Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix security issues in dependencies and Studio directly #979

Merged
merged 4 commits into from
Jan 9, 2023
Merged

Fix security issues in dependencies and Studio directly #979

merged 4 commits into from
Jan 9, 2023

Commits on Jan 9, 2023

  1. Fix prototype pollution vulnerability in settings handling 

    URL parameters could be used to modify the root prototype, eg.:
   ?__proto__.toString=peter

Fortunately, the assigned value is always a string, so it's not possible
to overwrite functions with other functions. The example above just
leads to a JS error which is caught by the application and an error is
then displayed. It might be possible to add a new field to the prototype
that then leads to other code checking `if ('foo' in obj)` to behave
differently. But I couldn't find a spot that could be abused. I might
very well have missed something, but my guess would be that this
vulnerability is not really exploitable in a bad way.

Note: I think only one of the `{}` needs to be replaced by
`Object.create(null)`, but it doesn't hurt just replacing all of them.
From a quick glance, I also didn't find any similar problems in the
code base.
    @LukasKalbertodt
    LukasKalbertodt committed Jan 9, 2023
    Configuration menu
    Copy the full SHA
    2c09ced View commit details
    Browse the repository at this point in the history

  2. Run npm audit fix

    @LukasKalbertodt
    LukasKalbertodt committed Jan 9, 2023
    Configuration menu
    Copy the full SHA
    4fd278f View commit details
    Browse the repository at this point in the history

  3. Update react-scripts to 5.0.1 

    This updates a ton of other dependencies. In particular, it also fixes
a ton of security issues within the dependency tree.
    @LukasKalbertodt
    LukasKalbertodt committed Jan 9, 2023
    Configuration menu
    Copy the full SHA
    52d7e48 View commit details
    Browse the repository at this point in the history

  4. Update a few dependencies (just minor bumps)

    @LukasKalbertodt
    LukasKalbertodt committed Jan 9, 2023
    Configuration menu
    Copy the full SHA
    a65572c View commit details
    Browse the repository at this point in the history