Snyk reports high risk severity for acorn in react-scripts #8615

w3bdesign · 2020-03-07T21:07:25Z

Describe the bug

Snyk reports high severity issue with react-scripts. See details below:

Regular Expression Denial of Service (ReDoS)

Vulnerable module: acorn
Introduced through: [email protected]
Exploit maturity: No known exploit
Fixed in: 7.1.1

Detailed paths

Introduced through: [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No remediation path available.
Introduced through: [email protected] › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No remediation path available.
Introduced through: [email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No remediation path available.

…and 14 more
Overview

acorn is a tiny, fast JavaScript parser written in JavaScript.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via a regex in the form of /[x-\ud800]/u, which causes the parser to enter an infinite loop.

This string is not a valid UTF16 and is therefore not sanitized before reaching the parser. An application which processes untrusted input and passes it directly to acorn, will allow attackers to leverage the vulnerability leading to a Denial of Service.

Did you try recovering your dependencies?

Yes.

Please paste the output of `npm --version` and/or `yarn --version` to confirm.

6.13.7

Which terms did you search for in User Guide?

Not applicable.

Environment

Environment Info:

System:
OS: Windows 7 6.1.7601
CPU: (8) x64 Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
Binaries:
Node: 12.16.1 - C:\Program Files\nodejs\node.EXE
Yarn: 1.21.1 - C:\Program Files (x86)\Yarn x\bin\yarn.CMD
npm: 6.13.7 - C:\Program Files\nodejs\npm.CMD
Browsers:
Internet Explorer: 11.0.9600.19301
npmPackages:
react: ^16.13.0 => 16.13.0
react-dom: ^16.13.0 => 16.13.0
react-scripts: 3.4.0 => 3.4.0
npmGlobalPackages:
create-react-app: Not Found

Steps to reproduce

Install new version of React.

(Write your steps here:)

npx create-react-app my-app
Test with Snyk.io

The text was updated successfully, but these errors were encountered:

nceight · 2020-03-08T03:51:40Z

I also have the same issue

BMD-518 · 2020-03-08T03:53:57Z

As do I! Feeling less lonely now

SirMauri · 2020-03-08T05:39:29Z

I also have this issue.
npm audit throws that the acorn vuln is patched in version >=7.1.1. I don't know if installing directly the acorn module to the latest version with npm install acorn@latest will solve it. Gonna give it a try and share my results.

jakubkratina · 2020-03-08T15:05:10Z

@SirMauri any results?

bpedersen · 2020-03-08T15:21:58Z

Setting resolutions in package.json is the better approach if using yarn as you don’t explicitly set a dependency on acorn in your project.

dusty · 2020-03-08T16:05:31Z

@bpedersen thanks for the recommendation, this clears the warnings in yarn audit.

  "resolutions": {
    "acorn": "^7.1.1"
  },

BMD-518 · 2020-03-08T16:44:06Z

Adding the resolution worked. I came across this issue while working on a very small project using create-react-app. I'm pretty new to coding but I couldn't find a way to address this with npm. I just switched over to yarn but I'm still curious, what can be done about this in projects set up with node package manager?

w3bdesign · 2020-03-09T01:35:38Z

@dusty @bpedersen @BMD-518

It may remove the warning to manually set the resolution, but does it affect anything in the Create React App in any way? Like, any functionality?

dusty · 2020-03-09T03:38:05Z

I haven't noticed any build issues with the patched acorn.

w3bdesign · 2020-03-09T03:52:59Z

@dusty
And no visible bugs in any React apps?

vanskins · 2020-03-09T08:21:52Z

Are there fix for this ?

jBraekke · 2020-03-09T08:29:57Z

Any fix for npm? I've found 17 moderate severity vulnerabilities related to react-scripts using acorn.

vanskins · 2020-03-09T08:35:05Z

This needs to be fixed asap because it affect developers using create-react-app.

chrisgiann44 · 2020-03-09T09:46:18Z

resolution worked for me

leinss · 2020-03-09T10:05:13Z

Running npm, I was able to fix it temporarily by
adding to package.json scripts:
"preinstall": "npx npm-force-resolutions",

and adding to package.json
"resolutions": { "acorn": "^7.1.1" }

waiting for react-scripts update though.

