[🐸 Frogbot] Upgrade angular to 1.8.0

[github-actions]

📦 Vulnerable Dependencies

✍️ Summary

SEVERITY	CONTEXTUAL ANALYSIS	DIRECT DEPENDENCIES	IMPACTED DEPENDENCY	FIXED VERSIONS	CVES
High	Undetermined	angular:1.3.9	angular 1.3.9	[1.7.9]	CVE-2019-10768

🔬 Research Details

Description:
angular is a development platform for building mobile and desktop web applications using Typescript/JavaScript and other languages.

The function merge was found to be vulnerable to prototype pollution, when accepting arbitrary source objects from untrusted input

Example of code vulnerable to this issue -

const angular = require('angular'); 
const evilsrc = {__proto__: {evilkey: "evilvalue"}}
angular.merge({}, evilsrc)

Remediation:

Development mitigations

Add the Object.freeze(Object.prototype); directive once at the beginning of your main JS source code file (ex. index.js), preferably after all your require directives. This will prevent any changes to the prototype object, thus completely negating prototype pollution attacks.

---

🐸 JFrog Frogbot