High vulnerability in dependency package vinyl-fs > glob-stream > glob-parent

[pedrodlz]

🐛 Bug Report

High vulnerability found in package glob-parent
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ glob-parent before 5.1.2 vulnerable to Regular Expression │
│ │ Denial of Service in enclosure regex │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ glob-parent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=5.1.2 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ i18next-parser │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ i18next-parser > vinyl-fs > glob-stream > glob-parent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1081884 │
└───────────────┴──────────────────────────────────────────────────────────────┘

To Reproduce

yarn audit

Expected behavior

No vulnerabilities found

Your Environment

• runtime version: node v16.16.0, Ract Native 0.68.5
• i18next version: 6.6.0
• os: Windows

[eelkevdbos]

If you run npm v8.3+, you can add an override to package.json until it is fixed:

  "overrides": {
    "glob-parent": "^5.1.2"
  }

[chidg]

Hi maintainers, any chance of an update on this? overrides/resolutions is an ok workaround, but it would be nicer if there was a proper fix.

[karellm]

@chidg I have limited bandwidth atm, would you be available to make a PR?

[chidg]

Hi @karellm, it turns out you already have a PR for the dependency upgrade: #859
Unfortunately there is a failing test relating to Broccoli. I spent some time debugging it but couldn't make much progress.

[karellm]

I've spent about an hour trying to debug this and couldn't find why the test fail. It looks like the files are not being parsed for some obscure reason.

[chidg]

Same experience I had!

[woutervanvliet]

Spent well over an hour debugging; turned out glob-stream, used by vinyl-fs, only scans from the current directory and upwards, thus not finding temporary files created by Broccoli and in turn not creating translation files.

This all should be solved in #930.

[karellm]

This should be fixed as of 8.9.0