Ordinal43 · 2020-03-09T11:35:04Z

Running npm, I was able to fix it temporarily by
adding to package.json scripts:
"preinstall": "npx npm-force-resolutions",

and adding to package.json
"resolutions": { "acorn": "^7.1.1" }

waiting for react-scripts update though.

For others attempting this fix, please be mindful of your other dependencies that uses acorn.
Tried this solution and sadly 7.1.1 broke some of my other modules.

shrugs, guess I'll have to wait on actual fixes.

jBraekke · 2020-03-09T13:09:38Z

Solved it temporary by using npm-audit-resolver

vanskins · 2020-03-09T17:50:16Z

Any updates ?

mohammedmunna · 2020-03-10T08:42:14Z

 "resolutions": {
    "acorn": "^7.1.1"
  },

did not work for me.

any updates on the fix?

Dmitrijus1989 · 2020-03-10T12:07:20Z

same here :

Moderate Regular Expression Denial of Service
Package acorn
Patched in >=6.4.1 <7.0.0 || >=7.1.1
Dependency of react-scripts
Path react-scripts > jest > jest-cli > jest-config >
jest-environment-jsdom > jsdom > acorn
More info https://npmjs.com/advisories/1488

any updates ?

marcioolivia · 2020-03-10T13:07:15Z

Same here,
I tried to use the work around with the version 7.1.1, but "broke" my app, so I tried use 6.4.1 and worked it for me.
But still a work around...

"scripts": {
    "preinstall": "npx npm-force-resolutions",
    "start": "react-scripts start",
    "build": "react-scripts build",
    "test": "react-scripts test",
    "eject": "react-scripts eject",
    "lint-quiet": "eslint . --quiet",
    "start-prod": "node app.js"
  },
  "resolutions": {
    "acorn": "^6.4.1"
  }

any updates ?

facebook/create-react-app#8615

sofalse · 2020-03-10T16:56:36Z

jestjs/jest#9643

Update to jest v25.1.0 required in order to fix that vulnerability. It has some breaking changes, so I don't know if that's doable.

BMD-518 · 2020-03-10T19:35:23Z

Well, I had taken the resolutions route but just removed the resolutions from my package.json and ranyarn audit after updating packages and I'm no longer getting any vulnerabilities. So.. maybe it's been fixed?

marcioolivia · 2020-03-11T12:29:01Z

I don't know if is a fix. I did the yarn audit.

yarn audit
yarn audit v
1.19.1
info No lockfile found.
warning @material-ui/core > [email protected]: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1
warning react-scripts > jest-environment-jsdom-fourteen > jsdom > [email protected]: request has been deprecated, see request/request#3142
warning react-scripts > jest > jest-cli > jest-config > jest-environment-jsdom > jsdom > [email protected]: request has been deprecated, see request/request#3142
warning react-scripts > jest > jest-cli > jest-config > jest-environment-jsdom > jsdom > [email protected]: use String.prototype.padStart()
warning react-scripts > workbox-webpack-plugin > workbox-build > strip-comments > babel-plugin-transform-object-rest-spread > babel-runtime > [email protected]: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.
warning [email protected]: request has been deprecated, see request/request#3142
0 vulnerabilities found - Packages audited: 920690
Done in 31.75s.

But, as is show, it doesn't fix, just show that is deprecated, but not upgrade or anything. Actually, I don't know what yarn did to show 0 vulnerabilities...

But when I did "npm i", in my "package-lock.json" has been change, in jsdom, the version of acorn from 6.4.1 (has no issues) to 5.7.4, that has the main problem (vulnerability issue).

But still with 0 vulnerabilities, even with acorn 5.7.4 ¯_(ツ)_/¯

SimenB · 2020-03-12T13:15:22Z

Acorn 5, 6 and 7 have all had patch releases fixing it, so this shouldn't be an issue anymore

marcioolivia · 2020-03-12T14:37:55Z

I deleted the node_modules folder, the lock files (npm and yarn) and I did:
yarn

And everything is ok, 0 vulnerabilities
After, I did npm i (why not? ¯_(ツ)_/¯)
Also 0 vulnerabilities.

To finish, yarn start and is working fine.

