Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add shrinkwrap back into nsp check task #1492

Closed
3 tasks done
DonutEspresso opened this issue Sep 13, 2017 · 2 comments
Closed
3 tasks done

Add shrinkwrap back into nsp check task #1492

DonutEspresso opened this issue Sep 13, 2017 · 2 comments

Comments

@DonutEspresso
Copy link
Member

  • Used appropriate template for the issue type
  • Searched both open and closed issues for duplicates of this issue
  • Title adequately and concisely reflects the feature or the bug

A recent release of nsp caused nsp's internal dev dependencies to be included as part of the nsp check. This is a bug on nsp's part:
nodesecurity/nsp#185

We should revert #1482 once a new nsp version is released.

@hekike
Copy link
Member

hekike commented Sep 29, 2017

nsp finds vulnerabilities in the dependency tree without shrinkwrap if we have a package-lock.json file. Shouldn't we add package-lock.json to restify instead of reverting #1482?

With package-lock.json file:

$ make nsp
(+) 1 vulnerabilities found
┌───────────────┬─────────────────────────────────────────────────────────────────┐
│               │ Regular Expression Denial of Service                            │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ Name          │ debug                                                           │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ CVSS          │ 3.7 (Low)                                                       │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ Installed     │ 2.6.8                                                           │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ Vulnerable    │ <= 2.6.8 || >= 3.0.0 <= 3.0.1                                   │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ Patched       │ >= 2.6.9 < 3.0.0 || >= 3.1.0                                    │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ Path          │ restify@6.0.1 > spdy@3.4.7 > debug@2.6.8                        │
├───────────────┼─────────────────────────────────────────────────────────────────┤
│ More Info     │ https://nodesecurity.io/advisories/534                          │
└───────────────┴─────────────────────────────────────────────────────────────────┘

@hekike
Copy link
Member

hekike commented Sep 29, 2017

Related to: #1477

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants