chore: fix security vulnerabilities by hurali97 · Pull Request #48532 · Expensify/App

hurali97 · 2024-09-04T09:11:20Z

Details

This PR fixes the security issues as reported by npm audit. More details in the linked issue.

Fixed Issues

$ #48327
PROPOSAL: #48327

Tests

Verify that no errors appear in the JS console

Testing Steps:

Verify the general usage of the app doesn't break

Offline tests

QA Steps

Verify that no errors appear in the JS console

PR Author Checklist

Screenshots/Videos

Android: Native

Screen.Recording.2024-09-04.at.1.33.38.PM.mov

Android: mWeb Chrome

Screen.Recording.2024-09-04.at.1.50.22.PM.mov

iOS: Native

Screen.Recording.2024-09-04.at.1.32.33.PM.mov

iOS: mWeb Safari

Screen.Recording.2024-09-04.at.1.50.39.PM.mov

MacOS: Chrome / Safari

Screen.Recording.2024-09-04.at.1.53.09.PM.mov

MacOS: Desktop

Screen.Recording.2024-09-04.at.1.56.54.PM.mov

…y-App into hur/chore/fix-security-vulnerabilities

hurali97 · 2024-09-05T08:46:34Z

package.json

    "react-native-web-sound": "^0.1.3",
    "react-native-webview": "13.8.6",
-    "react-pdf": "^7.7.3",
+    "react-pdf": "9.1.0",


We can keep or discard the changes related to pdf. The reason is that here we already have a tracker to update react-pdf. If we decide to keep the changes, the linked issue probably won't have any affect because it will be deployed in the newer versions, so they can do a bump whenever that issue is fixed.

Once that happens we will have to update react-fast-pdf as well because it depends on react-pdf and we no longer have pdfjs-dist/legacy/build instead we have pdfjs-dist/build. This is also explained in the issue here. I have added a patch for react-fast-pdf in this PR thinking that we can first get this PR merged with the patch and then follow up on react-fast-pdf by fixing the issue there and bumping and removing the patch in Expensify App.

Edit: We do have pdfjs-dist/legacy/build but we have .mjs instead of .js, so we still have to update react-fast-pdf. I missed it the first time but now I have updated this PR to include legacy build of pdfjs-dist just like we have in main.

melvin-bot · 2024-09-06T08:38:45Z

@hungvu193 Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

hungvu193 · 2024-09-06T09:19:27Z

package.json

+    "braces": "3.0.3",
+    "yargs": "17.7.2",
+    "yargs-parser": "21.1.1",
+    "@expo/config-plugins": "8.0.4",
+    "ws": "8.17.1",
+    "react-pdf": "9.1.0",
+    "micromatch": "4.0.8",
+    "json5": "2.2.2",
+    "loader-utils": "2.0.4",
+    "follow-redirects": "1.15.6",
+    "fast-xml-parser": "4.4.1",
+    "express": "4.19.2",
+    "elliptic": "6.5.7",
+    "fast-json-patch": "3.1.1",
+    "webpack": "^5.94.0",
+    "@blakeembrey/template": "1.2.0"


May I know why do we need to add these libs?

@hungvu193 These libraries are transitive dependencies. Which means they are already installed in our project. We are just updating them here and nothing more.

Why do we need to update is explained in the linked issue but TL:DR is to fix the security vulnerabilities in these libraries.

hungvu193 · 2024-09-09T07:44:47Z

Nice

hungvu193 · 2024-09-09T09:23:03Z

When I tried to upload pdf on mSafari, I got this crash, Can you take a look @hurali97 ?

Screen.Recording.2024-09-09.at.16.21.00.mov

…crashes after selecting to upload

hurali97 · 2024-09-09T11:58:25Z

When I tried to upload pdf on mSafari, I got this crash, Can you take a look @hurali97 ?

Screen.Recording.2024-09-09.at.16.21.00.mov

@hungvu193 So it was happening because of a missing polyfill for Promise.withResolvers. Since this polyfill is available via corejs and we have it installed already, so it's just a matter of importing it. Here's this solution shared in the issues of react-pdf.

I have pushed a commit which fixes this.

