角度工程中的Lodash漏洞

Question

在将npm安装到模糊管理模板https://github.com/akveo/blur-admin之后

我通过在npm审计对话框中使用run recomendations解决了许多问题。但是，即使在跑完之后，我也无法修复它。

$ npm install lodash@latest --save

我已经更新了package.json中的存档：

{
  "name": "blur_admin",
  "version": "1.3.1",
  "devDependencies": {
    "bower": "~1.8.4",
    "browser-sync": "^2.26.3",
    "browser-sync-spa": "~1.0.3",
    "chalk": "~1.1.1",
    "del": "~2.2.2",
    "eslint-plugin-angular": "~0.12.0",
    "estraverse": "~4.2.0",
    "gulp": "^4.0.0",
    "gulp-angular-filesort": "^1.2.1",
    "gulp-angular-templatecache": "~2.0.0",
    "gulp-autoprefixer": "~3.1.1",
    "gulp-eslint": "^5.0.0",
    "gulp-filter": "~4.0.0",
    "gulp-flatten": "~0.3.1",
    "gulp-gh-pages": "^0.5.4",
    "gulp-inject": "~4.1.0",
    "gulp-load-plugins": "~1.4.0",
    "gulp-minify-css": "~1.2.1",
    "gulp-minify-html": "~1.0.4",
    "gulp-ng-annotate": "~2.0.0",
    "gulp-prompt": "^1.1.0",
    "gulp-protractor": "^4.1.0",
    "gulp-rename": "^1.2.2",
    "gulp-replace": "~0.5.4",
    "gulp-rev": "~7.1.2",
    "gulp-rev-replace": "~0.4.2",
    "gulp-sass": "^4.0.1",
    "gulp-shell": "^0.5.2",
    "gulp-size": "~2.1.0",
    "gulp-sourcemaps": "~1.6.0",
    "gulp-uglify": "~2.0.0",
    "gulp-useref": "^3.1.6",
    "gulp-util": "~3.0.6",
    "gulp-zip": "^3.0.2",
    "http-proxy-middleware": "~0.17.2",
    "lodash": "^4.17.11",
    "main-bower-files": "~2.13.1",
    "uglify-save-license": "~0.4.1",
    "wiredep": "~4.0.0",
    "wrench": "~1.5.8"
  },
  "scripts": {
    "postinstall": "bower install"
  }
}

但是仍然得到: PS D:\dev\Blur-Admin \blur-admin-master\blur-admin-master> npm审计

                       === npm audit security report ===


                                 Manual Review
             Some vulnerabilities require your attention to resolve

          Visit https://go.npm.me/audit-guide for additional guidance


  Low             Prototype Pollution

  Package         lodash

  Patched in      >=4.17.5

  Dependency of   browser-sync-spa [dev]

  Path            browser-sync-spa > opt-merger > lodash

  More info       https://nodesecurity.io/advisories/577

found 1 low severity vulnerability in 13272 scanned packages
  1 vulnerability requires manual review. See the full report for details.
PS D:\dev\Blur-Admin test\blur-admin-master\blur-admin-master>

我什么都试过了！

Answer 1

这通常意味着您的project.json中的其他项目依赖项之一依赖目录，而且它们没有修补它们的pacakge.json。

错误声明它是哪个："browser-sync-spa"和它的路径：

browser-sync-spa > opt-merger > lodash

您必须在browser-sync-spa或opt-merger上打开一个问题来更新他们的repo/package.json，或者为他们打开一个PR。

其他的选择是接受它或Fork他们的项目，也就是nuclear option。