chore: Bump fast-check to version 3 #3301
Merged
+29
−23
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Next target will be to leverage fast-check to detect some potential prototype poisoning in the exposed APIs before they turn into CVEs. |
The version 3 of fast-check added something very interesting for libraries such as ramda: it can more likely produce values such as `__proto__` or `toString` which are known sources for CVE. On fast-check's side, I also worked on some tooling making poisoning related issues even simpler to detect with an automatic detection for poisoning on globals. I successfully found back several past CVEs of lodash thanks to it.
dubzzz
changed the title
|
@kedashoe I just updated this PR. I believe it can be useful for the project to rely on the latest version of fast-check in order to benefit from all the improvements brought by v3. It includes prototype poisoning related detection which is something that can easily strike projects such as ramda. |
Coverage Summary> ramda@0.30.0 coverage:summary
> BABEL_ENV=cjs nyc --reporter=text-summary mocha -- --reporter=min --require @babel/register
�[2J�[1;3H
1192 passing (911ms)
=============================== Coverage summary ===============================
Statements : 94.06% ( 2486/2643 )
Branches : 85.76% ( 970/1131 )
Functions : 93.28% ( 555/595 )
Lines : 94.34% ( 2332/2472 )
================================================================================ |
|
NOTE: I'm currently working on a version 4 of fast-check. It should not come with many breaking changes but still always to be closer to the latest release to simplify future bumps. |
kedashoe
approved these changes
May 24, 2024
|
ty @dubzzz sorry for missing this the first time |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The version 3 of fast-check added something very interesting for libraries such as ramda: it can more likely produce values such as
__proto__ortoStringwhich are known sources for CVE.On fast-check's side, I also worked on some tooling making poisoning related issues even simpler to detect with an automatic detection for poisoning on globals. I successfully found back several past CVEs of lodash thanks to it.