Address Snyk reported vulnerabilities

[nilsbeuth]

Describe the Bug

Hi. We're experimenting with your dmn.js open source library. It looks like a super way of exposing Decisions in our application.

However, we also use https://snyk.io/ -- which helps us ensure we only use libraries that are secure.

The dmn-js library (dmn-js@9.4.0) failed our integration tests, on two counts.

1. "Prototype Pollution". "Affected versions of this package are vulnerable to Prototype Pollution. The library could be tricked into adding or modifying properties of Object.prototype using a constructor or proto payload".

2. "Denial of Service". "Affected versions of this package are vulnerable to Denial of Service. Node Fetch did not honor the size option after following a redirect".

After an initial investigation, our web developer informs me that the vulnerabilities are not within dmn-js, but within other libraries nested within.

Wondering whether there are any plans/intentions to resolve these?

Thanks

Steps to Reproduce

Connect Snyk to an application that uses the dmn-js library.

Expected Behavior

No vulnerabilities reported by snyk.

Environment

• Library version: 9.4.0

[pinussilvestrus]

Thanks for reporting! 👍
We will discuss internally how to approach the security vulnerabilities and then come back to you.

[nikku]

After an initial investigation, our web developer informs me that the vulnerabilities are not within dmn-js, but within other libraries nested within.

For a tool such as dmn-js we gotta distinguish two kind of dependencies: development and production. From what I see both, node-fetch as well as minimist are dependencies during development only.

How do development dependencies impact your usage of dmn-js?

[nikku]

Reproduce without snyk:

❯ (cd packages/dmn-js-shared && npm i --package-lock-only && npm audit)
npm WARN deprecated core-js@2.6.12: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.
npm notice created a lockfile as package-lock.json. You should commit this file.
added 78 packages and audited 81 packages in 3.257s
found 2 low severity vulnerabilities
  run `npm audit fix` to fix them, or `npm audit` for details
                                                                                
                       === npm audit security report ===                        
                                                                                
# Run  npm install inferno@7.4.6  to resolve 2 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ inferno                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ inferno > opencollective > minimist                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ node-fetch                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ inferno                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ inferno > opencollective > node-fetch                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1556                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


found 2 low severity vulnerabilities in 81 scanned packages
  2 vulnerabilities require semver-major dependency updates.

[nikku]

We do not have any immediate plans to resolve these issues.

[nikku]

The fix is not a simple and straight forward one.

[nilsbeuth]

Thanks @nikku for your promt and detailed response. Our web devs will see what they can do to sidestep the vulnerabilities - and if we can't we'll likely have to find another way to render decisions.