Screen.Recording.2024-09-09.at.4.49.16.PM.mov

hungvu193 · 2024-09-10T06:37:16Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified tests pass on all platforms & I tested again on:
- Android: Native
- Android: mWeb Chrome
- iOS: Native
- iOS: mWeb Safari
- MacOS: Chrome / Safari
- MacOS: Desktop
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified proper code patterns were followed (see Reviewing the code)
- I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick).
- I verified that the left part of a conditional rendering a React component is a boolean and NOT a string, e.g. myBool && <MyComponent />.
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text shown in the product is localized by adding it to src/languages/* files and using the translation method
- I verified all numbers, amounts, dates and phone numbers shown in the product are using the localization methods
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
- I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
- I verified the JSDocs style guidelines (in STYLE.md) were followed
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately and each prop has a /** comment above it */
- The file is named correctly
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
- Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
- All JSX used for rendering exists in the render method
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If any new file was added I verified that:
- The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If a new page is added, I verified it's using the ScrollView component to make it scrollable when more elements are added to the page.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: Native

Android.mov

Android: mWeb Chrome

Screen.Recording.2024-09-10.at.13.40.12.mov

iOS: Native

IOS.mov

iOS: mWeb Safari

ios.safari.mov

MacOS: Chrome / Safari

Web.chrome.mov

MacOS: Desktop

Desktop.mov

hungvu193

LGTM

melvin-bot · 2024-09-10T06:37:40Z

We did not find an internal engineer to review this PR, trying to assign a random engineer to #48327 as well as to this PR... Please reach out for help on Slack if no one gets assigned!

hungvu193 · 2024-09-11T02:40:25Z

@hurali97 We have conflicts here

…y-App into hur/chore/fix-security-vulnerabilities

hungvu193 · 2024-09-11T07:57:11Z

@grgia this PR is ready for your review!

hurali97 · 2024-09-11T09:24:55Z

@hungvu193 After pulling in the latest main, I see 28 vulnerabilities added. Should we fix those in this PR or leave as is?

hungvu193 · 2024-09-11T09:28:39Z

Hmm I think Yes

hurali97 · 2024-09-11T09:35:32Z

@hungvu193 so I have it fixed now, below is the diff:

diff --git a/package.json b/package.json
index 3f685cc1efe..c636a18aaf8 100644
--- a/package.json
+++ b/package.json
@@ -345,11 +345,14 @@
     "loader-utils": "2.0.4",
     "follow-redirects": "1.15.6",
     "fast-xml-parser": "4.4.1",
-    "express": "4.19.2",
+    "express": "4.20.0",
     "elliptic": "6.5.7",
     "fast-json-patch": "3.1.1",
     "webpack": "^5.94.0",
-    "@blakeembrey/template": "1.2.0"
+    "@blakeembrey/template": "1.2.0",
+    "body-parser": "1.20.3",
+    "path-to-regexp": "0.1.10",
+    "send": "0.19.0"
   },
   "expo": {
     "autolinking": {

I will push it shortly 👍

hungvu193 · 2024-09-11T09:36:30Z

Thanks for your quick work 🚀

hurali97 · 2024-09-12T08:01:49Z

@hungvu193 After pulling in the latest main CI and local both are failing because of:

I don't see any changes in my PR which could affect this, so I am looping in @kirillzyusko as I see some commits from him in the history for react-compiler-healthcheck. @kirillzyusko could you maybe know why this could be happening? I have tried removing node_modules and re-installing but the error persists.

kirillzyusko · 2024-09-12T08:25:04Z

@hurali97 have you tried to lock the version, i. e. change ^0.0.0-experimental-ab3118d-20240725 -> 0.0.0-experimental-ab3118d-20240725 in package.json? And reinstall node_modules?

hurali97 · 2024-09-12T08:33:21Z

@hurali97 have you tried to lock the version, i. e. change ^0.0.0-experimental-ab3118d-20240725 -> 0.0.0-experimental-ab3118d-20240725 in package.json? And reinstall node_modules?

Yeah did that but no luck. The error says that the patch is for the previous version then the one installed. Which means that we maybe missed updating the patch to target this newer version?

Failed to apply patch file react-compiler-healthcheck+0.0.0-experimental-b130d5f-20240625+001+initial.patch.

From git history,

kirillzyusko · 2024-09-12T09:47:13Z

@hurali97 there wasn't a difference between 0625 and 0725 versions, so the patch still could be applied successfully.