I think it can be close this issue.

zwarrell · 2020-03-12T15:08:58Z

New patch worked for me! Ran an npm audit fix and it was able to fix the vulnerabilities with the new patch available.

w3bdesign · 2020-03-12T19:11:38Z

Issue confirmed fixed after deleting package-lock.json, deleting node_modules, running npm install and then npm audit fix again.

Also reran Snyk test and no more acorn vulnerabilities.

w3bdesign added issue: bug report needs triage labels Mar 7, 2020

dmihalcik-virtru added a commit to virtru/protect-and-track that referenced this issue Mar 10, 2020

💪 Force acorn version

55e63d7

facebook/create-react-app#8615

dmihalcik-virtru mentioned this issue Mar 12, 2020

🔒 PLAT-332 PLAT-266 Updates to deps virtru/protect-and-track#160

Merged

w3bdesign closed this as completed Mar 12, 2020

lock bot locked and limited conversation to collaborators Mar 17, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Snyk reports high risk severity for acorn in react-scripts #8615

Snyk reports high risk severity for acorn in react-scripts #8615

w3bdesign commented Mar 7, 2020

nceight commented Mar 8, 2020

BMD-518 commented Mar 8, 2020

SirMauri commented Mar 8, 2020

jakubkratina commented Mar 8, 2020

bpedersen commented Mar 8, 2020

dusty commented Mar 8, 2020

BMD-518 commented Mar 8, 2020

w3bdesign commented Mar 9, 2020

dusty commented Mar 9, 2020

w3bdesign commented Mar 9, 2020

vanskins commented Mar 9, 2020

jBraekke commented Mar 9, 2020

vanskins commented Mar 9, 2020

chrisgiann44 commented Mar 9, 2020

leinss commented Mar 9, 2020

Ordinal43 commented Mar 9, 2020

jBraekke commented Mar 9, 2020

vanskins commented Mar 9, 2020

mohammedmunna commented Mar 10, 2020 •

edited

Loading

Dmitrijus1989 commented Mar 10, 2020 •

edited

Loading

marcioolivia commented Mar 10, 2020 •

edited

Loading

sofalse commented Mar 10, 2020

BMD-518 commented Mar 10, 2020

marcioolivia commented Mar 11, 2020

SimenB commented Mar 12, 2020

marcioolivia commented Mar 12, 2020

zwarrell commented Mar 12, 2020

w3bdesign commented Mar 12, 2020

Snyk reports high risk severity for acorn in react-scripts #8615

Snyk reports high risk severity for acorn in react-scripts #8615

Comments

w3bdesign commented Mar 7, 2020

Describe the bug

Did you try recovering your dependencies?

Please paste the output of npm --version and/or yarn --version to confirm.

Which terms did you search for in User Guide?

Environment

Steps to reproduce

nceight commented Mar 8, 2020

BMD-518 commented Mar 8, 2020

SirMauri commented Mar 8, 2020

jakubkratina commented Mar 8, 2020

bpedersen commented Mar 8, 2020

dusty commented Mar 8, 2020

BMD-518 commented Mar 8, 2020

w3bdesign commented Mar 9, 2020

dusty commented Mar 9, 2020

w3bdesign commented Mar 9, 2020

vanskins commented Mar 9, 2020

jBraekke commented Mar 9, 2020

vanskins commented Mar 9, 2020

chrisgiann44 commented Mar 9, 2020

leinss commented Mar 9, 2020

Ordinal43 commented Mar 9, 2020

jBraekke commented Mar 9, 2020

vanskins commented Mar 9, 2020

mohammedmunna commented Mar 10, 2020 • edited Loading

Dmitrijus1989 commented Mar 10, 2020 • edited Loading

marcioolivia commented Mar 10, 2020 • edited Loading

sofalse commented Mar 10, 2020

BMD-518 commented Mar 10, 2020

marcioolivia commented Mar 11, 2020

SimenB commented Mar 12, 2020

marcioolivia commented Mar 12, 2020

zwarrell commented Mar 12, 2020

w3bdesign commented Mar 12, 2020

Please paste the output of `npm --version` and/or `yarn --version` to confirm.

mohammedmunna commented Mar 10, 2020 •

edited

Loading

Dmitrijus1989 commented Mar 10, 2020 •

edited

Loading

marcioolivia commented Mar 10, 2020 •

edited

Loading