create-react-app 浏览器列表和glob-parent中的正则表达式拒绝服务漏洞,

neskvpey  于 5个月前  发布在  React
关注(0)|答案(3)|浏览(74)

在浏览器列表和glob-parent依赖中存在正则表达式拒绝服务漏洞。以下是npm审计安全报告的样式:

=== npm audit security report ===
                            
                                                Manual Review
                            Some vulnerabilities require your attention to resolve
                            
                            Visit https://go.npm.me/audit-guide for additional guidance
                            Moderate Regular Expression Denial of Service
                            
                            Package browserslist
                            
                            Patched in >=4.16.5
                            
                            Dependency of react-scripts
                            
                            Path react-scripts > react-dev-utils > browserslist
                            
                            More info https://npmjs.com/advisories/1747
                            
                            Moderate Regular expression denial of service
                            
                            Package glob-parent
                            
                            Patched in >=5.1.2
                            
                            Dependency of react-scripts
                            
                            Path react-scripts > webpack > watchpack > watchpack-chokidar2 >
                            chokidar > glob-parent
                            
                            More info https://npmjs.com/advisories/1751
                            
                            Moderate Regular expression denial of service
                            
                            Package glob-parent
                            
                            Patched in >=5.1.2
                            
                            Dependency of react-scripts
                            
                            Path react-scripts > webpack-dev-server > chokidar > glob-parent
                            
                            More info https://npmjs.com/advisories/1751
                            
                            found 3 moderate severity vulnerabilities in 2498 scanned packages
                            3 vulnerabilities require manual review. See the full report for details.

这是依赖树:

1. devDependencies: react-scripts > react-dev-utils > browserslist
2. devDependencies: react-scripts > webpack > watchpack > watchpack-chokidar2 > chokidar > glob-parent
3. devDependencies: react-scripts > webpack-dev-server > chokidar > glob-parent

该漏洞已在browserslist版本>= 4.16.5(react-scripts中的当前版本:4.14.2)中修复。
该漏洞已在glob-parent版本> 5.1.2(react-scripts中的当前版本:5.1.2)中修复。
此外,您是否可以告知我们计划在react-scripts版本中修复这些漏洞的预计时间?

v1l68za4

v1l68za41#

also

react-scripts > webpack-dev-server > ansi-html

details here – webpack/webpack-dev-server#3801

dgiusagp

dgiusagp2#

这个问题已经被自动标记为过时,因为它没有任何最近的活动。如果没有发生任何进一步的活动,它将在5天后被关闭。

相关问题