nsp advises prototype pollution attack vulnerability in the `hoek` dependency

[eddieajau]

[READ] Step 1: Are you in the right place?

Yes

[REQUIRED] Step 2: Describe your environment

• Operating System version: OSX 10.12.6
• Firebase SDK version: 5.9.0
• Library version: ??
• Firebase Product: ??

[REQUIRED] Step 3: Describe the problem

nsp alerts a Prototype pollution attack vulnerability in the hoek dependency.

See https://nodesecurity.io/advisories/566

Steps to reproduce:

npm i -g nsp 
nsp check

Name | hoek
Installed | 2.16.3 
Vulnerable | <= 4.2.0 || >= 5.0.0 < 5.0.3 
Patched | > 4.2.0 < 5.0.0 || >= 5.0.3     
Path | firebase-admin@5.9.0 > @google-cloud/firestore@0.11.2 > google-gax@0.14.5 > grpc@1.7.3 > node-pre-gyp@0.6.39 > hawk@3.1.3 > hoek@2.… 

Relevant Code:

package.json

[google-oss-bot]

Hey there! I couldn't figure out what this issue is about, so I've labeled it for a human to triage. Hang tight.

[hiranya911]

Cannot fix this at this level, since the dependency is coming through Firestore/gRPC. We are already using the latest available versions of those dependencies:

firebase-admin@5.11.0 /usr/local/google/home/hkj/Projects/firebase-admin-node/public
├─┬ @google-cloud/firestore@0.13.0
│ └─┬ @google-cloud/common-grpc@0.6.0
│   └─┬ grpc@1.9.1
│     └─┬ node-pre-gyp@0.6.39
│       └─┬ hawk@3.1.3
│         ├─┬ boom@2.10.1
│         │ └── hoek@2.16.3  deduped
│         ├── hoek@2.16.3 
│         └─┬ sntp@1.0.9
│           └── hoek@2.16.3

I'd recommend reporting this at https://github.com/grpc/grpc-node. They can probably fix this by simply bumping their hawk dependency to something more recent.

[yoiang]

It looks like gRPC has updated to resolve this issue, so are @google-cloud/common-grpc and @google-cloud/firestore the last two culprits before firebase-admin-node can be updated?

Would it be useful to keep this issue open until it is resolved?

[TeaSeaLancs]

@yoiang It looks like the dependencies listed above are now solved?