[CVE-2022-25758] Use dart-sass instead of node-sass

[Flyingliuhub]

Signed-off-by: Tao liu [email protected]

Description

This PR fixes the Regular expression denial of service in scss-tokenizer, use dart-sass instead of node-sass.

The node-sass are deprecated, the detail here.

The suggested solution (#535) is that use dart-sass instead of node-sass

The scan detail as following and link here

yarn why scss-tokenizer
yarn why v1.22.18
[1/4] Why do we have the module "scss-tokenizer"...?
[2/4] Initialising dependency graph...
warning Resolution field "[email protected]" is incompatible with requested version "typescript@~4.5.2"
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "[email protected]"
info Reasons this module exists
   - "_project_#@osd#ui-framework#node-sass#sass-graph" depends on it
   - Hoisted from "_project_#@osd#ui-framework#node-sass#sass-graph#scss-tokenizer"
info Disk size without dependencies: "268KB"
info Disk size with unique dependencies: "1.11MB"
info Disk size with transitive dependencies: "1.11MB"
info Number of shared dependencies: 2
Done in 1.01s.

Issues Resolved

#1842 , #535

Check List

• New functionality includes testing.
  • All tests pass
    • yarn test:jest
    • yarn test:jest_integration
    • yarn test:ftr
• New functionality has been documented.
• Commits are signed per the DCO using --signoff

[codecov-commenter]

Codecov Report

Merging #2054 (cfd6aa4) into main (76e0f20) will increase coverage by 0.00%.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #2054   +/-   ##
=======================================
  Coverage   67.50%   67.51%           
=======================================
  Files        3077     3077           
  Lines       59184    59188    +4     
  Branches     9003     9003           
=======================================
+ Hits        39955    39958    +3     
- Misses      17044    17045    +1     
  Partials     2185     2185           

Impacted Files	Coverage Δ
...ic/application/models/sense_editor/sense_editor.ts	64.00% <0.00%> (-0.89%)	⬇️
...plugins/maps_legacy/public/map/service_settings.js	1.60% <0.00%> (-0.03%)	⬇️
.../maps_legacy/public/map/base_maps_visualization.js	1.94% <0.00%> (-0.02%)	⬇️
src/plugins/vis_type_vega/public/services.ts	100.00% <0.00%> (ø)
packages/osd-optimizer/src/node/cache.ts	52.77% <0.00%> (+2.77%)	⬆️
...s/osd-optimizer/src/node/node_auto_tranpilation.ts	87.75% <0.00%> (+4.08%)	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[kavilla]

looks like a snapshot failure, could update them?

[kavilla]

Do we see the issue called out here: #535 with EUI complaining?

I know we bumped EUI so it might have unblocked #535.

[Flyingliuhub]

EUI complaining?

According the error in the #535, it sounds like that happened on during the build compile, I didn't see the build compile error and UI error.

[Flyingliuhub]

looks like a snapshot failure, could update them?

Thanks. I updated the test, it should fixes the tests.

[kavilla]

Awesome! Do you know if there is any performance updates with the rendering? Also, will OUI be impacted by this @AMoo-Miki ? Finally, I haven't checked by do we use the sass render or renderSync?

[Flyingliuhub]

@AMoo-Miki , Is this changes looking good from your side? if you have time, please take a look this changes, thanks

[kavilla]

Hello @Flyingliuhub, are we able to eyeball any performance impact?

[Flyingliuhub]

Hello @Flyingliuhub, are we able to eyeball any performance impact?

I didn't see the page load (dashboard/discover/Visualizations) different in my local.

It take about 12 minutes for build locally with following command

yarn build-platform linux --skip-os-packages --skip-archives --release

[kavilla]

What are possible risk and impact to get this merged? Could we list and discuss here.

Is it a check list we could follow to self check besides automation test

Biggest worry was OUI, but Miki is good with that. Downstream might be impacted so it will be a breaking change for 3.0. The only other thing is if there is any performance degradation. But we don't have any client side perf tests so looks good to me. However, will hold off from merging until at least tomorrow just in case in becomes a blocker for OUI.

[seraphjiang]

Any update team ~
@Flyingliuhub @kavilla @AMoo-Miki

[Flyingliuhub]

Any update team ~ @Flyingliuhub @kavilla @AMoo-Miki

@kavilla , Is there any update from retro? if everything looks good from retro meeting, could you please click "Merge"? Thanks