Browser-sync: RE DoS + Prototype pollution vulnerability

Created on 23 Jul 2018 · 5Comments · Source: BrowserSync/browser-sync

Issue details

NPM flagged a vulnerability regarding this package due to a Regular Expression Denial of Service found in its debug dependency as follows:

 Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ debug                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >= 2.6.9 < 3.0.0 || >= 3.1.0                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ browser-sync [dev]                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ browser-sync > localtunnel > debug                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/534

There's also an apparent Prototype Pollution in its lodash dependency as follows:

 Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.5                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ browser-sync                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ browser-sync > easy-extender > lodash                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/577

Steps to reproduce/test case

# cd to a project that uses browser-sync as a dev dependency
npm audit #or nsp check

Please specify which version of Browsersync, node and npm you're running

Browsersync [2.24.6]
Node [10.7.0]
Npm [6.2.0]

Affected platforms

[x] linux
[x] windows
[x] OS X
[ ] freebsd
[ ] solaris
[ ] other _(please specify which)_

Browsersync use-case

[x] API
[ ] Gulp
[ ] Grunt
[ ] CLI

If CLI, please paste the entire command below

{cli command here}

for all other use-cases, (gulp, grunt etc), please show us exactly how you're using Browsersync

    if (app.get('browser') || process.env.BROWSER) {
      require('browser-sync')({
        proxy: `localhost:${port}`,
        files: ['public/**/*.{js,css}']
      });
    }

Source