npx npm-force-resolutions
npm install

worked for me

+1

[Nikhilkapoor20]

any update on this ? apart from mentioned patch

[clydin]

Please be aware that the Angular CLI is a Node.js application and the vulnerability specifies that it does not affect Node.js applications.

See the full GitHub advisory here: https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx

However, a patch release for 8.3 is forthcoming which will resolve npm's warnings.

[mjxsxp]

one fix is that you add it to your resolutions in package.json

 "resolutions": {
    "serialize-javascript": "^2.1.1"
  }

and then possibly:

rm -r node_modules
npx npm-force-resolutions
npm install

worked for me

Thanks!

[marieAugade]

Hi, I'm having the same issue. the trick "npx-force-resolutions" worked in local for me. But it's not working when building it on Git Lab for example.

Do you have more information please ?

[leonlehmann]

Adding resolutions doesn’t work for me either. Any other tricks or just wait until this issue is resolved?

[masseSnus]

adding
"resolutions": {
"serialize-javascript": "^2.1.1"
}
fixed this problem locally. However, it fails in Gitlab pipeline where it introduces the same problem again.
Any other tricks on this one?

[wburgers]

@marieAugade, @leonlehmann and @masseSnus
The resolutions block is not picked up by npm natively, but is something that works in yarn only.
npm install --save npm-force-resolutions installs a package that will make npm work with the resolutions block.

executing npx npm-force-resolutions and npm install in your terminal will fix the package-lock.json to resolve to the correct package.
But you need to do that every time.
In order for your CI build to get fixed, also add npx npm-force-resolutions to the scripts block in the preinstall step.

"scripts": {
    "preinstall": "npx npm-force-resolutions"
}

npm will execute it every time you run npm install

Hope this helps

[marieAugade]

@wburgers I'll try this, thank you very much

[Sampath-Lokuge]

@wburgers Thanks and it works for me.

[henrahmagix]

@angular-devkit/build-angular v8.3.21 has been released. npm audit fix now automatically fixes this vulnerability 🎉

[clydin]

Version 8.3.21 will no longer show the npm warning. Please also note that the Angular CLI was not affected by this vulnerability.

[angular-automatic-lock-bot[bot]]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{_This action has been performed automatically by a bot._}