Fix audits (#321)

.vscode/settings.json

@@ -2,7 +2,7 @@
   "editor.defaultFormatter": "esbenp.prettier-vscode",
   "editor.formatOnSave": true,
   "editor.codeActionsOnSave": {
-    "source.fixAll": true
+    "source.fixAll": "explicit"
   },
   "typescript.tsdk": "node_modules/typescript/lib",
   "search.exclude": {

package.json

@@ -77,7 +77,7 @@
     "@typescript-eslint/parser": "^5.48.2",
     "audit-types": "^0.5.6",
     "c8": "^7.12.0",
-    "chai": "^4.3.7",
+    "chai": "^4.3.10",
     "concurrently": "^7.6.0",
     "eslint": "^8.32.0",
     "eslint-config-prettier": "^8.6.0",
@@ -91,4 +91,4 @@
     "tsup": "^6.5.0",
     "typescript": "^4.9.4"
   }
-}
+}

test/npm-auditer.spec.ts

@@ -79,8 +79,8 @@ describe("npm-auditer", () => {
     expect(summary).to.eql(
       summaryWithDefault({
         failedLevelsFound: ["high"],
-        advisoriesFound: ["GHSA-38f5-ghc2-fcmv"],
-        advisoryPathsFound: ["GHSA-38f5-ghc2-fcmv|cryo"],
+        advisoriesFound: ["GHSA-hrpp-h998-j3pp"],
+        advisoryPathsFound: ["GHSA-hrpp-h998-j3pp|qs"],
       })
     );
   });

test/npm-high/npm-output.json

@@ -1,58 +1,60 @@
 {
   "actions": [
     {
-      "action": "review",
-      "module": "cryo",
+      "isMajor": false,
+      "action": "install",
       "resolves": [
         {
-          "id": 1066151,
-          "path": "cryo",
+          "id": 1094102,
+          "path": "qs",
           "dev": false,
-          "bundled": false,
-          "optional": false
+          "optional": false,
+          "bundled": false
         }
-      ]
+      ],
+      "module": "qs",
+      "target": "6.11.2"
     }
   ],
   "advisories": {
-    "1066151": {
+    "1094102": {
       "findings": [
         {
-          "version": "0.0.6",
+          "version": "6.10.2",
           "paths": [
-            "cryo"
+            "qs"
           ]
         }
       ],
       "metadata": null,
-      "vulnerable_versions": "<=0.0.6",
-      "module_name": "cryo",
+      "vulnerable_versions": ">=6.10.0 <6.10.3",
+      "module_name": "qs",
       "severity": "high",
-      "github_advisory_id": "GHSA-38f5-ghc2-fcmv",
+      "github_advisory_id": "GHSA-hrpp-h998-j3pp",
       "cves": [
-        "CVE-2018-3784"
+        "CVE-2022-24999"
       ],
       "access": "public",
-      "patched_versions": "<0.0.0",
+      "patched_versions": ">=6.10.3",
       "cvss": {
-        "score": 0,
-        "vectorString": null
+        "score": 7.5,
+        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
       },
-      "updated": "2020-08-31T18:32:59.000Z",
-      "recommendation": "None",
+      "updated": "2023-09-21T22:11:38.000Z",
+      "recommendation": "Upgrade to version 6.10.3 or later",
       "cwe": [
-        "CWE-94"
+        "CWE-1321"
       ],
       "found_by": null,
       "deleted": null,
-      "id": 1066151,
-      "references": "- https://nvd.nist.gov/vuln/detail/CVE-2018-3784\n- https://hackerone.com/reports/350418\n- https://github.com/advisories/GHSA-38f5-ghc2-fcmv\n- https://www.npmjs.com/advisories/690",
-      "created": "2022-03-11T08:00:43.889Z",
+      "id": 1094102,
+      "references": "- https://nvd.nist.gov/vuln/detail/CVE-2022-24999\n- https://github.com/ljharb/qs/pull/428\n- https://github.com/n8tz/CVE-2022-24999\n- https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ec\n- https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68\n- https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1b\n- https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2d\n- https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1\n- https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105\n- https://github.com/ljharb/qs/commit/ed0f5dcbef4b168a8ae299d78b1e4a2e9b1baf1f\n- https://github.com/ljharb/qs/commit/f945393cfe442fe8c6e62b4156fd35452c0686ee\n- https://github.com/ljharb/qs/commit/fc3682776670524a42e19709ec4a8138d0d7afda\n- https://github.com/expressjs/express/releases/tag/4.17.3\n- https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html\n- https://github.com/advisories/GHSA-hrpp-h998-j3pp",
+      "created": "2022-11-27T00:30:50.000Z",
       "reported_by": null,
-      "title": "Code Injection in cryo",
+      "title": "qs vulnerable to Prototype Pollution",
       "npm_advisory_id": null,
-      "overview": "All versions of `cryo` are vulnerable to code injection due to an Insecure implementation of deserialization.\n\n\n## Proof of concept\n\n```\nvar Cryo = require('cryo');\nvar frozen = '{\"root\":\"_CRYO_REF_3\",\"references\":[{\"contents\":{},\"value\":\"_CRYO_FUNCTION_function () {console.log(\\\\\"defconrussia\\\\\"); return 1111;}\"},{\"contents\":{},\"value\":\"_CRYO_FUNCTION_function () {console.log(\\\\\"defconrussia\\\\\");return 2222;}\"},{\"contents\":{\"toString\":\"_CRYO_REF_0\",\"valueOf\":\"_CRYO_REF_1\"},\"value\":\"_CRYO_OBJECT_\"},{\"contents\":{\"__proto__\":\"_CRYO_REF_2\"},\"value\":\"_CRYO_OBJECT_\"}]}'\nvar hydrated = Cryo.parse(frozen);\nconsole.log(hydrated);\n```\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.",
-      "url": "https://github.com/advisories/GHSA-38f5-ghc2-fcmv"
+      "overview": "qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.",
+      "url": "https://github.com/advisories/GHSA-hrpp-h998-j3pp"
     }
   },
   "muted": [],
@@ -64,10 +66,10 @@
       "high": 1,
       "critical": 0
     },
-    "dependencies": 1,
+    "dependencies": 9,
     "devDependencies": 0,
     "optionalDependencies": 0,
-    "totalDependencies": 1
+    "totalDependencies": 9
   },
-  "runId": "0711adfe-fc4e-4a94-80fc-e518c13a63d2"
+  "runId": "fe0d72f1-1fb6-4fb2-aa42-246a60c3950a"
 }