Lwc: NPM Package Vulnerabilities Reported

[larkintuckerllc]

Description

Steps to Reproduce

npx lwc-create-app my-app
npm audit

Expected Results

No reported vulnerabilities.

Actual Results

                       === npm audit security report ===                        

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ js-yaml                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.13.0                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ lwc-services                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ lwc-services > @lwc/compiler > @lwc/style-compiler > cssnano │
│               │ > postcss-svgo > svgo > js-yaml                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/788                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Code Injection                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ js-yaml                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.13.1                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ lwc-services                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ lwc-services > @lwc/compiler > @lwc/style-compiler > cssnano │
│               │ > postcss-svgo > svgo > js-yaml                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/813                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 2 vulnerabilities (1 moderate, 1 high) in 889133 scanned packages
  2 vulnerabilities require manual review. See the full report for details.

Browsers Affected

N/A

Possible Solution

Manually upgrade reported libraries; validate there are no negative impacts.

[caridy]

I think this is covered by https://github.com/salesforce/lwc/commit/1b458656bbee25c9809b0a4fbcfbc9d93782394d, which needs to be released. @ekashida @diervo can you confirm?

[ekashida]

No, that change removed an fstream vulnerability. This looks different.

[muenzpraeger]

This may be related to the cssnano upgrade that is mentioned in #1216

[diervo]

We have several packages depending on js-yaml 3.12.x, however the security issue is due to arbitrary load of yaml files vis specific method. We should eventually fix this, but I don't see it as a security problem since we don't use nor parse any yaml file as part of any of our code.

[ekashida]

I found out after discussing with @diervo that the reason why we can't upgrade cssnano right now is because they dropped support for their synchronous API.

[jarrodek]

@diervo the code might not be actually used but 1) it doesn't look good especially if you are starting with LWC and you see errors like this and 2) the infosec team most probably disagree with this and I will have a problem putting an app into production.
Is there anything we can do about that?

[diervo]

you are right, and we fixed most of them, will see what we can do about this one without upgrading the world.

[rahulbir]

+1 is this going to get fixed?