Security: colors library #489

plocket · 2022-01-10T14:33:58Z

See https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/. Repos using ALKiln out there all have a package.json of their own and thus necessarily require cucumber itself in their package.json.

All dependents need to add a line in their package.json "dependencies" property:

,
    "colors": "1.4.0"

We can see our dependents at https://github.com/SuffolkLITLab/ALKiln/network/dependents?package_id=UGFja2FnZS0xNDkzMjYzODcy

We also need to deprecate all previous versions of ALKiln.

plocket · 2022-01-10T14:43:44Z

Discuss adding our package-lock.json to our .gitignore so that we can run into the same problems as our developers.

See SuffolkLITLab/ALKiln#489.

This will be holding a reference to an old version of the `colors` npm package. See SuffolkLITLab/ALKiln#489.

See SuffolkLITLab/ALKiln#489.

This will be holding a reference to an old version of the `colors` npm package. See SuffolkLITLab/ALKiln#489.

See SuffolkLITLab/ALKiln#489.

plocket · 2022-01-10T15:41:49Z

I think the ones that are failing are now failing because of the bootstrap update to the dev server. They need to be updated to v3 of kiln. Is that worth it, or should we wait till v4? It may be a couple weeks yet.

React with 👍 for v3. React with 😄 for v4.

[Decision: We'll take care of this first, then move forward as we can to scope the update to v3 and go from there. ~~Most of these aren't under development and thus don't need working tests.~~]

See SuffolkLITLab/ALKiln#489.

plocket · 2022-01-10T15:55:18Z

We may also want to set up scheduled tests with our own repository (after deleting package-lock.json) in case we have periods of low development frequency. Does that sound reasonable? What kind of schedule? Once a day/week/month?

See SuffolkLITLab/ALKiln#489.

See SuffolkLITLab/ALKiln#489. Tests are probably failng because of the server boostrap update. We need to update this repo to v3 of alkiln or to wait till v4 and then update to v4.

See SuffolkLITLab/ALKiln#489.

* Delete package-lock.json This will be holding a reference to an old version of the `colors` npm package. See SuffolkLITLab/ALKiln#489. * For kiln, pin version of `colors` npm package See SuffolkLITLab/ALKiln#489.

See SuffolkLITLab/ALKiln#489.

See SuffolkLITLab/ALKiln#489. Tests are probably failng because of the server boostrap update. We need to update this repo to v3 of alkiln or to wait till v4 and then update to v4.

plocket · 2022-01-10T18:13:31Z

These are ones I didn't list above because they are for testing and not as urgent. Should still get to them at some point:

See SuffolkLITLab/ALKiln#489.

* Delete package-lock.json To pin colors package in alkiln * For kiln tests, pin version of `colors` package See SuffolkLITLab/ALKiln#489.

plocket · 2022-01-10T19:16:26Z

If anyone needs to keep their package-lock.json, this other package is a possible solution: https://www.npmjs.com/package/npm-force-resolutions. It lets you put something in your package.json that overrides package-lock.json.

plocket · 2022-02-03T19:59:47Z

All necessary dependents have been handled.

I'm thinking this is just going to be for v4. Not bothering with this for v3 unless we absolutely have to since none of the vulnerabilities are severe. My current rationale is that the more work we do to maintain 3, the less work we can do getting v4 ready for release. Ready to hear opinions. - Close #164, update cucumber to v7 - Prepare for v8 of cucumber because I won't remember it later - Close #394, update puppeteer - Update our version of node (and that of our action that we'll run for other people's libs). [Addresses #393 so we can use the suffolk npm org package.] - Use `npm audit` to fix the remaining vulnerabilities (now 0) - [Remove package.json as discussed in #489 to align our tests' behaviors with those of our users.] * Update action.yml node to v17 * Update from cucumber v6 to v7. See details. See https://github.com/cucumber/cucumber-js/blob/main/docs/migration.md#migrating-to-cucumber-js-7xx Only use cucumber setDefaultTimeout globally and use a shim that replicates the fix in v8 that lets you do custom timeouts more easily so we can still give enough time for steps that may need more time. Use all caps for statuses. Test screenshot step. Btw, the cucumber test output visually looks a bit different now - when a scenario passes, all the steps pass too. Sorry about the little comment changes, etc. Tried to remove a lot of those incidental unrelated changes. * Update puppeteer to latest (13). See details below. - page.waitFor -> page.waitForTimeout and page.waitForSelector (Got deprication notice. See puppeteer/puppeteer#6214.) - remove removeEventListener (we'd need to change it to removeListener anyway - v4.0.0 and see https://github.com/puppeteer/puppeteer/blob/main/docs/api.md#eventemitterremovelistenerevent-handler). For now we'll count on page close taking care of it, just in case removing it would prevent multiple-file-downloads. * Update GitHub worflow node version, tweak changelog item order * Fix npm audit vulnerabilities and update action.yml cucumber * Pin the colors lib in action.yml * Remove package-lock.json #489, use kiln v4 for users, CHANGELOG * Fix custom timeout, remove duplicate report entry, as per review

