react-devtools-core depends on potentially insecure "ws" version 2.0.3

[uncttao]

It is reported by security tools such as Snyk that "ws@2.0.3" suffers from Denial of Service(DoS) vulnerabilities. This security flaw is already fixed by the author of "ws" in newer versions. We greatly appreciate it if React team could upgrade "ws" to a non-vulnerable version as soon as possible.

[byCedric]

With Node Security Platform this is also flagged as High (7.5 CVSS) Here is the report you get when running the nsp check command. If help is needed I wouldn't mind to pitch in!

┌────────────┬────────────────────────────────────────────────────────────────────┐
│            │ Denial of Service                                                  │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Name       │ ws                                                                 │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ CVSS       │ 7.5 (High)                                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Installed  │ 2.3.1                                                              │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Vulnerable │ <1.1.5 || >=2.0.0 <3.3.1                                           │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Patched    │ >= 1.1.5 <2.0.0 || >=3.3.1                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Path       │ react-native@0.54.0 > react-devtools-core@3.1.0 > ws@2.3.1         |                        │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ More Info  │ https://nodesecurity.io/advisories/550                             │
└────────────┴────────────────────────────────────────────────────────────────────┘

[byCedric]

Any update on this issue? I see the project still uses the vulnerable version of ws.

[byCedric]

Casually pinging this issue for any response or progress on this issue. If necessary I can help fixing this issue once and for all...

[jeffvandyke]

Just thought I should mention that with npm 6, everybody using react-native will get at least one high-severity vulnerability message (whether actually relevant for react-native development or not) due to the transitive dependency on ws <3.3.1. Advisory at https://nodesecurity.io/advisories/550, ws package at https://github.com/websockets/ws, currently at v5.1.1

[byCedric]

As a nice addition, npm audit now "fails" (exit code 1) on every issue including this one. Please consider this security issue as important. A pull request containing the fix is created already and can be merged right?

[bvaughn]

react-devtools-core 3.2.2 has been published with this fix.

Sorry for the long turnaround time. ☹️ Thanks for bringing it to our attention. ❤️

[byCedric]

No worries, things happen. Thanks for the fix!

[chef-sudo]

Hi,

I'm getting an exception on react-native run-android
while the index.js exists in the root of the project

Metro Bundler ready.

Loading dependency graph, done.
error: bundling failed: NotFoundError: Cannot find entry file index.js in any of the roots: ["c:\\Workspace\\Mobile\\PizzaApp"]
    at DependencyGraph.getAbsolutePath (c:\Workspace\Mobile\PizzaApp\node_modules\metro\src\node-haste\DependencyGraph.js:317:11)
    at c:\Workspace\Mobile\PizzaApp\node_modules\metro\src\DeltaBundler\DeltaCalculator.js:280:416
    at Generator.next (<anonymous>)
    at step (c:\Workspace\Mobile\PizzaApp\node_modules\metro\src\DeltaBundler\DeltaCalculator.js:11:445)
    at c:\Workspace\Mobile\PizzaApp\node_modules\metro\src\DeltaBundler\DeltaCalculator.js:11:605
    at process._tickCallback (internal/process/next_tick.js:68:7)
 BUNDLE  [android, dev] ./index.js ░░░░░░░░░░░░░░░░ 0.0% (0/1), failed.

Steps to reproduce

1. ignite new PizzaApp ( choose bowser )
2. cd to dir & npm install

......
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN eslint-plugin-react-native@3.2.1 requires a peer of eslint@^3.17.0 || ^4.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN jest-preset-ignite@0.5.0 requires a peer of jest@^22.4.2 but none is installed. You must install peer dependencies yourself.
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@1.2.4 (node_modules\fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@1.2.4: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"})

added 506 packages from 564 contributors, removed 136 packages, updated 1673 packages and audited 49549 packages in 192.102s
found 3 vulnerabilities (2 low, 1 high)
  run `npm audit fix` to fix them, or `npm audit` for details

npm audit

  High            Denial of Service                                        
                                                                           
  Package         ws                                                       
                                                                           
  Patched in      >= 1.1.5 <2.0.0 || >=3.3.1                               
                                                                           
  Dependency of   react-native                                             
                                                                           
  Path            react-native > react-devtools-core > ws                  
                                                                           
  More info       https://nodesecurity.io/advisories/550                   
                                                                           
                                                                           
  Low             Prototype Pollution                                      
                                                                           
  Package         lodash                                                   
                                                                           
  Patched in      >=4.17.5                                                 
                                                                           
  Dependency of   react-native                                             
                                                                           
  Path            react-native > plist > xmlbuilder > lodash               
                                                                           
  More info       https://nodesecurity.io/advisories/577                   
                                                                           
                                                                           
  Low             Prototype Pollution                                      
                                                                           
  Package         lodash                                                   
                                                                           
  Patched in      >=4.17.5                                                 
                                                                           
  Dependency of   solidarity                                               
                                                                           
  Path            solidarity > gluegun > cli-table2 > lodash               
                                                                           
  More info       https://nodesecurity.io/advisories/577                   
                                                                           
found 3 vulnerabilities (2 low, 1 high) in 49549 scanned packages          
  3 vulnerabilities require manual review. See the full report for details.

