Webpack5

[nkavtur]

✏️ Changes

Attempt to upgrade extensions-cli to webtask v5. This was tested only with DAE, but can actually work for other extensions as well. Until this is properly tested for other extensions, i don't feel confident merging it into master.

📷 Screenshots

🔗 References

🎯 Testing

Tested with DAE. Both dev mode (npm run serve:dev) and prod mode (npm run build & deploy generated assets to webtask) seem to be working fine.

✅ This change has been tested in a Webtask

✅ This change has unit test coverage

✅ This change has integration test coverage

✅ This change has been tested for performance

🎡 Rollout

Need to properly test it with other extensions, not only DAE.

🔥 Rollback

📄 Procedure

[semgrep-code-auth0-extensions-1]

Medium severity vulnerability introduced by a package you're using:
Line 1680 lists a dependency (@babel/runtime) with a known Medium severity vulnerability. Fixing requires upgrading or replacing the dependency.

ℹ️ Why this matters

Affected versions of @babel/helpers, @babel/runtime, @babel/runtime-corejs2, and @babel/runtime-corejs3 are vulnerable to Inefficient Regular Expression Complexity. Babel generates a polyfill (the wrapRegExp helper) for String.prototype.replace on regular expressions with named capturing groups that has quadratic (ReDoS) complexity when an untrusted replacement string containing the substring $< is processed. The vulnerable code is generated polyfill code rather than a symbol you call directly, so any project transpiling named capturing groups against affected browser targets is at risk. Upgrade to a patched version and recompile your code to remediate.

References: GHSA, CVE

To resolve this comment:
Upgrade this dependency to at least version 7.26.10 at package-lock.json.

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-auth0-extensions-1]

Medium severity vulnerability may affect your project—review required:
Line 5648 lists a dependency (js-yaml) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of js-yaml are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). js-yaml is vulnerable to prototype pollution through its YAML merge key (<<) handling. When parsing untrusted YAML with load, loadAll, safeLoad, or safeLoadAll, a crafted document containing a __proto__ key inside a merged mapping can modify the prototype of the resulting object, leading to integrity violations in the application.

References: GHSA, CVE

To resolve this comment:
Check if you are using js-yaml on the CLI.

• If you're affected, upgrade this dependency to at least version 3.14.2 at package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-auth0-extensions-1]

Medium severity vulnerability may affect your project—review required:
Line 8680 lists a dependency (webpack-dev-server) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of webpack-dev-server are vulnerable to Exposed Dangerous Method or Function. webpack-dev-server serves bundled assets without rejecting cross-origin classic script requests. Because such <script src> requests bypass the same-origin policy, a malicious website visited by a developer running the dev server can load the application bundle cross-origin and, via prototype pollution of the webpack runtime, extract the application source code.

References: GHSA, CVE

To resolve this comment:
Check if you are using webpack dev server CLI setup.

• If you're affected, upgrade this dependency to at least version 5.2.1 at package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-auth0-extensions-1]

Medium severity vulnerability may affect your project—review required:
Line 8680 lists a dependency (webpack-dev-server) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of webpack-dev-server are vulnerable to Origin Validation Error. webpack-dev-server improperly validates the WebSocket connection Origin header, unconditionally accepting any IP-address-based Origin. A malicious website can perform a cross-site WebSocket hijack against a running dev server and exfiltrate the developer source code carried in Hot Module Reloading (HMR) messages. The insecure origin check is the package default and is reached on every WebSocket connection, so any project running an affected version is vulnerable.

References: GHSA, CVE

To resolve this comment:
Check if you are using webpack dev server CLI setup and access untrusted web site with non-Chromium based browser.

• If you're affected, upgrade this dependency to at least version 5.2.1 at package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-auth0-extensions-1]

High severity vulnerability may affect your project—review required:
Line 5648 lists a dependency (js-yaml) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key (<<), causing js-yaml to spend quadratic CPU time while parsing input whose size grows only linearly, resulting in a denial of service.

References: GHSA, CVE

To resolve this comment:
Check if you are using js-yaml on the CLI.

• If you're affected, upgrade this dependency to at least version 3.15.0 at package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[semgrep-code-auth0-extensions-1]

High severity vulnerability may affect your project—review required:
Line 1069 lists a dependency (@babel/plugin-transform-modules-systemjs) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of @babel/plugin-transform-modules-systemjs are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') / Improper Control of Generation of Code ('Code Injection'). @babel/plugin-transform-modules-systemjs mishandles module string specifiers when compiling code into SystemJS module form. An attacker who can supply specially crafted source code to a Babel build that uses this plugin (directly, or transitively via @babel/preset-env configured with modules: "systemjs") can cause Babel to emit output that executes arbitrary JavaScript when the compiled bundle is loaded.

References: GHSA, CVE

To resolve this comment:
Check if you install @babel/plugin-transform-modules-systemjs plugin through cli, or use @babel/preset-env preset with modules set to "systemjs".

• If you're affected, upgrade this dependency to at least version 7.29.4 at package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}