Skip to content

Commit

Permalink
[Snyk] Security upgrade node-forge from 0.9.1 to 0.10.0 (#2930)
Browse files Browse the repository at this point in the history 
* fix: package.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677

* update dompurify to 2.0.15

* update forge lib, add notes to build.sh

* try forge.all.js instead of forge.js

* stick to forge.js

* lib: Update node-forge to 0.10.0

This is a temporary measure as currently node-forge cannot be built in a
non-minimized, non-eval'led version.

See: digitalbazaar/forge#814

* Update build.sh

Co-authored-by: Tom J <tom@holub.me>
Co-authored-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>
Co-authored-by: Tom J <human@flowcrypt.com>
  • Loading branch information
@snyk-bot @wiktor-k
4 people committed Sep 4, 2020
1 parent a79419e commit 5834c1a
Show file tree
Hide file tree
Showing 3 changed files with 40 additions and 108 deletions.
5 changes: 5 additions & 0 deletions build.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,11 @@ mkdir -p $OUTDIR/lib/bootstrap
cp node_modules/bootstrap/dist/js/bootstrap.min.js $OUTDIR/lib/bootstrap/bootstrap.min.js
cp node_modules/bootstrap/dist/css/bootstrap.min.css $OUTDIR/lib/bootstrap/bootstrap.min.css

# to update node-forge library, which is missing the non-minified version in dist, we have to build it manually
# cd ~/git && rm -rf ./forge && git clone https://github.com/digitalbazaar/forge.git && cd ./forge && npm install && npm run-script build
# cp dist/forge.js ../flowcrypt-browser/extension/lib/forge.js
# WARN: the steps above are not working as of forge 0.10.0 due to eval/CSP mentioned here: https://github.com/digitalbazaar/forge/issues/814

# remaining build steps sequentially
( cd $SRCDIR && cp -r --parents ./**/*.{js,htm,css,ttf,woff2,png,svg,txt} ./{.web-extension-id,manifest.json} ../$OUTDIR )
node ./build/tooling/resolve-modules
Expand Down
137 changes: 32 additions & 105 deletions extension/lib/forge.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
exports["forge"] = factory();
else
root["forge"] = factory();
})(typeof self !== 'undefined' ? self : this, function() {
})(window, function() {
return /******/ (function(modules) { // webpackBootstrap
/******/ // The module cache
/******/ var installedModules = {};
Expand Down Expand Up @@ -46,14 +46,34 @@ return /******/ (function(modules) { // webpackBootstrap
/******/ // define getter function for harmony exports
/******/ __webpack_require__.d = function(exports, name, getter) {
/******/ if(!__webpack_require__.o(exports, name)) {
/******/ Object.defineProperty(exports, name, {
/******/ configurable: false,
/******/ enumerable: true,
/******/ get: getter
/******/ });
/******/ Object.defineProperty(exports, name, { enumerable: true, get: getter });
/******/ }
/******/ };
/******/
/******/ // define __esModule on exports
/******/ __webpack_require__.r = function(exports) {
/******/ if(typeof Symbol !== 'undefined' && Symbol.toStringTag) {
/******/ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
/******/ }
/******/ Object.defineProperty(exports, '__esModule', { value: true });
/******/ };
/******/
/******/ // create a fake namespace object
/******/ // mode & 1: value is a module id, require it
/******/ // mode & 2: merge all properties of value into the ns
/******/ // mode & 4: return value when already ns object
/******/ // mode & 8|1: behave like require
/******/ __webpack_require__.t = function(value, mode) {
/******/ if(mode & 1) value = __webpack_require__(value);
/******/ if(mode & 8) return value;
/******/ if((mode & 4) && typeof value === 'object' && value && value.__esModule) return value;
/******/ var ns = Object.create(null);
/******/ __webpack_require__.r(ns);
/******/ Object.defineProperty(ns, 'default', { enumerable: true, value: value });
/******/ if(mode & 2 && typeof value != 'string') for(var key in value) __webpack_require__.d(ns, key, function(key) { return value[key]; }.bind(null, key));
/******/ return ns;
/******/ };
/******/
/******/ // getDefaultExport function for compatibility with non-harmony modules
/******/ __webpack_require__.n = function(module) {
/******/ var getter = module && module.__esModule ?
Expand All @@ -69,6 +89,7 @@ return /******/ (function(modules) { // webpackBootstrap
/******/ // __webpack_public_path__
/******/ __webpack_require__.p = "";
/******/
/******/
/******/ // Load entry module and return exports
/******/ return __webpack_require__(__webpack_require__.s = 34);
/******/ })
Expand Down Expand Up @@ -2611,99 +2632,6 @@ util.makeLink = function(path, query, fragment) {
((fragment.length > 0) ? ('#' + fragment) : '');
};

