[stable27] Fix npm audit

[nextcloud-command]

Audit report

This audit fix resolves 21 of the total 30 vulnerabilities found in your project.

Updated dependencies

• @adobe/css-tools
• @babel/traverse
• @cypress/request
• @jimp/core
• @jimp/custom
• @nextcloud/cypress
• browserify-sign
• cypress
• ejs
• express
• follow-redirects
• load-bmfont
• nextcloud-vue-collections
• node-vibrant
• parse-bmfont-xml
• phin
• select2
• tar
• wait-on
• webpack-dev-middleware
• xml2js

Fixed vulnerabilities

@adobe/css-tools #

• @adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity
• Severity: moderate (CVSS 5)
• Reference: GHSA-prr3-c3m5-p7q2
• Affected versions: <4.3.2
• Package usage:
  • node_modules/@adobe/css-tools

@babel/traverse #

• Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
• Severity: critical 🚨 (CVSS 9.4)
• Reference: GHSA-67hx-6x53-jw92
• Affected versions: <7.23.2
• Package usage:
  • node_modules/@babel/traverse

@cypress/request #

• Server-Side Request Forgery in Request
• Severity: moderate (CVSS 6.1)
• Reference: GHSA-p8p7-x288-28g6
• Affected versions: <=2.88.12
• Package usage:
  • node_modules/@cypress/request

@jimp/core #

• Caused by vulnerable dependency:
  • phin
• Affected versions: <=0.21.4--canary.1163.d07ed6254d130e2995d24101e93427ec091016e6.0
• Package usage:
  • node_modules/@jimp/core

@jimp/custom #

• Caused by vulnerable dependency:
  • @jimp/core
• Affected versions: <=0.21.4--canary.1163.d07ed6254d130e2995d24101e93427ec091016e6.0
• Package usage:
  • node_modules/@jimp/custom

@nextcloud/cypress #

• Caused by vulnerable dependency:
  • cypress
• Affected versions:
• Package usage:
  • node_modules/@nextcloud/cypress

browserify-sign #

• browserify-sign upper bound check issue in dsaVerify leads to a signature forgery attack
• Severity: high (CVSS 7.5)
• Reference: GHSA-x9w5-v3q2-3rhw
• Affected versions: 2.6.0 - 4.2.1
• Package usage:
  • node_modules/browserify-sign

cypress #

• Caused by vulnerable dependency:
  • @cypress/request
• Affected versions: 4.3.0 - 12.17.4
• Package usage:
  • node_modules/cypress

ejs #

• ejs lacks certain pollution protection
• Severity: moderate
• Reference: GHSA-ghr5-ch3p-vcr6
• Affected versions: <3.1.10
• Package usage:
  • node_modules/ejs

express #

• Express.js Open Redirect in malformed URLs
• Severity: moderate (CVSS 6.1)
• Reference: GHSA-rv95-896h-c2vc
• Affected versions: <4.19.2
• Package usage:
  • node_modules/express

follow-redirects #

• Follow Redirects improperly handles URLs in the url.parse() function
• Severity: moderate (CVSS 6.1)
• Reference: GHSA-jchw-25xp-jwwc
• Affected versions: <=1.15.5
• Package usage:
  • node_modules/follow-redirects

load-bmfont #

• Caused by vulnerable dependency:
  • phin
• Affected versions: >=1.4.0
• Package usage:
  • node_modules/load-bmfont

nextcloud-vue-collections #

• Caused by vulnerable dependency:
  • @nextcloud/axios
  • @nextcloud/vue
• Affected versions: 0.6.0 - 0.10.0
• Package usage:
  • node_modules/nextcloud-vue-collections

node-vibrant #

• Caused by vulnerable dependency:
  • @jimp/custom
• Affected versions: 3.1.5 - 3.1.6
• Package usage:
  • node_modules/node-vibrant

parse-bmfont-xml #

• Caused by vulnerable dependency:
  • xml2js
• Affected versions: <=1.1.4
• Package usage:
  • node_modules/parse-bmfont-xml

phin #

• phin may include sensitive headers in subsequent requests after redirect
• Severity: moderate (CVSS 4.3)
• Reference: GHSA-x565-32qp-m3vf
• Affected versions: <3.7.1
• Package usage:
  • node_modules/phin

select2 #

• Improper Neutralization of Input During Web Page Generation in Select2
• Severity: moderate (CVSS 6.1)
• Reference: GHSA-rf66-hmqf-q3fc
• Affected versions: <4.0.6
• Package usage:
  • node_modules/select2

tar #

• Denial of service while parsing a tar file due to lack of folders count validation
• Severity: moderate (CVSS 6.5)
• Reference: GHSA-f5x3-32g6-xq36
• Affected versions: <6.2.1
• Package usage:
  • node_modules/tar

wait-on #

• Caused by vulnerable dependency:
  • axios
• Affected versions: 5.0.0-rc.0 - 7.1.0
• Package usage:
  • node_modules/wait-on

webpack-dev-middleware #

• Path traversal in webpack-dev-middleware
• Severity: high (CVSS 7.4)
• Reference: GHSA-wr3j-pwj9-hqq6
• Affected versions: <=5.3.3
• Package usage:
  • node_modules/webpack-dev-middleware

xml2js #

• xml2js is vulnerable to prototype pollution
• Severity: moderate (CVSS 5.3)
• Reference: GHSA-776f-qx25-q3cc
• Affected versions: <0.5.0
• Package usage:
  • node_modules/xml2js

[blizzz]

/compile /

[blizzz]

Cypress error:

AssertionError: Timed out retrying after 4000ms: Expected to find element: [data-cy-files-navigation-settings-quota], but never found it.

Related or flaky?

[susnux]

Related or flaky?

sounds flaky

[blizzz]

Related or flaky?

sounds flaky

There is a similar failing test with Selenium 🤔 https://drone.nextcloud.com/nextcloud/server/55895/57/4

[blizzz]

@susnux * │ ✖ Navigation.cy.ts 00:55 9 5 4 - - │* keeps failing

AssertionError: Timed out retrying after 4000ms: Expected to find element: [data-cy-files-navigation-settings-quota], but never found it.

[susnux]

Seems like the module export changed, so for mocking in the test we need to default import.
Long story short: Fixed.