potential security vulnerability via an outdated version of static-module@1.5.0 > static-eval@0.2.4 #19

Activity

1. etpinard commented on Feb 21, 2018

   

   etpinard

   on Feb 21, 2018

   Contributor

   More actions

   Unfortunately, bumping static-module to the unvulnerable 2.x series won't be trivial.

   Changes from PRs browserify/static-eval#18 and browserify/static-module#38 appear to be incompatible with cwise.

   From my findings, static-module fails (i.e. does not transform cwise({args: [], body: () => {}}) expressions) whenever body() mutates one if its input arguments.

   For example, with

   // cmd.js
   var fs = require('fs')
   var sm = require('./lib/cwise-transform')()
   
   process.stdin.pipe(sm).pipe(process.stdout)

   // works.js
   var cwise = require('cwise')
   var f = cwise({
     args: ["array"],
     body: function() {
         return 'yo'
     },
   })

   // fails.js
   var cwise = require('cwise')
   var f = cwise({
     args: ["array"],
     body: function(a) {
         ++a
     },
   })

   then, node cmd.js < works.js works just fine (but doesn't do anything 😏 ), and node cmd.js < fails.js outputs:

   
   var f = cwise({
     args: ["array"],
     body: function(a) {
         ++a
     }
   })
   

   that is, it correctly removes the require statement, but ignores the cwise call.
3. michal-rad commented on Feb 27, 2018

   

   michal-rad

   on Feb 27, 2018

   More actions

   +1

   👍React with 👍1Reacted by Zakariaa Oulhafiane
4. etpinard commented on Mar 5, 2018

   

   etpinard

   on Mar 5, 2018

   Contributor

   More actions

   @alhugot I believe your patch in https://github.com/alhugot/cwise/commit/39b4ad8a1c67d94903bdc139e59bc764e59bad6f defeats the purpose of browserify suite where cwise is used as a transform.

   To double-check, would you mind comparing the output of browserify -t cwise test/fill.js using old and new static-module versions?
7. etpinard commented on Mar 5, 2018

   

   etpinard

   on Mar 5, 2018

   Contributor

   More actions

   . Sorry a bit slow on this one.

   No worries. Thanks for the help!
8. dutscher commented on Mar 9, 2018

   

   dutscher

   on Mar 9, 2018

   More actions

   +1

   👍React with 👍1Reacted by Zakariaa Oulhafiane
9. hakandilek commented on May 30, 2018

   

   hakandilek

   on May 30, 2018

   More actions

   @etpinard browserify -t cwise test/fill.js outputs are the same with static-module@2.2.5
10. etpinard commented on May 30, 2018

    

    etpinard

    on May 30, 2018

    Contributor

    More actions

    @hakandilek thanks for the headsup, but npm test fails for me with static-module@2.2.5.
11. hakandilek commented on May 30, 2018

    

    hakandilek

    on May 30, 2018 via email

    More actions

    What's the reason? Check out my linked pull request. I've integrated Travis ci also for the actual nodejs versions.

    …

    On Wed, 30 May 2018, 17:44 Étienne Tétreault-Pinard, < ***@***.***> wrote: @hakandilek <https://github.com/hakandilek> thanks for the headsup, but npm test fails for me with ***@***.*** — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#19 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABBdWf3KaUh7_bwyNR-hvHwpcEnxsTS3ks5t3r5jgaJpZM4SMRVS> .
12. etpinard commented on May 30, 2018

    

    etpinard

    on May 30, 2018

    Contributor

    More actions

    Check out my linked pull request.

    Ha. Sorry I missed that. Thanks for the PR.
13. srinivasrk commented on Jun 22, 2018

    

    srinivasrk

    on Jun 22, 2018

    More actions

    any update on this issue ?

    👍React with 👍15Reacted by Matthias John, Michael Turkeev, giichiro.sasaki, Ryan Guill, Jared McKimm, Johnny Edwards, Yutaka Takeda, AJ Raczkowski, Steffen, Tony Wieser (previously Microsoft Research) and 5 more
14. elf-mouse commented on Feb 28, 2019

    

    elf-mouse

    on Feb 28, 2019

    More actions

    potential security vulnerability +1

    👍React with 👍3Reacted by Stanley Yuan, Patrick Cate and Zakariaa Oulhafiane
15. k-sai-kiranmayee commented on Sep 25, 2019

    

    k-sai-kiranmayee

    on Sep 25, 2019

    More actions

    Hello! Is there any update on this one...Is this #21 successfully merged?

    Thank you!