Skip to main content

Fixing security vulnerabilities in npm dependencies

It’s been a while since I have written a blog and now since most of us are working from home, the time that used to go in commute is now saved and I thought why not utilize this time and write about my recent experience of fixing a security vulnerability.
So if any of you in the recent time have seen something like this image below and have no clue how to fix it then this article is for you. When I saw it, I had no clue either but with some research I could fix this.

🔬 Problem:

github security vulernability bot alert
github security vulnerability bot alert
So what this means is one of the dependencies in your package.json has some security implications which can be exploited by an attacker and can cause problems for you, your product, for users of your product or the company you work for.
This vulnerability could have caused a Regular Expression Denial of Service

💡 Finding:

  1. npm audit — which should show you an output like the following image:
npm audit log showing minimist as a prototype pollution vulnerability
npm audit log
2) Github security policy can also notify you — something like the following image:
github security page screenshot showing minimist as a moderate level vulnerability
github security alert
Today when I started working I had to deal with this error where acorn and minimistwere being reported as security vulnerabilities.

🎉 Solution

📦 npm update
  1. This is the first thing you should do and it’s the simplest one too.
  • Run npm update — https://docs.npmjs.com/cli-commands/update.html
  • Delete your package-lock.json file or for yarn users, delete your yarn.lock file. In an ideal world this would work, but there might be some dependency which does not follow semver and might get updated too.
  • So a better solution here would be to only delete the lines corresponding to the vulnerable package in your package-lock.json(or yarn.lock) file.
  • Run npm install again
In an ideal scenario, this should have upgraded your dependencies to the next semver version and those libraries might have already fixed the version of there transitive dependencies.
🔭 npm audit
2. But if that did not fix your issue, which for minimistdid not fix for me, then follow the below mentioned steps:
2.1) To fix any dependency, you need to first know which npm package depends on that.
npm audit
This will tell you the packages which are vulnerable.
npm audit log showing minimist as a prototype pollution vulnerability
This tells me that minimist is required by mkdirp and that is required by mocha
A quick glance into package-lock.json can give you more information around the affected version.
In my case mocha(7.1.0) -> mkdirp(0.5.1) -> minimist(0.0.8) — the vulnerable version.
🔑 Resolutions key
3) And finally the fix was:
3.1) First npm install the non-vulnerable version, which in my case was 1.2.5
npm install minimist --save-dev
yarn and npmusers
3.2) Add a resolutions key in your package.json file
{
"resolutions": {
"minimist": "^1.2.5"
}
}
For npm users, we need one more step for that resolutions key to work.
3.3) Use npm-force-resolutions(https://www.npmjs.com/package/npm-force-resolutions)

"scripts": {
"preinstall": "npx npm-force-resolutions"
}
3.4) After that run
npm install
That’s it. That solves the dependency issues which can not be updated using either npm update or by uninstalling and reinstalling a new dependency.
To check if the dependency works correctly
npm ls minimist
This should give you an output the image below

⚠️ Disclaimer

If some packages are only compatible with an older version, then this change might break your app. So be careful while resolving to a particular version and test your app before releasing this change.

Comments

Post a Comment

Popular posts from this blog

4 Ways to Communicate Across Browser Tabs in Realtime

1. Local Storage Events You might have already used LocalStorage, which is accessible across Tabs within the same application origin. But do you know that it also supports events? You can use this feature to communicate across Browser Tabs, where other Tabs will receive the event once the storage is updated. For example, let’s say in one Tab, we execute the following JavaScript code. window.localStorage.setItem("loggedIn", "true"); The other Tabs which listen to the event will receive it, as shown below. window.addEventListener('storage', (event) => { if (event.storageArea != localStorage) return; if (event.key === 'loggedIn') { // Do something with event.newValue } }); 2. Broadcast Channel API The Broadcast Channel API allows communication between Tabs, Windows, Frames, Iframes, and  Web Workers . One Tab can create and post to a channel as follows. const channel = new BroadcastChannel('app-data'); channel.postMessage(data); And oth...
Post a Comment
Read more

Certbot SSL configuration in ubuntu

  Introduction Let’s Encrypt is a Certificate Authority (CA) that provides an easy way to obtain and install free  TLS/SSL certificates , thereby enabling encrypted HTTPS on web servers. It simplifies the process by providing a software client, Certbot, that attempts to automate most (if not all) of the required steps. Currently, the entire process of obtaining and installing a certificate is fully automated on both Apache and Nginx. In this tutorial, you will use Certbot to obtain a free SSL certificate for Apache on Ubuntu 18.04 and set up your certificate to renew automatically. This tutorial will use a separate Apache virtual host file instead of the default configuration file.  We recommend  creating new Apache virtual host files for each domain because it helps to avoid common mistakes and maintains the default files as a fallback configuration. Prerequisites To follow this tutorial, you will need: One Ubuntu 18.04 server set up by following this  initial ...
Post a Comment
Read more

Working with Node.js streams

  Introduction Streams are one of the major features that most Node.js applications rely on, especially when handling HTTP requests, reading/writing files, and making socket communications. Streams are very predictable since we can always expect data, error, and end events when using streams. This article will teach Node developers how to use streams to efficiently handle large amounts of data. This is a typical real-world challenge faced by Node developers when they have to deal with a large data source, and it may not be feasible to process this data all at once. This article will cover the following topics: Types of streams When to adopt Node.js streams Batching Composing streams in Node.js Transforming data with transform streams Piping streams Error handling Node.js streams Types of streams The following are four main types of streams in Node.js: Readable streams: The readable stream is responsible for reading data from a source file Writable streams: The writable stream is re...
Post a Comment
Read more