Firebase-tools: Update vulnerable dependencies (or use alternatives)
See https://snyk.io/test/npm/firebase-tools — it lists 4 vulnerable deps (2 high, 2 low) installed with the latest version of firebase-tools.
Related: #235, but that lists other deps (probably no longer valid?).
Current Snyk output:
- [High] Arbitrary Command Injection
Introduced through:[email protected] › [email protected], - [High] Directory Traversal
Introduced through:[email protected] › [email protected], - [Low] Prototype Pollution
Introduced through:[email protected] › [email protected] › [email protected] › [email protected], - [Low] Prototype Pollution
Introduced through:[email protected] › [email protected] › [email protected] › [email protected]and 2 other lodash paths.
ChALkeR
👍6
All 8 comments
This is what npm install prints now:
$ npm i firebase-tools
…
…
+ [email protected]
added 533 packages from 270 contributors in 53.092s
[!] 6 vulnerabilities found [2483 packages audited]
Severity: 2 low | 2 moderate | 1 high | 1 critical
Run `npm audit` for more detail
npm audit output:
$ npm audit
=== npm audit security report ===
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ critical │ Command Injection │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ open │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ firebase-tools │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ firebase-tools > open │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/663 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate │ Prototype pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ hoek │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ firebase-tools │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ firebase-tools > jsonwebtoken > joi > hoek │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/566 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate │ Prototype pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ hoek │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ firebase-tools │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ firebase-tools > jsonwebtoken > joi > topo > hoek │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/566 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ Path Traversal │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ superstatic │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ firebase-tools │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ firebase-tools > superstatic │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/652 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ lodash │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ firebase-tools │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ firebase-tools > superstatic > glob-slasher > toxic > lodash │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/577 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ lodash │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ firebase-tools │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ firebase-tools > superstatic > nash > lodash │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/577 │
└───────────────┴──────────────────────────────────────────────────────────────┘
[!] 6 vulnerabilities found - Packages audited: 2483 (0 dev, 1275 optional)
Severity: 2 low | 2 moderate | 1 high | 1 critical
Unfortunately superstatic and open are already at their latest versions, so this is not as simple as updating dependencies. I don't think we can get away from using superstatic, but we may be able to use an alternative for open, PRs welcome :)
laurenzlong
on 21 May 2018
@laurenzlong superstatic is a part of firebase, so that is in scope — just release a new version without the vulnerability.
open could be replaced.
I am not a user of firebase-tools and am not going to file PRs, sorry.
Especially given the lack of interest from maintainers.
ChALkeR
on 21 May 2018
👍4
Especially given the lack of interest from maintainers.
That was harsh. It's probably not their fault, Google has other priorities... They release some half-baked stuff and then they move employees to different projects. You can't expect a high quality from Google. Take a look a Polymerfire, it's in much, much worse condition ;)
merlinnot
on 7 Jun 2018
👍1
3.19.1 has been released and addresses vulnerable deps.
mbleigh
on 26 Jun 2018
@mbleigh I think there is one left (other than superstatic path traversal that should have the data updated):
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Path Traversal │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ superstatic │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ No patch available │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ firebase-tools │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ firebase-tools > superstatic │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/652 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Prototype Pollution │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ lodash │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=4.17.5 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ firebase-tools │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ firebase-tools > superstatic > nash > lodash │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/577 │
└───────────────┴──────────────────────────────────────────────────────────────┘
Yes, we still have that one to deal with, but it doesn't directly affect firebase-tools (it is used by a package that is only used to control the superstatic command-line interface but is never loaded in the course of using firebase-tools) and is marked as "Low".
Will try to patch it through Superstatic but wanted to get a fix out for the higher level vulnerabilities ASAP.
mbleigh
on 26 Jun 2018
👍4
I have four Prototype Pollution high-level warnings from node-forge via firebase-tools
They are all very similar to
High Prototype Pollution in node-forge
Package node-forge
Patched in >= 0.10.0
Dependency of firebase-tools
Path firebase-tools > google-gax > google-auth-library > gtoken >
google-p12-pem > node-forge
More info https://npmjs.com/advisories/1561
cjcurrie
on 2 Oct 2020
👍1
Was this page helpful?
0 / 5 - 0 ratings
Related issues
francisrod01
·
3Comments
ahaverty
·
4Comments
laurenzlong
·
4Comments
jefrydco
·
3Comments
repentsinner
·
3Comments
Most helpful comment
Yes, we still have that one to deal with, but it doesn't directly affect
firebase-tools(it is used by a package that is only used to control thesuperstaticcommand-line interface but is never loaded in the course of usingfirebase-tools) and is marked as "Low".Will try to patch it through Superstatic but wanted to get a fix out for the higher level vulnerabilities ASAP.