Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Depends on vulnerable versions of three #244

Closed
RoopanV opened this issue Jul 23, 2021 · 5 comments · Fixed by #247
Closed

Depends on vulnerable versions of three #244

RoopanV opened this issue Jul 23, 2021 · 5 comments · Fixed by #247

Comments

@RoopanV
Copy link

RoopanV commented Jul 23, 2021

npm audit gives below error

three <0.125.0
Severity: high
Regular Expression Denial of Service - https://npmjs.com/advisories/1639
No fix available
node_modules/three
videojs-vr *
Depends on vulnerable versions of three
node_modules/videojs-vr

version installed "videojs-vr": "^1.8.0",
@promethyttrium
Copy link

found 11210 vulnerabilities (985 moderate, 10225 high) -- gives a deal of confidence...

@gkatsev
Copy link
Member

gkatsev commented Aug 26, 2021

I'm not seeing that many vulnerabilities. When running npm audit --production I'm seeing two, one for threejs and the other because the locally installed version of video.js has a potential vulnerability.

found 2 vulnerabilities (1 moderate, 1 high) in 31 scanned packages

Looking at the advisory, I'm not sure if it really applies here. We never call THREE.Color() directly.

Also, it seems like versions newer than the one that we use have removed some of the files that we depend upon and like means that updating is a non-trivial task. Unfortunately, we don't really have much bandwidth to look into this. If someone is able to take a look and figure out how to update things, we'd be incredibly grateful.

@gkatsev gkatsev mentioned this issue Aug 26, 2021
Merged
@gkatsev
Copy link
Member

gkatsev commented Aug 26, 2021

Decided most expedient way of fixing this is by vendoring the files. See #247
@RoopanV or @promethyttrium can you try out the PR and verify whether things continue working as expected for you?

gkatsev added a commit that referenced this issue Aug 31, 2021
@gkatsev
feat: vendor threejs files (#247)
6a76537 
Copy the example files we depended on from an older version of threejs into a vendor directory and apply the rollup replace pieces directly to it.
This allows us to update to a newer version of threejs so that npm audit --production no longer produces any issues. We can't upgrade to newer versions of threejs until we update our tooling and likely start transpiling threejs as well, because by default it starts including new JS features in the build files.

Fixes #244.
@gkatsev
Copy link
Member

gkatsev commented Aug 31, 2021

I've published this as 1.10.0. It's tagged next on npm. Please try it out and let me know if there are issues, thanks.

@andreas-venturini
Copy link

andreas-venturini commented Sep 17, 2021 •
edited
Loading

I tested this with a 360° video in equirectangular format, it works.

I noticed these warnings in the console - which might or might not be an issue for unrelated functionality of this plugin:

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: vendor threejs files videojs/videojs-vr
4 participants
@gkatsev @promethyttrium @andreas-venturini @RoopanV