From b01f0c94696addc4f3ec386c0447f297731141f2 Mon Sep 17 00:00:00 2001 From: Dan J Miller Date: Thu, 12 Sep 2024 18:03:09 -0230 Subject: [PATCH] fix: Resolve path-to-regexp to v1.9.0 to resolve GHSA-9wv6-86v2-598j (#27113) Co-authored-by: MetaMask Bot --- .yarnrc.yml | 11 ----------- lavamoat/browserify/beta/policy.json | 6 +++--- lavamoat/browserify/flask/policy.json | 6 +++--- lavamoat/browserify/main/policy.json | 6 +++--- lavamoat/browserify/mmi/policy.json | 6 +++--- package.json | 3 ++- yarn.lock | 22 ++++------------------ 7 files changed, 18 insertions(+), 42 deletions(-) diff --git a/.yarnrc.yml b/.yarnrc.yml index 7fb86a083740..252333917781 100644 --- a/.yarnrc.yml +++ b/.yarnrc.yml @@ -43,17 +43,6 @@ npmAuditIgnoreAdvisories: # not appear to be used. - 1092461 - # Issue: path-to-regexp outputs backtracking regular expressions - # URL: https://github.com/advisories/GHSA-9wv6-86v2-598j - # path-to-regexp is used in react-router v5.1.2, which we use. However, the - # vulnerability in path-to-regexp could only be exploited within react-router - # if malicious properties were passed to react-router components or methods - # explicitly from our code. As such, this vulneratibility cannot be exploited - # by an external / malicious actor. Meanwhile, once we update to v6+, - # path-to-regexp will no longer be used. - - 1099518 - - 1099539 - # Temp fix for https://github.com/MetaMask/metamask-extension/pull/16920 for the sake of 11.7.1 hotfix # This will be removed in this ticket https://github.com/MetaMask/metamask-extension/issues/22299 - 'ts-custom-error (deprecation)' diff --git a/lavamoat/browserify/beta/policy.json b/lavamoat/browserify/beta/policy.json index de4fafac732e..26137793901e 100644 --- a/lavamoat/browserify/beta/policy.json +++ b/lavamoat/browserify/beta/policy.json @@ -5219,7 +5219,7 @@ "react-router-dom>react-router>mini-create-react-context": true, "react-router-dom>tiny-invariant": true, "react-router-dom>tiny-warning": true, - "sinon>nise>path-to-regexp": true + "serve-handler>path-to-regexp": true } }, "react-router-dom>react-router>history": { @@ -5369,9 +5369,9 @@ "process": true } }, - "sinon>nise>path-to-regexp": { + "serve-handler>path-to-regexp": { "packages": { - "sinon>nise>path-to-regexp>isarray": true + "serve-handler>path-to-regexp>isarray": true } }, "stream-browserify": { diff --git a/lavamoat/browserify/flask/policy.json b/lavamoat/browserify/flask/policy.json index de4fafac732e..26137793901e 100644 --- a/lavamoat/browserify/flask/policy.json +++ b/lavamoat/browserify/flask/policy.json @@ -5219,7 +5219,7 @@ "react-router-dom>react-router>mini-create-react-context": true, "react-router-dom>tiny-invariant": true, "react-router-dom>tiny-warning": true, - "sinon>nise>path-to-regexp": true + "serve-handler>path-to-regexp": true } }, "react-router-dom>react-router>history": { @@ -5369,9 +5369,9 @@ "process": true } }, - "sinon>nise>path-to-regexp": { + "serve-handler>path-to-regexp": { "packages": { - "sinon>nise>path-to-regexp>isarray": true + "serve-handler>path-to-regexp>isarray": true } }, "stream-browserify": { diff --git a/lavamoat/browserify/main/policy.json b/lavamoat/browserify/main/policy.json index de4fafac732e..26137793901e 100644 --- a/lavamoat/browserify/main/policy.json +++ b/lavamoat/browserify/main/policy.json @@ -5219,7 +5219,7 @@ "react-router-dom>react-router>mini-create-react-context": true, "react-router-dom>tiny-invariant": true, "react-router-dom>tiny-warning": true, - "sinon>nise>path-to-regexp": true + "serve-handler>path-to-regexp": true } }, "react-router-dom>react-router>history": { @@ -5369,9 +5369,9 @@ "process": true } }, - "sinon>nise>path-to-regexp": { + "serve-handler>path-to-regexp": { "packages": { - "sinon>nise>path-to-regexp>isarray": true + "serve-handler>path-to-regexp>isarray": true } }, "stream-browserify": { diff --git a/lavamoat/browserify/mmi/policy.json b/lavamoat/browserify/mmi/policy.json index 40a0dab601ea..4f930c04aed8 100644 --- a/lavamoat/browserify/mmi/policy.json +++ b/lavamoat/browserify/mmi/policy.json @@ -5287,7 +5287,7 @@ "react-router-dom>react-router>mini-create-react-context": true, "react-router-dom>tiny-invariant": true, "react-router-dom>tiny-warning": true, - "sinon>nise>path-to-regexp": true + "serve-handler>path-to-regexp": true } }, "react-router-dom>react-router>history": { @@ -5437,9 +5437,9 @@ "process": true } }, - "sinon>nise>path-to-regexp": { + "serve-handler>path-to-regexp": { "packages": { - "sinon>nise>path-to-regexp>isarray": true + "serve-handler>path-to-regexp>isarray": true } }, "stream-browserify": { diff --git a/package.json b/package.json index 8b49001cfe14..81c53bb0146d 100644 --- a/package.json +++ b/package.json @@ -267,7 +267,8 @@ "@metamask/nonce-tracker@npm:^5.0.0": "patch:@metamask/nonce-tracker@npm%3A5.0.0#~/.yarn/patches/@metamask-nonce-tracker-npm-5.0.0-d81478218e.patch", "@metamask/keyring-controller@npm:^16.0.0": "patch:@metamask/keyring-controller@npm%3A17.1.1#~/.yarn/patches/@metamask-keyring-controller-npm-17.1.1-098cb41930.patch", "@metamask/keyring-controller@npm:^17.1.0": "patch:@metamask/keyring-controller@npm%3A17.1.1#~/.yarn/patches/@metamask-keyring-controller-npm-17.1.1-098cb41930.patch", - "@trezor/connect-web@npm:^9.1.11": "patch:@trezor/connect-web@npm%3A9.3.0#~/.yarn/patches/@trezor-connect-web-npm-9.3.0-040ab10d9a.patch" + "@trezor/connect-web@npm:^9.1.11": "patch:@trezor/connect-web@npm%3A9.3.0#~/.yarn/patches/@trezor-connect-web-npm-9.3.0-040ab10d9a.patch", + "path-to-regexp": "1.9.0" }, "dependencies": { "@babel/runtime": "patch:@babel/runtime@npm%3A7.24.0#~/.yarn/patches/@babel-runtime-npm-7.24.0-7eb1dd11a2.patch", diff --git a/yarn.lock b/yarn.lock index 5d333062da8a..f00445f63771 100644 --- a/yarn.lock +++ b/yarn.lock @@ -28946,26 +28946,12 @@ __metadata: languageName: node linkType: hard -"path-to-regexp@npm:0.1.7": - version: 0.1.7 - resolution: "path-to-regexp@npm:0.1.7" - checksum: 10/701c99e1f08e3400bea4d701cf6f03517474bb1b608da71c78b1eb261415b645c5670dfae49808c89e12cea2dccd113b069f040a80de012da0400191c6dbd1c8 - languageName: node - linkType: hard - -"path-to-regexp@npm:2.2.1": - version: 2.2.1 - resolution: "path-to-regexp@npm:2.2.1" - checksum: 10/1a7125f8c1b5904d556a29722333219df4aa779039e903efe2fbfe0cc3ae9246672846fc8ad285664020b70e434347e0bc9af691fd7d61df8eaa7b018dcd56fb - languageName: node - linkType: hard - -"path-to-regexp@npm:^1.7.0": - version: 1.7.0 - resolution: "path-to-regexp@npm:1.7.0" +"path-to-regexp@npm:1.9.0": + version: 1.9.0 + resolution: "path-to-regexp@npm:1.9.0" dependencies: isarray: "npm:0.0.1" - checksum: 10/7e1275a34fcfed7ba9d0d82ea7149f0c87d8c941c9b34109ab455cceb783b6387ce9275deeb6519eb0f880777a44bcb387cd579d3bb0cfbf4e7fe93c0e3b1a69 + checksum: 10/67f0f4823f7aab356523d93a83f9f8222bdd119fa0b27a8f8b587e8e6c9825294bb4ccd16ae619def111ff3fe5d15ff8f658cdd3b0d58b9c882de6fd15bc1b76 languageName: node linkType: hard