Created log.txt and git hub artifact for reports. Closes #466. * add log.txt for report messages * create artifact for logs * Update changelog * Update our package's dependencies for v4 (#503) I'm thinking this is just going to be for v4. Not bothering with this for v3 unless we absolutely have to since none of the vulnerabilities are severe. My current rationale is that the more work we do to maintain 3, the less work we can do getting v4 ready for release. Ready to hear opinions. - Close #164, update cucumber to v7 - Prepare for v8 of cucumber because I won't remember it later - Close #394, update puppeteer - Update our version of node (and that of our action that we'll run for other people's libs). [Addresses #393 so we can use the suffolk npm org package.] - Use `npm audit` to fix the remaining vulnerabilities (now 0) - [Remove package.json as discussed in #489 to align our tests' behaviors with those of our users.] * Update action.yml node to v17 * Update from cucumber v6 to v7. See details. See https://github.com/cucumber/cucumber-js/blob/main/docs/migration.md#migrating-to-cucumber-js-7xx Only use cucumber setDefaultTimeout globally and use a shim that replicates the fix in v8 that lets you do custom timeouts more easily so we can still give enough time for steps that may need more time. Use all caps for statuses. Test screenshot step. Btw, the cucumber test output visually looks a bit different now - when a scenario passes, all the steps pass too. Sorry about the little comment changes, etc. Tried to remove a lot of those incidental unrelated changes. * Update puppeteer to latest (13). See details below. - page.waitFor -> page.waitForTimeout and page.waitForSelector (Got deprication notice. See puppeteer/puppeteer#6214.) - remove removeEventListener (we'd need to change it to removeListener anyway - v4.0.0 and see https://github.com/puppeteer/puppeteer/blob/main/docs/api.md#eventemitterremovelistenerevent-handler). For now we'll count on page close taking care of it, just in case removing it would prevent multiple-file-downloads. * Update GitHub worflow node version, tweak changelog item order * Fix npm audit vulnerabilities and update action.yml cucumber * Pin the colors lib in action.yml * Remove package-lock.json #489, use kiln v4 for users, CHANGELOG * Fix custom timeout, remove duplicate report entry, as per review * Allow a developer to wait as a first Step v4. #387. Add test. (#506) Closes #387. Also, generally adds safety measures for when page does not exist. Very similar to PR #459, but moving the responsibility down to a spot that most functions make use of, meaning that it'll be applied to a lot more cases. They mostly won't need it, but it might still be worth being more comprehensive. * Allow a developer to wait as a first Step v4. #387. Add test. Will be able to close once we've added this as an establishing step (in addition to it being a regular step). Also, generally adds safety measures for when page does not exist. * Add test Co-authored-by: Bryce Willey <Bryce.Steven.Willey@gmail.com> Co-authored-by: Bryce Willey <Bryce.Steven.Willey@gmail.com> * add log to gitnore and cleanup console.logs and typos * add empty string to file Co-authored-by: plocket <52798256+plocket@users.noreply.github.com> Co-authored-by: Bryce Willey <Bryce.Steven.Willey@gmail.com>

plocket added the security label Jan 10, 2022

plocket assigned BryceStevenWilley and plocket Jan 10, 2022

plocket added the priority A combination of urgency and impact label Jan 10, 2022

plocket mentioned this issue Jan 10, 2022

Security: Pinned colors library to 1.4.0 #488

Merged

plocket added a commit to SuffolkLITLab/docassemble-AssemblyLine that referenced this issue Jan 10, 2022