I tend to think that the reason why it fails is because you have this lock file content:

    "node_modules/react-compiler-healthcheck": {
      "version": "0.0.0",
      "resolved": "https://registry.npmjs.org/react-compiler-healthcheck/-/react-compiler-healthcheck-0.0.0.tgz",
      "integrity": "sha512-b+WqemUSkGcAag7+xEEl/pVCULXnP8tWsZsqDx8MgCETkaC+yxPzOwpsScVkTiRJ/Z75e+xdAa9W67S/hx6dSw==",
      "dev": true
    },

While expected content is:

"node_modules/react-compiler-healthcheck": {
      "version": "0.0.0-experimental-b130d5f-20240625",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@babel/core": "^7.24.4",
        "@babel/parser": "^7.24.4",
        "chalk": "4",
        "fast-glob": "^3.3.2",
        "ora": "5.4.1",
        "yargs": "^17.7.2",
        "zod": "^3.22.4",
        "zod-validation-error": "^3.0.3"
      },
      "bin": {
        "react-compiler-healthcheck": "dist/index.js"
      },
      "engines": {
        "node": "^14.17.0 || ^16.0.0 || >= 18.0.0"
      }
    },

So you installed the first published version 0.0.0 while we use slightly more latest versions.

hurali97 · 2024-09-12T10:59:47Z

@kirillzyusko Oh man ! Thanks I will check this out 🚀

…y-App into hur/chore/fix-security-vulnerabilities

hurali97 · 2024-09-13T10:55:46Z

@hungvu193 All is green now.

hungvu193

All yours @grgia

hungvu193 · 2024-09-17T08:16:44Z

Can you merge main please? @hurali97 😄

…y-vulnerabilities # Conflicts: # package-lock.json

OSBotify · 2024-09-17T13:23:24Z

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

OSBotify · 2024-09-17T20:51:42Z

🚀 Deployed to staging by https://github.com/grgia in version: 9.0.37-0 🚀

platform	result
🤖 android 🤖	success ✅
🖥 desktop 🖥	success ✅
🍎 iOS 🍎	success ✅
🕸 web 🕸	success ✅

m-natarajan · 2024-09-17T21:47:04Z

@hungvu193 Can you please share the QA steps for this or full regression suite is enough for this which we normally do

hungvu193 · 2024-09-18T03:16:11Z

@m-natarajan Sure.
Regression test:

Go to any chat.
Click Plus button => Add Attachment => Choose any pdf.
Verify that you can preview that pdf. Click Send.
Verify that you send the pdf without any issue.
Send a few other pdf files then click on one of the pdf to view the pdf.
Press the left and right arrow to switch between pdf files.
Verify you can switch between pdf files.

OSBotify · 2024-09-19T23:33:30Z

🚀 Deployed to production by https://github.com/grgia in version: 9.0.38-4 🚀

platform	result
🤖 android 🤖	success ✅
🖥 desktop 🖥	success ✅
🍎 iOS 🍎	success ✅
🕸 web 🕸	success ✅

allgandalf · 2024-12-12T09:22:01Z

src/components/PDFThumbnail/index.tsx

-import pdfWorkerSource from 'pdfjs-dist/legacy/build/pdf.worker';
+import 'core-js/proposals/promise-with-resolvers';
+// eslint-disable-next-line import/extensions
+import pdfWorkerSource from 'pdfjs-dist/legacy/build/pdf.worker.mjs';


There was a upstream error in using legacy built , we should had imported from pdfjs-dist/build/pdf.worker.mjs, Though i see that pdfWorkerSource was imported much before this, but we should had switched the upstream repo here. @hungvu193 do let me know if you disagree here. 😄 , this caused #51313

hurali97 added 4 commits September 4, 2024 14:01

chore: fix security vulnerabilities

2cb4ffa

Merge branch 'main' of https://github.com/callstack-internal/Expensif…

2b57416

…y-App into hur/chore/fix-security-vulnerabilities

chore: ran build actions after upgrading

a443748

fix: eslint issues

b8d8744

hurali97 commented Sep 5, 2024

View reviewed changes

hurali97 added 3 commits September 5, 2024 15:25

chore: fix security vulnerabilties

53248d1

refactor: use legacy pdf

fbf9528

fix: storybook tests

a5f64f8

hurali97 marked this pull request as ready for review September 6, 2024 08:38

hurali97 requested a review from a team as a code owner September 6, 2024 08:38

melvin-bot bot requested a review from hungvu193 September 6, 2024 08:38

melvin-bot bot removed the request for review from a team September 6, 2024 08:38

hungvu193 reviewed Sep 6, 2024

View reviewed changes

fix: add polyfills for Promise.withResolvers as on mobile safari PDF …

8488452

…crashes after selecting to upload

hungvu193 approved these changes Sep 10, 2024

View reviewed changes

Merge branch 'main' of https://github.com/callstack-internal/Expensif…

c6a5159

…y-App into hur/chore/fix-security-vulnerabilities

chore: fix security vulnerabilities

50fcb26

hungvu193 approved these changes Sep 11, 2024

View reviewed changes

melvin-bot bot requested a review from grgia September 11, 2024 15:27

hurali97 force-pushed the hur/chore/fix-security-vulnerabilities branch from 50eade2 to 50fcb26 Compare September 13, 2024 07:52

Merge branch 'main' of https://github.com/callstack-internal/Expensif…

6d3751f

…y-App into hur/chore/fix-security-vulnerabilities

szymonrybczak approved these changes Sep 13, 2024

View reviewed changes

hungvu193 approved these changes Sep 13, 2024

View reviewed changes

grgia previously approved these changes Sep 17, 2024

View reviewed changes

Merge remote-tracking branch 'origin/main' into hur/chore/fix-securit…

053aebb

…y-vulnerabilities # Conflicts: # package-lock.json

szymonrybczak dismissed grgia’s stale review via 053aebb September 17, 2024 12:42

chore: update package-lock.json

aa5ddab

grgia approved these changes Sep 17, 2024

View reviewed changes

grgia merged commit 266ad46 into Expensify:main Sep 17, 2024

github-actions bot mentioned this pull request Sep 17, 2024

Deploy Checklist: New Expensify 2024-09-17 #49356

Closed

40 tasks

szymonrybczak mentioned this pull request Sep 18, 2024

[$250] Fix security vulnerabilities in Expensify App #48327

Closed

VickyStash mentioned this pull request Nov 14, 2024

[HOLD for payment 2024-12-12] [$250] Web - [AU] Attachment - Console errors appear when uploading a PDF attachment to a 1:1 DM #51313

Closed

8 tasks

allgandalf reviewed Dec 12, 2024

View reviewed changes

Conversation

hurali97 commented Sep 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Fixed Issues

Tests

Offline tests

QA Steps

PR Author Checklist

Screenshots/Videos

Uh oh!

hurali97 Sep 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

melvin-bot bot commented Sep 6, 2024

Uh oh!

hungvu193 Sep 6, 2024

Choose a reason for hiding this comment

Uh oh!

hurali97 Sep 9, 2024

Choose a reason for hiding this comment

Uh oh!

hungvu193 commented Sep 9, 2024

Uh oh!

hungvu193 commented Sep 9, 2024

Uh oh!

hurali97 commented Sep 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hungvu193 commented Sep 10, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Screenshots/Videos

Uh oh!

hungvu193 left a comment

Choose a reason for hiding this comment

Uh oh!

melvin-bot bot commented Sep 10, 2024

Uh oh!

hungvu193 commented Sep 11, 2024

Uh oh!

hungvu193 commented Sep 11, 2024

Uh oh!

hurali97 commented Sep 11, 2024

Uh oh!

hungvu193 commented Sep 11, 2024

Uh oh!

hurali97 commented Sep 11, 2024

Uh oh!

hungvu193 commented Sep 11, 2024

Uh oh!

hurali97 commented Sep 12, 2024

Uh oh!

kirillzyusko commented Sep 12, 2024

Uh oh!

hurali97 commented Sep 12, 2024

Uh oh!

kirillzyusko commented Sep 12, 2024

Uh oh!

hurali97 commented Sep 12, 2024

Uh oh!

hurali97 commented Sep 13, 2024

Uh oh!

hungvu193 left a comment

Choose a reason for hiding this comment

Uh oh!

hungvu193 commented Sep 17, 2024

Uh oh!

OSBotify commented Sep 17, 2024

Uh oh!

OSBotify commented Sep 17, 2024

Uh oh!

m-natarajan commented Sep 17, 2024

Uh oh!

hungvu193 commented Sep 18, 2024

Uh oh!

OSBotify commented Sep 19, 2024

Uh oh!

allgandalf Dec 12, 2024

hurali97 commented Sep 4, 2024 •

edited

Loading

hurali97 Sep 5, 2024 •

edited

Loading

hurali97 commented Sep 9, 2024 •

edited

Loading

hungvu193 commented Sep 10, 2024 •

edited

Loading