jsome > yargs > yargs-parser vulnerability reported by npm audit

[sstone1]

Installing @accordproject/[email protected] causes npm audit to report vulnerabilities.

Two of them are caused by the dependency on the jsome library:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @ds/flows-cli                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @ds/flows-cli > @ds/flows-engine >                           │
│               │ @accordproject/concerto-core > jsome > yargs > yargs-parser  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1500                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @ds/flows-plugin-basic                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @ds/flows-plugin-basic > @ds/flows-engine >                  │
│               │ @accordproject/concerto-core > jsome > yargs > yargs-parser  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1500                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

The jsome library appears to be abandonware, with no update since 2018:

• https://www.npmjs.com/package/jsome
• https://github.com/Javascipt/Jsome

It seems unlikely that they will publish a new version with the dependency changes in.

Given that this is used to colorize log output, we could probably replace it with another module fairly easily. There's a few options out there:

• https://www.npmjs.com/package/@buzuli/json
• https://www.npmjs.com/package/color-json
• https://www.npmjs.com/package/json-colorizer

[jeromesimeon]

Thanks for the report! @mttrbrts any opinion about the alternatives to jsome?

[jeromesimeon]

Seems fixed after #306 tested on an empty project with just concerto-core as a dependency:

zsh-5.8$ cat package.json
{
  "name": "testproj",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "@accordproject/concerto-core": "1.0.5-20210806204610"
  }
}

Audit result:

zsh-5.8$ npm install
npm WARN deprecated [email protected]: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN [email protected] No description
npm WARN [email protected] No repository field.

added 2 packages from 4 contributors, removed 57 packages, updated 2 packages and audited 25 packages in 3.006s
found 0 vulnerabilities

zsh-5.8$ npm audit 
=== npm audit security report ===                        
                                                                                
found 0 vulnerabilities
 in 25 scanned packages

[jeromesimeon]

@sstone1 This should be fixed in Concerto 1.1.0 https://github.com/accordproject/concerto/releases/tag/v1.1.0

Still worth trying on your end! Let me know if more issues or if we can close this.

[sstone1]

@jeromesimeon thanks, can confirm it works fine with concerto v1.1.0!