/**
* Follows a path of keys deep into an object hierarchy and set a value.
* If a key does not exist or it's value is not an object, create an
* object in it's place. This can be destructive to a object tree if
* leaf nodes are given as non-final path keys.
* Used to avoid exceptions from missing parts of the path.
*
* @param object the starting object.
* @param keys an array of string keys.
* @param value the value to set.
*/
util.setPath = function(object, keys, value) {
// need to start at an object
if(typeof(object) === 'object' && object !== null) {
var i = 0;
var len = keys.length;
while(i < len) {
var next = keys[i++];
if(i == len) {
// last
object[next] = value;
} else {
// more
var hasNext = (next in object);
if(!hasNext ||
(hasNext && typeof(object[next]) !== 'object') ||
(hasNext && object[next] === null)) {
object[next] = {};
}
object = object[next];
}
}
}
};

/**
* Follows a path of keys deep into an object hierarchy and return a value.
* If a key does not exist, create an object in it's place.
* Used to avoid exceptions from missing parts of the path.
*
* @param object the starting object.
* @param keys an array of string keys.
* @param _default value to return if path not found.
*
* @return the value at the path if found, else default if given, else
* undefined.
*/
util.getPath = function(object, keys, _default) {
var i = 0;
var len = keys.length;
var hasNext = true;
while(hasNext && i < len &&
typeof(object) === 'object' && object !== null) {
var next = keys[i++];
hasNext = next in object;
if(hasNext) {
object = object[next];
}
}
return (hasNext ? object : _default);
};

/**
* Follow a path of keys deep into an object hierarchy and delete the
* last one. If a key does not exist, do nothing.
* Used to avoid exceptions from missing parts of the path.
*
* @param object the starting object.
* @param keys an array of string keys.
*/
util.deletePath = function(object, keys) {
// need to start at an object
if(typeof(object) === 'object' && object !== null) {
var i = 0;
var len = keys.length;
while(i < len) {
var next = keys[i++];
if(i == len) {
// last
delete object[next];
} else {
// more
if(!(next in object) ||
(typeof(object[next]) !== 'object') ||
(object[next] === null)) {
break;
}
object = object[next];
}
}
}
};

/**
* Check if an object is empty.
*
Expand Down Expand Up @@ -3097,7 +3025,7 @@ util.estimateCores = function(options, callback) {
}
};

/* WEBPACK VAR INJECTION */}.call(exports, __webpack_require__(36)))
/* WEBPACK VAR INJECTION */}.call(this, __webpack_require__(36)))

/***/ }),
/* 2 */
Expand Down Expand Up @@ -25211,7 +25139,7 @@ forge.log.prepareFull = function(message) {
if(!('full' in message)) {
// copy args and insert message at the front
var args = [message.message];
args = args.concat([] || message['arguments']);
args = args.concat([] || false);
// format the message
message.full = forge.util.format.apply(this, args);
}
Expand Down Expand Up @@ -25471,11 +25399,10 @@ g = (function() {

try {
// This works if eval is allowed (see CSP)
g = g || Function("return this")() || (1,eval)("this");
} catch(e) {
g = g || new Function("return this")();
} catch (e) {
// This works if the window reference is available
if(typeof window === "object")
g = window;
if (typeof window === "object") g = window;
}

// g can still be undefined, but nothing to do about it...
Expand Down
6 changes: 3 additions & 3 deletions package.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,11 +36,11 @@
},
"dependencies": {
"@flowcrypt/fine-uploader": "5.16.4",
"dompurify": "2.0.14",
"dompurify": "2.0.15",
"jquery": "3.5.1",
"openpgp": "4.10.7",
"sweetalert2": "9.17.1",
"node-forge": "0.9.1",
"node-forge": "0.10.0",
"iso-8859-2": "1.0.0",
"zxcvbn": "4.4.2",
"squire-rte": "1.10.2",
Expand Down Expand Up @@ -87,4 +87,4 @@
"url": "https://github.com/FlowCrypt/flowcrypt-browser/issues"
},
"homepage": "https://flowcrypt.com"
}
}

0 comments on commit 5834c1a

Please sign in to comment.