Security Vulnerability issue

[alejandro-serrano]

Hi,

We are getting the following security vulnerability issue in the plugin when performing a yarn audit:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Infinite loop in jpeg-js                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ jpeg-js                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.4.4                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ testcafe-browser-provider-browserstack                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ testcafe-browser-provider-browserstack > jimp > @jimp/types  │
│               │ > @jimp/jpeg > jpeg-js                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1075625                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

Further information can be found here:
GHSA-xvf7-4v9q-58w6

Thanks!

[AlexKamaev]

Thank you for pointing this out to us. It looks like the jimp module is not under active development, so the maintainer cannot merge the PRs that fix the issue:
jimp-dev/jimp#1090
jimp-dev/jimp#1093
We'll take a look at this problem as soon as possible and will find an appropriate solution.

[kukhariev]

testcafe-browser-provider-browserstack/src/backends/js-testing.js

Lines 114 to 119 in 9cfdb6f

	async takeScreenshot (id, screenshotPath) {
	var buffer = await requestApi(BROWSERSTACK_API_PATHS.screenshot(this.workers[id].id));
	var image = await jimp.read(buffer);
	await image.writeAsync(screenshotPath);
	}

What is the purpose of the jimp used here ?

! ok . sorted

[Aleksey28]

It reads and writes images. We are already working on this issue and we will resolve it as soon as possible.