security Issue with bl

[scenaristeur]

Hi, the new version npm tell me there is a security issue :

                   === npm audit security report ===                        
                                                                            
                                                                            
                             Manual Review                                  
         Some vulnerabilities require your attention to resolve             
                                                                            
      Visit https://go.npm.me/audit-guide for additional guidance           

Moderate Memory Exposure

Package bl

Patched in >=0.9.5 <1.0.0 || >=1.0.1

Dependency of level-sublevel

Path level-sublevel > levelup > bl

More info https://nodesecurity.io/advisories/596

[!] 1 vulnerability found - Packages audited: 498 (0 dev, 0 optional)
Severity: 1 Moderate

[dominictarr]

it depends on some stuff in an old version of level, which pulls in bl at an old version. I don't think it would actually be possible to exploit this vulnerability via level-sublevel, and doing the work to update (with tests passing) just to make a warning disappear isn't worth it (since I'm not writing new code that uses level-sublevel anymore) but if you care to make a PR I'd be happy to merge.

[aral]

@dominictarr Just out of curiosity, what are you using these days for the same functionality without level-sublevel as a dependency? :)

[aral]

Answering my own question from the previous comment: https://github.com/flumedb/

(See Level/community#14 (comment))

[dominictarr]

tl;dr is that flume is more flexible with respect to the index designs that can be used, and (also very important) it has much better support for upgrading indexes. For example, if you changed the encoding used in a index, you just bump the index version, and it automatically regenerates the index at startup.

[mkj28]

@dominictarr thanks for the writeup!

but we also got hit by this on vulnerability scans

[dominictarr]

as I said, I'd be happy to merge a PR that fixes this, but fixing this myself isn't worth my time just to remove a false positive from some security scan thing.