Javascript-node & universal: Update 'ansi-regex' due to CVE-2021-3807 (#246)

* patch

* add check

* Patch for universal

* patch javascript-node

* update check-version-ge

* patch universal

* update manifest

* nit

* update: javascript

* update universal

* update test

* check without --save

* debug

* remove debug

* add checks

* Remove unwanted check!

* remove unwanted checks

* Update install.sh

* Update install.sh

* remove unwanted changes

Author: samruddhikhandale

src/javascript-node/.devcontainer/library-scripts/add-patch.sh

@@ -2,8 +2,9 @@
 
 IMAGE_VARIANT=$1
 
-# Temporary: Upgrade 'decode-uri-component' due to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900
-# 'decode-uri-component' is installed by the base image (node) for `node:14` which does not have the patch.
+# Temporary: These packages are installed by the base image (node) for `node:14` which does not have the patch.
+# Upgrade 'decode-uri-component' due to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900
+# Upgrade 'ansi-regex ' due to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3807
 if [[ "${IMAGE_VARIANT}" =~ "14" ]] ; then
     cd /usr/local/lib/node_modules/npm
     npm update --save

src/universal/.devcontainer/local-features/setup-user/install.sh

@@ -22,9 +22,11 @@ export DEBIAN_FRONTEND=noninteractive
 
 # Temporary: Upgrade NPM packages due to mentioned CVEs.
 # decode-uri-component: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900
-NPM_PACKAGES_LIST="decode-uri-component"
+# ansi-regex: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3807
+NPM_PACKAGES_LIST="decode-uri-component
+    ansi-regex"
 
-cd /usr/local/share/nvm/versions/node/v14.21.1/lib/node_modules/npm
+cd /usr/local/share/nvm/versions/node/v14*/lib/node_modules/npm
 npm install ${NPM_PACKAGES_LIST}
 
 # Enables the oryx tool to generate manifest-dir which is needed for running the postcreate tool

src/universal/test-project/test.sh

@@ -174,6 +174,9 @@ cd /usr/local/share/nvm/versions/node/v14.21.1/lib/node_modules/npm
 decodeVersion=$(npm ls --depth 1 --json | jq -r '.dependencies."decode-uri-component".version')
 check-version-ge "decode-uri-component" "${decodeVersion}" "0.2.1"
 
+ansiVersion=$(npm ls --depth 1 --json | jq -r '.dependencies."ansi-regex".version')
+check-version-ge "ansi-regex" "${ansiVersion}" "6.0.0"
+
 ls -la /home/codespace
 
 # Report result