Fix vulnerability in tar < 4.2.2

npm audit reports a bad vulnerability in tar < 4.2.2. It has been reported since April 5th.

Etherpad-lite isn’t using tar directly though. The dependency chain is npm > npm-lifecycle > node-gyp > tar.

So we need to wait for the chain to publish new versions with the dependencies fixed:

• Wait for a fixed version of node-gyp 3.x to be released (https://github.com/nodejs/node-gyp/pull/1718)
• Wait for a fixed version of npm to be released
• Bump the npm dependency.

(This issue is just for tracking the progress of updates in the dependencies chain.)

[muxator]

An updated version of npm (6.10.3) and npm-lifecycle fixes the vulnerabilities. We can close this.

[muxator]

Wow. Thanks @gobengo, nice sum up.

I did a quick check (install only) using npm-force-resolutions, and npm audit actually stopped listing the vulnerabilities on tar.

But this is so ugly I am still doubtful:

• we cannot know if this is functionally correct

• npm-force-resolutions basically performs a tool-assisted surgery on package-lock.json, and Etherpad does not come with one. The reason is not laziness, but the “peculiar” directory structure, startup & installation mode of Etherpad, which makes things hairy

• going this way has potentially no end. There is already another high profile vulnerability remaining on npm:

  ┌───────────────┬──────────────────────────────────────────────────────────────┐
  │ High          │ Arbitrary File Overwrite                                     │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Package       │ fstream                                                      │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Patched in    │ >=1.0.12                                                     │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Dependency of │ npm                                                          │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ Path          │ npm > libcipm > npm-lifecycle > node-gyp > fstream           │
  ├───────────────┼──────────────────────────────────────────────────────────────┤
  │ More info     │ https://nodesecurity.io/advisories/886                       │
  └───────────────┴──────────────────────────────────────────────────────────────┘
  

  This one was reported on 2019-05-19: https://www.npmjs.com/advisories/886.

  What to do here? We could continue forcing resolutions, but at that point we would basically end up doing npm’s work, and I am not really sure this would be healty for the project 😕

At least, thanks to your analysis, we now know that we are at the mercy of the npm team, and this is insane.