Redocly/redoc

Security vulnerability in old version of lodash

Open

#2,528 建立於 2024年4月24日

在 GitHub 查看
 (3 留言) (0 反應) (0 負責人)TypeScript (21,877 star) (2,272 fork)batch import
Type: Bughelp wantedp3

描述

Describe the bug The redoc/benchmark/index.html file references an obsolete version of lodash (4.17.4) with a known vulnerability that was fixed in later versions. The latest version is 4.17.21, which seems to have fixed the problem. Could the vulnerable version be replaced with the fixed version? Is the benchmark folder necessary to run redoc?

Expected behavior I expected redoc to pass muster with the security team at my company, but it was rejected because of the known vulnerability. See attached file. Redoc ML-vulnerability-report.xlsx

Minimal reproducible OpenAPI snippet(if possible)

Screenshots If applicable, add screenshots to help explain your problem.

Additional context Add any other context about the problem here.

貢獻者指南

技術棧
javascripttypescripthtml
領域
securityfrontend
議題類型
security
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
2
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
under 1 hour
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
fresh
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
familiarity with npm or yarnbasic knowledge of dependency management
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
90
研究方向
Update lodash version in 'redoc/benchmark/index.html' from 4.17.4 to 4.17.21. Verify that no breaking changes affect the benchmark functionality. Optionally, discuss whether the benchmark folder is necessary for the main application. Check the current package.json or lockfile to ensure consistency.