Skip to content
This repository was archived by the owner on Dec 15, 2020. It is now read-only.
This repository was archived by the owner on Dec 15, 2020. It is now read-only.

[Security] Fix 195 known vulnerabilities #72

Open
Open
[Security] Fix 195 known vulnerabilities#72
@mike-north

Description

@mike-north
mike-north
opened on Jul 9, 2018

This is a big can of worms to open up, but there are a bunch of security issues in this project's dependencies (mostly mocha and ember-cli). Unfortunately, upgrading ember-cli to the point where these issues are patched causes problems in this project's tests (which depend on now-removed private cli internals)

Don't use private internals of packages you depend on

Since this package was originally written, the terminal I/O stuff has been extracted to console-ui, and a feature that ember-cli-release's tests heavily rely on has been removed due to e-cli's own tests no longer needing it.

Through subclassing MockUI (once obtained from console-ui), we can get these back

function TestUI() {}
TestUI.prototype = new MockUI();

TestUI.prototype.waitForPrompt = function() {
  if (!this._waitingForPrompt) {
    var promise, resolver;
    promise = new Promise(function(resolve){
      resolver = resolve;
    });
    this._waitingForPrompt = promise;
    this._promptResolver = resolver;
  }
  return this._waitingForPrompt;
};

TestUI.prototype.prompt = function(opts, cb) {
  if (this._waitingForPrompt) {
    this._waitingForPrompt = null;
    this._promptResolver();
  }
  return MockUI.prototype.prompt.call(this, opts, cb);
}

Inquirer is annoying

I've spent a few hours digging really deep into this, and am at the point where we can no longer reliably mock answers to inquirer questions. Inquirer's own tests are a shining example of why mocking and stubbing out the whole world is a bad idea (tests aren't even run against real input/output streams, and use tons of testing helpers that aren't easily available to consumers). Because inquirer is a dependency of ember-cli (and we don't really interact with it directly), we're even farther removed from this thing that we need to alter in big ways to test effectively.

I have escalated this to the ember-cli team, and can resume working on this once I have an answer, and more OSS time

Backup plan

If beating inquirer into submission proves to time consuming or difficult, we should explore rewriting the tests in such a way that the console-ui is mocked entirely. This would be a regrettable, result of working with test-hostile dependencies of dependencies.

found 195 vulnerabilities (27 low, 112 moderate, 54 high, 2 critical)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions