Fix for security issues in Synk

[nandeshwarshubh]

Hi,

There are certain issues which were reported in Snyk for @storybook-react. Is there a roadmap to update the following dependencies and fix the issues?

Snyk @storybook-react issues

• Regular Expression Denial of Service (ReDoS) - @storybook/[email protected] › @storybook/[email protected] › @storybook/[email protected] › @storybook/[email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]
• Denial of Service (DoS) - @storybook/[email protected] › @storybook/[email protected] › @storybook/[email protected] › [email protected] › [email protected] › [email protected] › [email protected]
• Prototype Pollution - @storybook/[email protected] › @storybook/[email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]
• Regular Expression Denial of Service (ReDoS) - @storybook/[email protected] › @storybook/[email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]

[R-Lek]

Same here.
We've updated to Storybook 6.5.9 this week but the same vulnerabilities mentioned by @nandeshwarshubh were reported by Snyk as well.

https://snyk.io/test/npm/storybook/6.5.9

[shilman]

All of the fixes are breaking changes so we will include them in 7.0

[nandeshwarshubh]

One more issue identified:

Regular Expression Denial of Service (ReDoS) - @storybook/[email protected] › @storybook/[email protected] › @storybook/[email protected] › [email protected]

[R-Lek]

All of the fixes are breaking changes so we will include them in 7.0

Do you have a release schedule or an estimate when Storybook 7 will be released? I can't seem to find it myself.

[velsonjr]

Upgrading to 6.5.13 still has issues in below packages

• ansi-regex, Regular Expression Denial of Service
• trim Regular, Expression Denial of Service (ReDoS)
• loader-utils, Prototype Pollution
• trim-newlines, Denial of Service (DoS)
• unset-value, Prototype Pollution
• glob-parent, Regular Expression Denial of Service (ReDoS)
• loader-utils Regular Expression Denial of Service

Any timeline for this?

[mtorre4580-peya]

For a few dependencies I use resolutions from yarn to force the new version with the fix, but has a disadvantages to break something.

https://classic.yarnpkg.com/lang/en/docs/selective-version-resolutions/

[apalski]

Three more issues for V7 please:

• minimatch ReDoS vulnerability through glob CVE-2022-3517
• terser insecure use of regular expressions CVE-2022-25858
• Inefficient Regular Expression Complexity in nth-check through css-select CVE-2021-3803

[IanVS]

Would anyone be willing to dig in and help out by submitting pull requests?

Please do keep in mind that just because a CVE exists for a particular dependency does not mean that Storybook is using it in a way that makes it vulnerable, or that your use of Storybook opens you up to vulnerabilities. Most of these CVEs are geared towards folks using Node.js backends, in which case external users can sometimes cause problems. Storybook is a development tool and has different considerations.

That said, I know some companies are very strict about "no reported vulnerabilities" without taking the nuance into account, and we'd like to make sure dependencies are up to date regardless.

[alexgleason]

That said, I know some companies are very strict about "no reported vulnerabilities" without taking the nuance into account, and we'd like to make sure dependencies are up to date regardless.

The main problem is that if a real vulnerability comes in, it becomes buried in the security report.

[alexgleason]

Would anyone be willing to dig in and help out by submitting pull requests?

Why not just set up dependabot on this repo?

[shilman]

@alexgleason dependabot sends about 5 updates per day. @ndelangen has looked at this and spoken with the dependabot team. i hope we can figure out a less noisy process for fixing security issues as they come in. agree this is super important.

[vanessayuenn]

Closing this issue; all fixable issues in the Snyk reports have already been addressed in the latest version of Storybook.

There is still one report remaining with the vulnerability trim, which is introduced via MDX1 (@storybook/[email protected] › @mdx-js/[email protected] › [email protected] › [email protected]). This is a known issue and a good reason to migrate to MDX2, but we have decided to allow opt-in MDX1 support to ease the transition (see #20145), therefore keeping this dependency.