uglify -c changes behavior of mdast code #751

tmcw · 2015-07-21T22:25:26Z

I've created a repo to reproduce this bug: https://github.com/tmcw/mdast-uglify-bug

For the mdast markdown library, the source succeeds when not uglified, and then, passed through uglify -c, its behavior changes and it breaks.

I'm trying to dig through the source, passed through uglify -c and then uglify -b, in order to track down the cause. It's quite a doozy

The text was updated successfully, but these errors were encountered:

wooorm · 2015-07-22T08:27:12Z

I fixed this in mdast (syntax-tree/mdast@1a4fc46), but I’m not sure that this was really my error.

It was basically a long list of logical AND-operators, followed by an expression which I needed the value of (rules[name].exec(value)). For some reason I did not get that value, but true.

mishoo · 2015-07-22T13:36:04Z

This looks like a bug. Thanks for the test repo, it helped isolating the problem. The simplest test case appears to be:

match = !x &&
    (!z || c) &&
    (!k || d) &&
    the_stuff();

compresses to:

match = !(x || z && !c || k && !d || !the_stuff());

which obviously loses the value returned from the_stuff(). Will investigate as soon as I can.

mishoo · 2015-07-22T13:56:49Z

Fix pushed.

tmcw · 2015-07-22T13:59:27Z

👍 awesome, thank you!

mishoo · 2015-07-22T13:59:51Z

I also published v2.4.24 to npm, since the issue appears to be pretty serious.

mishoo/UglifyJS#751 https://zyan.scripts.mit.edu/blog/backdooring-js/

reedloden · 2015-08-24T18:46:22Z

Requested a CVE assignment in http://seclists.org/oss-sec/2015/q3/351

diracdeltas · 2015-08-24T19:00:22Z

I'm the author of the blog post @reedloden linked above - just wanted to clarify a couple things:

I haven't found exploits in the wild for this bug.
The PoC's described in the blog post don't work with the current release of UglifyJS2. (Excellent job getting things fixed quickly, @mishoo!)
I suspect that it's not uncommon for minifiers, transpilers, and other js processors to accidentally change return values, which of course can lead to security problems.

Update grunt-contrib-uglify dependency to v0.9.2 in order to fix security issue fixed in uglify-js v2.4.24. mishoo/UglifyJS#751 https://zyan.scripts.mit.edu/blog/backdooring-js/

rvanvelzen · 2015-08-24T20:35:23Z

I suspect that it's not uncommon

Definitely. Most of the stuff that can bite you is behind --unsafe, but there's probably more to be found.

Based on the recommendations of [bundler-audit]: ``` ruby-advisory-db: 227 advisories Name: uglifier Version: 2.7.0 Advisory: OSVDB-126747 Criticality: Unknown URL: mishoo/UglifyJS#751 Title: uglifier incorrectly handles non-boolean comparisons during minification Solution: upgrade to >= 2.7.2 Unpatched versions found! ``` [bundler-audit]: https://rubygems.org/gems/bundler-audit

mishoo/UglifyJS#751

This fixes a security vulnerability. Details: lautis/uglifier#86 https://zyan.scripts.mit.edu/blog/backdooring-js/ https://nodesecurity.io/advisories/uglifyjs_incorrectly_handles_non-boolean_comparisons mishoo/UglifyJS#751

Resolves advisory 126747 mishoo/UglifyJS#751

Update grunt-contrib-uglify dependency to v0.9.2 in order to avoid a security issue fixed in uglify-js v2.4.24. mishoo/UglifyJS#751 https://zyan.scripts.mit.edu/blog/backdooring-js/ Closes gh-2556

