Skip to content
This repository has been archived by the owner on Jul 29, 2024. It is now read-only.

protractor > optimist > minimist Prototype Pollution #5413

Closed
sdavids opened this issue Mar 26, 2020 · 5 comments · Fixed by #5416
Closed

protractor > optimist > minimist Prototype Pollution #5413

sdavids opened this issue Mar 26, 2020 · 5 comments · Fixed by #5416

Comments

@sdavids
Copy link

sdavids commented Mar 26, 2020

Bug report

  • Node Version: v13.10.1
  • Protractor Version: 5.4.3
  • Angular Version: 9.1.0
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ protractor [dev]                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ protractor > optimist > minimist                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

optimist is deprecated--maybe update to yargs?
alan-agius4 added a commit to alan-agius4/protractor that referenced this issue Mar 31, 2020
@alan-agius4
fix: security pototype pollution
7b14072 
Optimist has been deprecated over 2 years ago as has a security vulnerability. With this change we use it's succesor `yargs`.

Closes: angular#5413
alan-agius4 added a commit to alan-agius4/protractor that referenced this issue Mar 31, 2020
@alan-agius4
fix: security prototype pollution
e29fbbc 
Optimist has been deprecated over 2 years ago as has a security vulnerability. With this change we use it's successor `yargs`.

Closes: angular#5413
@alan-agius4 alan-agius4 mentioned this issue Mar 31, 2020
Merged
alan-agius4 added a commit to alan-agius4/protractor that referenced this issue Mar 31, 2020
@alan-agius4
fix: security prototype pollution
daef393 
Optimist has been deprecated over 2 years ago as has a security vulnerability. With this change we use it's successor `yargs`.

Closes: angular#5413
alan-agius4 added a commit to alan-agius4/protractor that referenced this issue Mar 31, 2020
@alan-agius4
fix: security prototype pollution
4acc0a1 
Optimist has been deprecated over 2 years ago as has a security vulnerability. With this change we use it's successor `yargs`.

Closes: angular#5413
@colbyhill21
Copy link

The change has been completed by @alan-agius4 although it still hasn't been merged in. Is there any estimate on when these changes will be merged and released?

@inpercima
Copy link

Is there a way to merge this existing pull request?

alan-agius4 added a commit to alan-agius4/protractor that referenced this issue Apr 11, 2020
@alan-agius4
fix: security prototype pollution
6e6584a 
Optimist has been deprecated over 2 years ago as has a security vulnerability. With this change we use it's successor `yargs`.

Closes: angular#5413
kyliau pushed a commit to alan-agius4/protractor that referenced this issue Apr 15, 2020
@alan-agius4
fix: security prototype pollution
ad8ce86 
Optimist has been deprecated over 2 years ago as has a security vulnerability. With this change we use it's successor `yargs`.

Closes: angular#5413
kyliau pushed a commit that referenced this issue Apr 15, 2020
@alan-agius4
fix: security prototype pollution
3b7fe02 
Optimist has been deprecated over 2 years ago as has a security vulnerability. With this change we use it's successor `yargs`.

Closes: #5413
kyliau pushed a commit to kyliau/protractor that referenced this issue Apr 15, 2020
@alan-agius4
fix: security prototype pollution
7602f47 
Optimist has been deprecated over 2 years ago as has a security vulnerability. With this change we use it's successor `yargs`.

Closes: angular#5413
@kyliau kyliau mentioned this issue Apr 15, 2020
Merged
alan-agius4 added a commit to kyliau/protractor that referenced this issue Apr 16, 2020
@alan-agius4
fix: security prototype pollution
f417221 
Optimist has been deprecated over 2 years ago as has a security vulnerability. With this change we use it's successor `yargs`.

Closes: angular#5413
alan-agius4 added a commit to kyliau/protractor that referenced this issue Apr 16, 2020
@alan-agius4
fix: security prototype pollution
1d9fe84 
Optimist has been deprecated over 2 years ago as has a security vulnerability. With this change we use it's successor `yargs`.

Closes: angular#5413
kyliau pushed a commit that referenced this issue Apr 16, 2020
@alan-agius4
fix: security prototype pollution
8b3ebf8 
Optimist has been deprecated over 2 years ago as has a security vulnerability. With this change we use it's successor `yargs`.

Closes: #5413
@evilaliv3
Copy link
Contributor

@alan-agius4 @kyliau: Considering the value of this patch i would suggest to issue a new release.

What do you think?

This could be relevant for many projects. Among the updates if anywone would like to review it i would kindly ask if we could try to include: #5421

\cc @cnishina @sjelin @sjelin

@alan-agius4
Copy link
Contributor

@evilaliv3, a release containing this fix has already been cut (5.4.4)

@evilaliv3
Copy link
Contributor

Ah, i'm sorry for the confusion, the fact that you edited many comments that you wrote time ago messed up many of the dates that github shows and i fooled me. thank you for the clarification @alan-agius4 and @kyliau

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: security prototype pollution alan-agius4/protractor
5 participants
@sdavids @evilaliv3 @inpercima @alan-agius4 @colbyhill21