npm audit warnings

[rogerta]

I just pulled from main@52a4fcd08c703dbf41d8978ca8d120fb9ffd882c (dated Mon Jul 26 10:31:11 2021 -0400) and got the following npm warning during npm install:

                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ mochapack [dev]                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ mochapack > glob-parent                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1751                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 moderate severity vulnerability in 796 scanned packages
  1 vulnerability requires manual review. See the full report for details.

[kberg]

Yeah, I saw that. Interesting, huh?

I have read about the vuln and I assert this is not a problem for us. Mochapack should definitely patch this though.

If you read https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905 which goes into the detail about the vulnerability, it creates a potential DOS attack with bad regular expressions. What that article says (as best as I can tell, anyway) is that very long input strings could result in very slow regular expression performance, thus being a possible attack vector by slowing down servers.

We only use mochapack for compilation, never for serving. So at worst, it will slow our compile phase horribly, but cannot impact our runtime.

In fact, I bet the only reason mochapack isn't rushing to patch is that it's probably never on the serving path.

[bafolts]

This is duplicate of sysgears/mochapack#107