Update grunt-contrib-uglify dependency to v0.9.2 in order to avoid a security issue fixed in uglify-js v2.4.24. mishoo/UglifyJS#751 https://zyan.scripts.mit.edu/blog/backdooring-js/ (cherry-picked from 835e921) Closes gh-2556

``` Name: uglifier Version: 2.7.1 Advisory: 126747 Criticality: Unknown URL: mishoo/UglifyJS#751 Title: uglifier incorrectly handles non-boolean comparisons during minification Solution: upgrade to >= 2.7.2 ```

Problem: [bundler-audit] returned this security warning: ``` Updating ruby-advisory-db ... From https://github.com/rubysec/ruby-advisory-db * branch master -> FETCH_HEAD Already up-to-date. ruby-advisory-db: 230 advisories Name: uglifier Version: 2.7.1 Advisory: OSVDB-126747 Criticality: Unknown URL: mishoo/UglifyJS#751 Title: uglifier incorrectly handles non-boolean comparisons during minification Solution: upgrade to >= 2.7.2 Unpatched versions found! ``` [bundler-audit]: https://github.com/rubysec/bundler-audit Solution: Upgrade `bundle update uglifier`

Update gem uglifier to >= 2.7.2 to address security alert for affected versions prior to 2.7.2 Sources: lautis/uglifier#86 https://zyan.scripts.mit.edu/blog/backdooring-js/ https://nodesecurity.io/advisories/uglifyjs_incorrectly_handles_non-boolean_comparisons mishoo/UglifyJS#751

Based on the recommendations of [bundler-audit]: ``` ruby-advisory-db: 227 advisories Name: uglifier Version: 2.7.0 Advisory: OSVDB-126747 Criticality: Unknown URL: mishoo/UglifyJS#751 Title: uglifier incorrectly handles non-boolean comparisons during minification Solution: upgrade to >= 2.7.2 Unpatched versions found! ``` [bundler-audit]: https://rubygems.org/gems/bundler-audit

Update gem uglifier to >= 2.7.2 to address security alert for affected versions prior to 2.7.2 Sources: lautis/uglifier#86 https://zyan.scripts.mit.edu/blog/backdooring-js/ https://nodesecurity.io/advisories/uglifyjs_incorrectly_handles_non-boolean_comparisons mishoo/UglifyJS#751

tmcw mentioned this issue Jul 21, 2015

uglify breaks mdast remarkjs/remark#41

Closed

mishoo closed this as completed in 905b601 Jul 22, 2015

reedloden added a commit to reedloden/webpack that referenced this issue Aug 24, 2015

Update uglify-js dependency to v2.4.24

4f05b20

mishoo/UglifyJS#751 https://zyan.scripts.mit.edu/blog/backdooring-js/

reedloden mentioned this issue Aug 24, 2015

Update uglify-js dependency to v2.4.24 webpack/webpack#1388

Merged

reedloden mentioned this issue Aug 24, 2015

Build: Update grunt-contrib-uglify for security issue in uglify-js jquery/jquery#2556

Closed

reedloden mentioned this issue Aug 24, 2015

Update UglifyJS to 2.4.24 lautis/uglifier#86

Merged

JamesMGreene mentioned this issue Aug 25, 2015

Security: Update UglifyJS to the latest version zeroclipboard/zeroclipboard#604

Closed

reedloden mentioned this issue Aug 26, 2015

Adding OSVDB-126747 for uglifier rubysec/ruby-advisory-db#202

Merged

jordimassaguerpla mentioned this issue Aug 27, 2015

update uglifier gem for fixing a security issue (OSVDB-126747) SUSE/Portus#292

Merged

notalex added a commit to blackducksoftware/ohloh-ui that referenced this issue Aug 28, 2015

Fix uglifier vulnerability issue

4da0645

mishoo/UglifyJS#751

notalex mentioned this issue Aug 28, 2015

Fix uglifier vulnerability issue blackducksoftware/ohloh-ui#633

Merged

elliotcm added a commit to alphagov/trade-tariff-frontend that referenced this issue Sep 2, 2015

Upgrade uglifier.

7b015ba

Resolves advisory 126747 mishoo/UglifyJS#751

dylangrafmyre mentioned this issue Sep 15, 2015

