firebase-admin snyk issues

[harshagarwal00]

Snyk is throwing a warning how to fix it ?
Link: https://snyk.io/test/npm/firebase-admin/10.2.0

node: v16.14.2
npm: 8.5.0

[google-oss-bot]

I found a few problems with this issue:

• I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.
• This issue does not seem to follow the issue template. Make sure you provide all the required information.

[harshagarwal00]

This is duplicate of #1512
But needs a fix.. cant believe above issue got ignored for 5 months :)

[lahirumaramba]

Thank you @harshagarwal00 for reporting this issue.
The Admin Node.js SDK uses dicer to parse multipart responses from Firebase and GCP backend servers.

firebase-admin-node/src/utils/api-request.ts

Line 592 in 94dd7c3

const multipartParser = new dicer({ boundary });

IIUC the threat introduced by the vulnerability in dicer is pretty low here as we can trust the responses from the BE servers. However, if you are using the dicer package to parse responses in your own code then you might be at a higher risk. Having said that, we are looking into the fixes mentioned in #1512 and the potential to use the fixed version of dicer in Admin SDK. I will use this issue to update the progress.

[fbartho]

Thanks @lahirumaramba -- I recognize this is a low vulnerability point, but given that Github/Dependabot are alerting, it'd be great to address this issue permanently.

[Corrob]

Another reason to fix this quickly is that some people block our releases on "npm audit" results to make sure we don't have high vulnerabilities in our release build. Currently, our releases are blocked or must be worked around until firebase-admin stops being reported as being with a high vulnerability in the audit.

[samarpanB]

Rightly said @Corrob . We are also facing the same issue. We are blocked for deployment on production environment because of npm audit failing and snyk also failing. Reason is this issue only. How soon can we fix it ?

[harshagarwal00]

@lahirumaramba : brilliant but its not tagged as a release... by when will we get that :)
waiting to import the fix
thanks!!!
[the latest version is 10.2.0]

[lahirumaramba]

This should be fixed in v10.3.0. Thanks everyone for you patience while we were working on the fix.

[Diribar]

The alert is still showng, both in Github and nodejs. Do you have any news about the solution?

[ellie-ochieno]

Because multer vulnerability issue was being classified as severity:high in my nodejs application, i resolved by upgrading to another version "multer": "^1.4.5-lts.1" as an alternative and all seemed to work well.