package.json

{
  "name": "PizzaApp",
  "version": "0.0.1",
  "private": true,
  "scripts": {
    "start": "node node_modules/react-native/local-cli/cli.js start",
    "test": "jest",
    "compile": "tsc --noEmit -p . --pretty",
    "format": "npm-run-all format:*",
    "format:js": "prettier --write {.,**}/*.js",
    "format:json": "prettier --write {.,**}/*.json",
    "format:md": "prettier --write {.,**}/*.md",
    "format:ts": "prettier --write {.,**}/*.{ts,tsx} && tslint --fix -p .",
    "lint": "npm-run-all lint:*",
    "lint:ts": "tslint -p .",
    "postinstall": "solidarity",
    "precommit": "lint-staged",
    "hack:types-react-navigation": "rimraf node_modules/@types/react-navigation/node_modules/@types",
    "hack:types-react-native": "rimraf node_modules/@types/react-native/node_modules/@types",
    "hack:types-react-test-renderer": "rimraf node_modules/@types/react-test-renderer/node_modules/@types",
    "patch": "patch-package",
    "prepare": "npm-run-all patch hack:*",
    "storybook": "storybook start -p 9001 --skip-packager"
  },
  "dependencies": {
    "apisauce": "^0.15.1",
    "lodash.throttle": "4.1.1",
    "mobx": "^4.3.0",
    "mobx-react": "5.1.2",
    "mobx-state-tree": "2.0.5",
    "ramda": "0.25.0",
    "react": "^16.4.0",
    "react-devtools-core": "^3.2.3",
    "react-native": "^0.55.0",
    "react-native-i18n": "2.0.12",
    "react-native-keychain": "3.0.0-rc.3",
    "react-native-segmented-control-tab": "^3.2.2",
    "react-navigation": "1.5.12",
    "reactotron-mst": "2.0.0-beta.2",
    "reactotron-react-native": "2.0.0-beta.2",
    "validate.js": "0.12.0"
  },
  "devDependencies": {
    "@storybook/addon-storyshots": "^3.4.6",
    "@storybook/react-native": "^3.4.6",
    "@types/jest": "22.2.3",
    "@types/ramda": "^0.25.32",
    "@types/react": "^16.3.16",
    "@types/react-native": "^0.55.16",
    "@types/react-navigation": "1.5.2",
    "@types/react-test-renderer": "16.0.1",
    "@types/validate.js": "0.11.0",
    "babel-jest": "23.0.1",
    "babel-plugin-transform-inline-environment-variables": "^0.4.3",
    "babel-preset-react-native": "4.0.0",
    "husky": "0.14.3",
    "ignite-ir-boilerplate-bowser": "^1.0.0-alpha.5",
    "jest": "23.1.0",
    "jest-preset-ignite": "0.5.0",
    "lint-staged": "^7.1.3",
    "npm-run-all": "4.1.3",
    "patch-package": "5.1.1",
    "postinstall-prepare": "1.0.1",
    "prettier": "^1.13.3",
    "react-dom": "^16.4.0",
    "react-native-typescript-transformer": "^1.2.9",
    "react-powerplug": "0.1.5",
    "react-test-renderer": "^16.4.0",
    "rimraf": "2.6.2",
    "solidarity": "2.1.0",
    "tslint": "5.10.0",
    "tslint-config-prettier": "^1.13.0",
    "typescript": "^2.9.1"
  },
  "jest": {
    "preset": "jest-preset-ignite"
  },
  "rnpm": {
    "assets": [
      "./src/theme/fonts/"
    ]
  },
  "lint-staged": {
    "*.js": [
      "prettier --write",
      "git add"
    ],
    "*.{ts,tsx}": [
      "prettier --write",
      "tslint --fix",
      "git add"
    ],
    "*.md": [
      "prettier --write",
      "git add"
    ],
    "*.json": [
      "prettier --write",
      "git add"
    ]
  }
}

Please advise,
Thanks