test: security scan

[davisjam]

• npm run test:redos now scans for REDOS issues
• added a Travis stage for 'security scan', which at the moment just checks for REDOS

Fixes: #1201.

[davisjam]

Not sure whether the CI stage is configured properly. I don't think CI changes take effect until after it's merged though, so someone should check it over.

[davisjam]

Actually it seems the Travis run is picking up the security scan, here. Results are as expected, cf. #1223

The security scan took 60 seconds, of which running the eslint plugin took 13 seconds. So I don't think querying my REDOS DB is problematic performance-wise.

[UziTech]

I still don't think the eslint plugin is all that helpful in our situation because of the way we construct the regexes.

[davisjam]

As you've pointed out earlier, a static analysis won't guarantee protection. I disagree, however, that it "is [not] all that helpful". It has already identified several REDOS issues, and it is certainly much better than nothing. I therefore suggest we adopt it.

We can open an issue to revisit this with a more thorough approach. Exposing the module's regexes and invoking vuln-regex-detector on them from the test suite would be a nice extension.

[styfle]

@davisjam CI is showing a vulnerability.

557:14  error  Regex pattern vulnerable to catastrophic backtracking: ^!?\[(label)\]\(\s*<?([\s\S]*?)>?(?:\s+(['"][\s\S]*?['"]))?\s*\)  vuln-regex-detector/no-vuln-regex

Is this a false positive? If not, can you fix it?

Ok I see now you have opened #1223
I'll take a look at that one.

[davisjam]

Is this a false positive?

This scan will not produce false positives. This tool only flags a regex if it has demonstrated super-linear behavior against it. It will have some false negatives, e.g. it did not catch #1224 .

[joshbruce]

I like the idea of CI covering us on security. Not going to require this be there for the 0.4.0 release as it seems like there might be some more conversation desired.

[styfle]

@davisjam Want to rebase on master?

[davisjam]

@styfle Rebased in 02b1343.

[UziTech]

I agree this is better than nothing, but I think we still need to do more.

[UziTech]

security scan 🔐

[davisjam]

Fixed.

Where do you guys find these cool symbols?

[styfle]

@davisjam If you type : you can start typing words and find emoji 🔍

Otherwise, checkout https://emojipedia.org 😄