Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update loader-utils to address security vulnerabilities #18

Merged
merged 2 commits into from
Sep 19, 2023

Conversation

achintmehta
Copy link

@achintmehta achintmehta commented Sep 18, 2023

The current version of i18next-resource-store-loader is using the loader-utils version 0.2.11.
This version has several security vulnerabilities.
webpack/loader-utils#214
https://nvd.nist.gov/vuln/detail/CVE-2022-37599
https://nvd.nist.gov/vuln/detail/CVE-2022-37601
https://nvd.nist.gov/vuln/detail/CVE-2022-37603

So using i18next-resource-store-loader in a project leads to several vulnerabilities being reported by third part vulnerability analyzers since it is linking to a vulnerable version of the loader-utils library.

Seems that this project is using loader-utils for parseQuery function only, which has been removed from version 3.0 of loader-utils.
Reference: https://github.com/webpack/loader-utils/blob/master/CHANGELOG.md
removed parseQuery in favor new URLSearchParams(loaderContext.resourceQuery.slice(1)) where loaderContext is this in loader function

As part of this PR, loader-utils library dependency has been removed and calls to parseQuery have been replaced with URLSearchParams.

Ran the unit tests which passed after the changes

 gulp test
[06:15:24] Using gulpfile /work/i18next-resource-store-loader/gulpfile.js
[06:15:24] Starting 'test'...
 12  -_-_-_-_-_-_-_,------,
 0   -_-_-_-_-_-_-_|   /\_/\
 0   -_-_-_-_-_-_-^|__( ^ .^)
     -_-_-_-_-_-_-  ""  ""

  12 passing (23ms)

[06:15:24] Finished 'test' after 65 ms

@de-robat de-robat merged commit 2e1ca15 into atroo:master Sep 19, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants