[Snyk: High] Regular Expression Denial of Service (ReDoS) (due 1/15/2021)

[lbeaufort]

Regular Expression Denial of Service (ReDoS)
Vulnerable module: | ua-parser-js
Fixed in: | 0.7.23

Detailed paths and remediation
Introduced through: fec-cms@1.0.0 › ua-parser-js@0.7.22
Introduced through: fec-cms@1.0.0 › draft-js@0.11.7 › fbjs@2.0.0 › ua-parser-js@0.7.22

Remediation:
Upgrade to ua-parser-js@0.7.23

[rfultz]

We've run into issues with weaknesses in draft-js before and determined that it's less of a concern for us because it's only used inside the Wagtail editor, which requires editor account login. We could remove ua-parser-js from package.js but it's only being used by fbjs, which is used by draft-js, which is only used by draftail

@patphongs any preference between removing ua-parser-js from package.js and then closing/blocking this ticket, or just closing/blocking because having it in package doesn't affect anything else?

[patphongs]

@rfultz Let's remove the ua-parser-js package from our code. Then close this issue as this vulnerability is not a risk due to it being behind an authenticated system.

[lbeaufort]

@patphongs @rfultz FYI, this was still being flagged by Snyk, so I marked it as "not vulnerable" with the note
(From @rfultz)

We've run into issues with weaknesses in draft-js before and determined that it's less of a concern for us because it's only used inside the Wagtail editor, which requires editor account login

https://app.snyk.io/org/fecgov/project/2a97cddb-4b62-4d54-b18f-3b85d55a5e10/?fromGitHubAuth=true#issue-SNYK-JS-UAPARSERJS-1023599