Pin version of colors package

eae2634

See SuffolkLITLab/ALKiln#489.

plocket added a commit to SuffolkLITLab/docassemble-MA209AProtectiveOrder that referenced this issue Jan 10, 2022

Delete package-lock.json

572bbf8

This will be holding a reference to an old version of the `colors` npm package. See SuffolkLITLab/ALKiln#489.

plocket added a commit to SuffolkLITLab/docassemble-MA209AProtectiveOrder that referenced this issue Jan 10, 2022

For kiln, pin version of colors npm package

8b44406

See SuffolkLITLab/ALKiln#489.

plocket added a commit to SuffolkLITLab/docassemble-209aPlaintiffMotionToModify that referenced this issue Jan 10, 2022

Delete package-lock.json

4cec599

This will be holding a reference to an old version of the `colors` npm package. See SuffolkLITLab/ALKiln#489.

plocket added a commit to SuffolkLITLab/docassemble-209aPlaintiffMotionToModify that referenced this issue Jan 10, 2022

For kiln, pin version of colors npm package

f6248cd

See SuffolkLITLab/ALKiln#489.

plocket added a commit to MassLegalHelp/docassemble-HelpForChildSupportObligors that referenced this issue Jan 10, 2022

For kiln tests, pin version of colors npm package

b08f640

See SuffolkLITLab/ALKiln#489.

plocket mentioned this issue Jan 10, 2022

For kiln tests, pin version of colors npm package MassLegalHelp/docassemble-HelpForChildSupportObligors#33

Merged

plocket added a commit to GBLS/docassemble-MAEvictionDefense that referenced this issue Jan 10, 2022

For kiln tests, pin version of colors npm package

d6e8a6f

See SuffolkLITLab/ALKiln#489.

plocket mentioned this issue Jan 10, 2022

For kiln tests, pin version of colors npm package GBLS/docassemble-MAEvictionDefense#208

Merged

plocket added a commit to SuffolkLITLab/docassemble-AssemblyLine that referenced this issue Jan 10, 2022

Pin version of colors package (#368)

d7a0795

See SuffolkLITLab/ALKiln#489.

plocket added a commit to MassLegalHelp/docassemble-HelpForChildSupportObligors that referenced this issue Jan 10, 2022

For kiln tests, pin version of colors npm package (#33)

f8c2c7d

See SuffolkLITLab/ALKiln#489.

plocket added a commit to SuffolkLITLab/docassemble-MAVirtualCourt that referenced this issue Jan 10, 2022

For kiln tests, pin version of colors package

801a220

See SuffolkLITLab/ALKiln#489.

plocket mentioned this issue Jan 10, 2022

For kiln tests, pin version of colors package SuffolkLITLab/docassemble-MAVirtualCourt#769

Merged

plocket closed this as completed Feb 3, 2022

plocket added a commit that referenced this issue Feb 8, 2022

Remove package-lock.json #489, use kiln v4 for users, CHANGELOG

6d6c085

plocket mentioned this issue Feb 8, 2022

Update our package's dependencies for v4 #503

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security: colors library #489

Security: colors library #489

plocket commented Jan 10, 2022 •

edited

plocket commented Jan 10, 2022

plocket commented Jan 10, 2022 •

edited

plocket commented Jan 10, 2022

plocket commented Jan 10, 2022 •

edited

plocket commented Jan 10, 2022

plocket commented Feb 3, 2022

Security: colors library #489

Security: colors library #489

Comments

plocket commented Jan 10, 2022 • edited

plocket commented Jan 10, 2022

plocket commented Jan 10, 2022 • edited

plocket commented Jan 10, 2022

plocket commented Jan 10, 2022 • edited

plocket commented Jan 10, 2022

plocket commented Feb 3, 2022

plocket commented Jan 10, 2022 •

edited

plocket commented Jan 10, 2022 •

edited

plocket commented Jan 10, 2022 •

edited