0

In our company we use veracode to scan our code and this tool give us a summary report at the end with the vulnerabilities found on our source code or dependencies.

I have created a new SPFx webpart, empty! just the basic hello world, and even then the tool found one vulnerability.

Component: validator Version: 8.2.0 Regular Expression Denial Of Service (ReDoS): validator is vulnerable to regular expression denial of service (ReDoS) attacks. A malicious user can pass a long URI to the isDataURI() function to cause a ReDoS attack. Link: https://sca.analysiscenter.veracode.com/vulnerability-database/security/sca/vulnerability/sid-7078/summary

When checking the dependency tree I found this:

├─┬ @microsoft/sp-build-web@1.12.1
│ └─┬ @microsoft/sp-build-core-tasks@1.12.1
│   └─┬ azure-storage@2.10.4
│     └── validator@9.4.1
└─┬ @microsoft/sp-module-interfaces@1.12.1
  └─┬ z-schema@3.18.4
    └── validator@8.2.0

If I understand correctly, I cant upgrade it myself because it may break the sp-module-interfaces.

Is there something I can do to update this package?

0

If you upgrade the package that another package you don't control depends on, you're effectively rolling the dice it won't break that other one.

If I understand correctly, I cant upgrade it myself because it may break the sp-module-interfaces.

Correct, you can't update it safely (ie: without side effects).

Is there something I can do to update this package?

Not really... technically you can upgrade the other package's sp-module-interface dependency tree and make sure things still work, then use your internal one. But practically speaking, this isn't possible because you don't have access to the sp-module-interfaces package it's not made available to us.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.