Redocly/redoc

Security vulnerability in old version of lodash

Open

#2528 opened on Apr 24, 2024

View on GitHub
 (3 comments) (0 reactions) (0 assignees)TypeScript (21,877 stars) (2,272 forks)batch import
Type: Bughelp wantedp3

Description

Describe the bug The redoc/benchmark/index.html file references an obsolete version of lodash (4.17.4) with a known vulnerability that was fixed in later versions. The latest version is 4.17.21, which seems to have fixed the problem. Could the vulnerable version be replaced with the fixed version? Is the benchmark folder necessary to run redoc?

Expected behavior I expected redoc to pass muster with the security team at my company, but it was rejected because of the known vulnerability. See attached file. Redoc ML-vulnerability-report.xlsx

Minimal reproducible OpenAPI snippet(if possible)

Screenshots If applicable, add screenshots to help explain your problem.

Additional context Add any other context about the problem here.

Contributor guide

Tech stack
javascripttypescripthtml
Domain
securityfrontend
Issue type
security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
familiarity with npm or yarnbasic knowledge of dependency management
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
90
Research direction
Update lodash version in 'redoc/benchmark/index.html' from 4.17.4 to 4.17.21. Verify that no breaking changes affect the benchmark functionality. Optionally, discuss whether the benchmark folder is necessary for the main application. Check the current package.json or lockfile to ensure consistency.