Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SECURITY - Cucumber affected by Marak/colors.js#285 #1885

Closed
jan-molak opened this issue Jan 10, 2022 · 3 comments
Closed

SECURITY - Cucumber affected by Marak/colors.js#285 #1885

jan-molak opened this issue Jan 10, 2022 · 3 comments

Comments

@jan-molak
Copy link
Member

jan-molak commented Jan 10, 2022

Describe the bug
Malicious code introduced in colors version 1.4.1 and 1.4.2 causes Cucumber.js to fall into an infinite loop, printing gibberish to the terminal.

CC: @davidjgoss @aslakhellesoy @jbpros

To Reproduce

Use any feature that prints to the terminal, for example:

npx @cucumber/cucumber --version

Screenshots
If applicable, add screenshots to help explain your problem.
Screenshot 2022-01-10 at 01 22 02

Desktop (please complete the following information):

  • OS: any
  • Browser any
  • Version all (Serenity/JS runs tests against Cucumber 1.x to 8.x, the issue is present in all version of Cucumber because of the dependency on cli-table3 and/or colors)

TO FIX

Short term:

Long term:

  • Consider replacing colors with chalk

Additional context
Add any other context about the problem here.

Marak/colors.js#285

jan-molak added a commit to serenity-js/serenity-js that referenced this issue Jan 10, 2022
Malicious code introduced in colors.js v1.4.1 and 1.4.2 causes all versions of Cucumber.js to fall
into an infinite loop; to avoid the issue, projects consuming Cucumber.js should specify an explicit
dependency on colors 1.4.0 until cucumber/cucumber-js#1885 is addressed. For more information, see
@kevin-s-wang
Copy link

Due to this incidence, it should raise our concerns of using third-party libraries. Perhaps, a viable and preferable way is to lock down the versions of the dependencies, especially for those being widely used.

@davidjgoss
Copy link
Contributor

An update:

  • We've release new versions on the current release streams that pin to the (safe) v1.4.0 of colors
    • 8.0.0-rc.2
    • 7.3.2 (best for most people)
  • npm seems to have pulled the offending versions of colors from the registry

So I think the immediate work needed is done, between all of that. I've opened #1888 to deal with switching to chalk.

Thanks again @mannyluvstacos for submitting the critical fix!

@mattwynne
Copy link
Member

Yes, big thanks @mannyluvstacos!

jan-molak added a commit to serenity-js/serenity-js that referenced this issue Jan 28, 2022
…sue has now been addressed

Offending versions of colors.js have been removed from npmjs.com

Closes cucumber/cucumber-js#1885
@davidjgoss davidjgoss mentioned this issue Mar 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants