fix: backport regex change from 8.0.1 by G-Rath · Pull Request #20 · npm/ssri

G-Rath · 2021-04-14T20:38:58Z

Backport of #17 so it's easier for people to patch.

Once/if this is merged and released, the advisory will need to be updated to reflect the new vulnerability/fixed range to allow > 7.0.2

Relates to #19.

References

nikoladev · 2021-04-21T10:05:03Z

This would be nice to get backported to version 7 of ssri for packages which depend on ssri@7.

For example, gatsby@2 depends on terser-webpack-plugin@^2.3.8 which depends on cacache@^13.0.1 which then depends on ssri@^7.0.0:

└─┬ gatsby@2.32.12
  └─┬ terser-webpack-plugin@2.3.8
    └─┬ cacache@13.0.1
      └── ssri@7.1.0

And I'm sure there's more packages like this.

georgeconstantinou · 2021-04-23T11:08:39Z

We are facing the same issue with @vue/cli-service direct and nested dependency:

$ npm ls ssri
└─┬ @vue/cli-service@4.5.12
  ├── ssri@7.1.0 
  └─┬ terser-webpack-plugin@2.3.8
    └─┬ cacache@13.0.1
      └── ssri@7.1.0

nikoladev · 2021-04-30T15:00:55Z

Friendly ping, @nlf

You released the previous updates for ssri. Could you look at this backport?

ghost

I think I need this fix

ghost · 2021-05-05T23:20:57Z

I need write access

ghost · 2021-05-06T20:22:46Z

I'm just learning this platform so I'll look for other instances of this software on my local directories--is that part of the pipeline so to say? Thanks.

ghost

Approve changes

ghost

Reviewed changes

ghost

Thanks

ghost

Thanks

G-Rath · 2021-05-11T00:54:50Z

@nlf @darcyclarke @wraithgar @isaacs would it be possible to get this merged and released?

We've coming up to this being open for a month now with the community being very vocal on this being annoying and showing a clear desire for the patch, which was promptly landed for the v6 & v8 lines in a desire to make it easy for devs to update which this version would also do.

If there is anything I can do on my end to help speed up getting this landed please let me know, but so far I've not had any review from the npm team :(

ghost · 2021-05-11T05:43:26Z

Am I holding up this project

ghost

Reviewed changes

ghost

Approve changes

ghost · 2021-05-15T20:51:59Z

index.js

+const STRICT_SRI_REGEX = /^([^-]+)-([A-Za-z0-9+/=]{44,88})(\?[\x21-\x7E]*)?$/
 const VCHAR_REGEX = /^[\x21-\x7E]+$/

 const SsriOpts = figgyPudding({


Approve remove const SsriOpts = figgyPudding({

ghost · 2021-05-15T20:51:59Z

index.js

+const STRICT_SRI_REGEX = /^([^-]+)-([A-Za-z0-9+/=]{44,88})(\?[\x21-\x7E]*)?$/
 const VCHAR_REGEX = /^[\x21-\x7E]+$/

 const SsriOpts = figgyPudding({


Approve remove const SsriOpts = figgyPudding({

ghost · 2021-05-15T20:52:34Z

index.js


 const BASE64_REGEX = /^[a-z0-9+/]+(?:=?=?)$/i
 const SRI_REGEX = /^([^-]+)-([^?]+)([?\S*]*)$/
-const STRICT_SRI_REGEX = /^([^-]+)-([A-Za-z0-9+/=]{44,88})(\?[\x21-\x7E]*)*$/


Approve remove constricting change

nlf

thank you for doing this work! sorry for the delay, but i'm about to publish it right now

@G-Rath

PR-URL: #20 Credit: @G-Rath Close: #20 Reviewed-by: @nlf

nlf · 2021-05-17T22:16:08Z

this was merged via commit 809c84d and published as ssri@7.1.1

G-Rath · 2021-05-17T22:20:01Z

@nlf I'd say no problem but... it was a long wait 😅

Are you able to fast-track getting the npm advisory updated to include 7.1.1 as being non-vulnerable so we could start making our tooling happy? 🤞

fix: backport regex change from 8.0.1

babcd3c

G-Rath requested a review from a team as a code owner April 14, 2021 20:38

This was referenced Apr 14, 2021

fix: backport regex change from 8.0.1 #19

Closed

simplify regex #17

Merged

jbo023 mentioned this pull request Apr 16, 2021

Current release of @vue/cli-service is affected by CVE-2021-27290 Regular Expression Denial of Service in ssri vuejs/vue-cli#6424

Closed

undergroundwires mentioned this pull request Apr 16, 2021

Failing security checks because of CVE-2021-27290 undergroundwires/privacy.sexy#69

Closed

G-Rath mentioned this pull request Apr 18, 2021

Bump ssri dependency from 6.0.1 to 6.0.2 to address CVE-2021-27290 npm/cacache#49

Closed

darcyclarke self-assigned this Apr 19, 2021

darcyclarke added this to the OSS - Sprint 29 milestone Apr 19, 2021

scastaldi approved these changes Apr 19, 2021

View reviewed changes

darcyclarke removed their assignment May 3, 2021

darcyclarke modified the milestones: OSS - Sprint 29, OSS - Sprint 30 May 3, 2021

ghost reviewed May 5, 2021

View reviewed changes

georgeconstantinou approved these changes May 6, 2021

View reviewed changes

ghost approved these changes May 7, 2021

View reviewed changes

ghost reviewed May 8, 2021

View reviewed changes

ghost approved these changes May 8, 2021

View reviewed changes

ghost approved these changes May 11, 2021

View reviewed changes

ghost reviewed May 15, 2021

View reviewed changes

darcyclarke assigned nlf May 17, 2021

nlf approved these changes May 17, 2021

View reviewed changes

nlf pushed a commit that referenced this pull request May 17, 2021

fix: backport regex change from 8.0.1

809c84d

PR-URL: #20 Credit: @G-Rath Close: #20 Reviewed-by: @nlf

nlf closed this May 17, 2021

G-Rath deleted the backport-regex-fix branch May 17, 2021 22:16

pratheeshrussell-qb mentioned this pull request Feb 20, 2025

Test pratheeshrussell-qb/docker_vuln_scan#8

Closed

pratheeshrussell-qb mentioned this pull request Apr 7, 2025

Test pratheeshrussell-qb/docker_vuln_scan#9

Closed

github-actions bot mentioned this pull request Apr 7, 2025

Test2 pratheeshrussell-qb/docker_vuln_scan#10

Open

Conversation

G-Rath commented Apr 14, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

References

Uh oh!

nikoladev commented Apr 21, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

georgeconstantinou commented Apr 23, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nikoladev commented Apr 30, 2021

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

ghost commented May 5, 2021

Uh oh!

ghost commented May 6, 2021

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

G-Rath commented May 11, 2021

Uh oh!

ghost commented May 11, 2021

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

ghost left a comment

Choose a reason for hiding this comment

Uh oh!

ghost May 15, 2021

Choose a reason for hiding this comment

Uh oh!

ghost May 15, 2021

Choose a reason for hiding this comment

Uh oh!

ghost May 15, 2021

Choose a reason for hiding this comment

Uh oh!

nlf left a comment

Choose a reason for hiding this comment

Uh oh!

nlf commented May 17, 2021

Uh oh!

G-Rath commented May 17, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

G-Rath commented Apr 14, 2021 •

edited

Loading

nikoladev commented Apr 21, 2021 •

edited

Loading

georgeconstantinou commented Apr 23, 2021 •

edited

Loading