RE DoS + Prototype pollution vulnerability

[Berkmann18]

Issue details

NPM flagged a vulnerability regarding this package due to a Regular Expression Denial of Service found in its debug dependency as follows:

 Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ debug                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >= 2.6.9 < 3.0.0 || >= 3.1.0                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ browser-sync [dev]                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ browser-sync > localtunnel > debug                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/534             

There's also an apparent Prototype Pollution in its lodash dependency as follows:

 Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.5                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ browser-sync                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ browser-sync > easy-extender > lodash                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/577

Steps to reproduce/test case

# cd to a project that uses browser-sync as a dev dependency
npm audit #or nsp check

Please specify which version of Browsersync, node and npm you're running

• Browsersync [2.24.6]
• Node [10.7.0]
• Npm [6.2.0]

Affected platforms

• linux
• windows
• OS X
• freebsd
• solaris
• other (please specify which)

Browsersync use-case

• API
• Gulp
• Grunt
• CLI

If CLI, please paste the entire command below

{cli command here}

for all other use-cases, (gulp, grunt etc), please show us exactly how you're using Browsersync

    if (app.get('browser') || process.env.BROWSER) {
      require('browser-sync')({
        proxy: `localhost:${port}`,
        files: ['public/**/*.{js,css}']
      });
    }

[shakyShane]

I cannot address the localtunnel one localtunnel/localtunnel#272

[Berkmann18]

@shakyShane How come? Aren't you the author and a contributor to that package including BrowserSync ?

[adamjaffeback]

FYI, localtunnel updated their dependencies with localtunnel/localtunnel#256 and released to v1.9.1 to fix their end.

[Berkmann18]

@adamjaffeback Thanks for info.

[jt2k]

@shakyShane Thanks for fixing this! I see the change is tagged with a 2.25.0 alpha release. When will the final version be released?