Fix audits (#321)

Author: quinnturner

.vscode/settings.json

@@ -2,7 +2,7 @@
   "editor.defaultFormatter": "esbenp.prettier-vscode",
   "editor.formatOnSave": true,
   "editor.codeActionsOnSave": {
-    "source.fixAll": true
+    "source.fixAll": "explicit"
   },
   "typescript.tsdk": "node_modules/typescript/lib",
   "search.exclude": {

package-lock.json

@@ -77,7 +77,7 @@
     "@typescript-eslint/parser": "^5.48.2",
     "audit-types": "^0.5.6",
     "c8": "^7.12.0",
-    "chai": "^4.3.7",
+    "chai": "^4.3.10",
     "concurrently": "^7.6.0",
     "eslint": "^8.32.0",
     "eslint-config-prettier": "^8.6.0",
@@ -91,4 +91,4 @@
     "tsup": "^6.5.0",
     "typescript": "^4.9.4"
   }
-}
+}

package.json

@@ -79,8 +79,8 @@ describe("npm-auditer", () => {
     expect(summary).to.eql(
       summaryWithDefault({
         failedLevelsFound: ["high"],
-        advisoriesFound: ["GHSA-38f5-ghc2-fcmv"],
-        advisoryPathsFound: ["GHSA-38f5-ghc2-fcmv|cryo"],
+        advisoriesFound: ["GHSA-hrpp-h998-j3pp"],
+        advisoryPathsFound: ["GHSA-hrpp-h998-j3pp|qs"],
       })
     );
   });

test/npm-auditer.spec.ts

@@ -1,58 +1,60 @@
 {
   "actions": [
     {
-      "action": "review",
-      "module": "cryo",
+      "isMajor": false,
+      "action": "install",
       "resolves": [
         {
-          "id": 1066151,
-          "path": "cryo",
+          "id": 1094102,
+          "path": "qs",
           "dev": false,
-          "bundled": false,
-          "optional": false
+          "optional": false,
+          "bundled": false
         }
-      ]
+      ],
+      "module": "qs",
+      "target": "6.11.2"
     }
   ],
   "advisories": {
-    "1066151": {
+    "1094102": {
       "findings": [
         {
-          "version": "0.0.6",
+          "version": "6.10.2",
           "paths": [
-            "cryo"
+            "qs"
           ]
         }
       ],
       "metadata": null,
-      "vulnerable_versions": "<=0.0.6",
-      "module_name": "cryo",
+      "vulnerable_versions": ">=6.10.0 <6.10.3",
+      "module_name": "qs",
       "severity": "high",
-      "github_advisory_id": "GHSA-38f5-ghc2-fcmv",
+      "github_advisory_id": "GHSA-hrpp-h998-j3pp",
       "cves": [
-        "CVE-2018-3784"
+        "CVE-2022-24999"
       ],
       "access": "public",
-      "patched_versions": "<0.0.0",
+      "patched_versions": ">=6.10.3",
       "cvss": {
-        "score": 0,
-        "vectorString": null
+        "score": 7.5,
+        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
       },
-      "updated": "2020-08-31T18:32:59.000Z",
-      "recommendation": "None",
+      "updated": "2023-09-21T22:11:38.000Z",
+      "recommendation": "Upgrade to version 6.10.3 or later",
       "cwe": [
-        "CWE-94"
+        "CWE-1321"
       ],
       "found_by": null,
       "deleted": null,
-      "id": 1066151,
-      "references": "- https://nvd.nist.gov/vuln/detail/CVE-2018-3784\n- https://hackerone.com/reports/350418\n- https://github.com/advisories/GHSA-38f5-ghc2-fcmv\n- https://www.npmjs.com/advisories/690",
-      "created": "2022-03-11T08:00:43.889Z",
+      "id": 1094102,
+      "references": "- https://nvd.nist.gov/vuln/detail/CVE-2022-24999\n- https://github.com/ljharb/qs/pull/428\n- https://github.com/n8tz/CVE-2022-24999\n- https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec\n- https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68\n- https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b\n- https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d\n- https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1\n- https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105\n- https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f\n- https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee\n- https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda\n- https://github.com/expressjs/express/releases/tag/4.17.3\n- https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html\n- https://github.com/advisories/GHSA-hrpp-h998-j3pp",
+      "created": "2022-11-27T00:30:50.000Z",
       "reported_by": null,
-      "title": "Code Injection in cryo",
+      "title": "qs vulnerable to Prototype Pollution",
       "npm_advisory_id": null,
-      "overview": "All versions of `cryo` are vulnerable to code injection due to an Insecure implementation of deserialization.\n\n\n## Proof of concept\n\n```\nvar Cryo = require('cryo');\nvar frozen = '{\"root\":\"_CRYO_REF_3\",\"references\":[{\"contents\":{},\"value\":\"_CRYO_FUNCTION_function () {console.log(\\\\\"defconrussia\\\\\"); return 1111;}\"},{\"contents\":{},\"value\":\"_CRYO_FUNCTION_function () {console.log(\\\\\"defconrussia\\\\\");return 2222;}\"},{\"contents\":{\"toString\":\"_CRYO_REF_0\",\"valueOf\":\"_CRYO_REF_1\"},\"value\":\"_CRYO_OBJECT_\"},{\"contents\":{\"__proto__\":\"_CRYO_REF_2\"},\"value\":\"_CRYO_OBJECT_\"}]}'\nvar hydrated = Cryo.parse(frozen);\nconsole.log(hydrated);\n```\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.",
-      "url": "https://github.com/advisories/GHSA-38f5-ghc2-fcmv"
+      "overview": "qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.",
+      "url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp"
     }
   },
   "muted": [],
@@ -64,10 +66,10 @@
       "high": 1,
       "critical": 0
     },
-    "dependencies": 1,
+    "dependencies": 9,
     "devDependencies": 0,
     "optionalDependencies": 0,
-    "totalDependencies": 1
+    "totalDependencies": 9
   },
-  "runId": "0711adfe-fc4e-4a94-80fc-e518c13a63d2"
+  "runId": "fe0d72f1-1fb6-4fb2-aa42-246a60c3950a"
 }