Address security alert for gem uglifier shakacode/react_on_rails#25

Merged

mend-bolt-for-github bot mentioned this issue Apr 8, 2021

WS-2015-0033 (High) detected in uglify-js-2.2.5.tgz - autoclosed VeeVee450/swiper-website#33

Closed

mend-for-github-com bot mentioned this issue May 6, 2021

WS-2015-0033 (High) detected in uglify-js-1.3.2.tgz, uglifier-1.2.3.gem Reid-Turner/Practice#15

Open

mend-bolt-for-github bot mentioned this issue May 18, 2021

WS-2015-0033 (High) detected in uglify-js-2.2.5.tgz hholder/simple-survey-server#10

Open

mend-bolt-for-github bot mentioned this issue Jun 2, 2021

WS-2015-0033 (High) detected in uglify-js-1.3.5.tgz - autoclosed dreamboy9/ofbiz#26

Closed

mend-for-github-com bot mentioned this issue Jun 6, 2021

WS-2015-0033 (High) detected in uglify-js-2.4.19.tgz samq-starkcorp/IdentityServer4#10

Open

This was referenced Jun 8, 2021

WS-2015-0033 (High) detected in uglify-js-2.2.5.tgz - autoclosed vipinsun/cactus#118

Closed

WS-2015-0033 (High) detected in uglify-js-2.4.13.tgz - autoclosed S69y/S69y#36

Closed

mend-bolt-for-github bot mentioned this issue Jun 30, 2021

WS-2015-0033 (High) detected in uglify-js-1.3.3.tgz samuelteixeiras/caite#25

Open

mend-for-github-com bot mentioned this issue Jul 13, 2021

WS-2015-0033 (High) detected in uglify-js-2.3.6.tgz harrinry/fetch#28

Open

mend-bolt-for-github bot mentioned this issue Aug 3, 2021

WS-2015-0033 (High) detected in uglifier-1.3.0.gem - autoclosed Kijacode/dotfiles#83

Closed

mend-for-github-com bot mentioned this issue Aug 11, 2021

WS-2015-0033 (High) detected in uglify-js-2.2.5.tgz harrinry/SkinnyJS#36

Open

This was referenced Aug 12, 2021

WS-2015-0033 (High) detected in uglify-js-1.0.7.tgz - autoclosed turkdevops/brackets#79

Closed

WS-2015-0033 (High) detected in uglify-js-2.2.5.tgz, uglify-js-1.0.7.tgz - autoclosed turkdevops/brackets#80

Closed

This was referenced Aug 19, 2021

WS-2015-0033 (High) detected in uglify-js-2.4.19.tgz - autoclosed Tim-Demo/IdentityServer4#11

Closed

WS-2015-0033 (High) detected in uglify-js-2.2.5.tgz Pio1006/angular.js#62

Open

mend-bolt-for-github bot mentioned this issue Aug 25, 2021

WS-2015-0033 (High) detected in multiple libraries - autoclosed MidnightBSD/midnightbsd-app-store#127

Closed

mend-for-github-com bot mentioned this issue Aug 25, 2021

WS-2015-0033 (High) detected in uglify-js-2.3.6.tgz Pio1006/selectize.js#72

Open

mend-bolt-for-github bot mentioned this issue Aug 30, 2021

WS-2015-0033 (High) detected in uglify-js-2.3.6.tgz valdisiljuconoks/localization-provider-opti#130

Closed

mend-for-github-com bot mentioned this issue Nov 2, 2021

WS-2015-0033 (High) detected in uglify-js-2.4.19.tgz - autoclosed lukebrogan-mend/IdentityServer4#25

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

uglify -c changes behavior of mdast code #751

uglify -c changes behavior of mdast code #751

tmcw commented Jul 21, 2015

wooorm commented Jul 22, 2015

mishoo commented Jul 22, 2015

mishoo commented Jul 22, 2015

tmcw commented Jul 22, 2015

mishoo commented Jul 22, 2015

reedloden commented Aug 24, 2015

diracdeltas commented Aug 24, 2015

rvanvelzen commented Aug 24, 2015

uglify -c changes behavior of mdast code #751

uglify -c changes behavior of mdast code #751

Comments

tmcw commented Jul 21, 2015

wooorm commented Jul 22, 2015

mishoo commented Jul 22, 2015

mishoo commented Jul 22, 2015

tmcw commented Jul 22, 2015

mishoo commented Jul 22, 2015

reedloden commented Aug 24, 2015

diracdeltas commented Aug 24, 2015

rvanvelzen commented Aug 24, 2015