(security): update webpack-dev-server to address cves #1473

d-buckner · 2024-12-09T21:47:03Z

Description

This addresses 11 CVEs associated with webpack-dev-server v3.

Resolved CVE	Vulnerable Library
CVE-2024-37890	ws-6.2.2
CVE-2024-43796	express-4.19.2
CVE-2024-45590	body-parser-1.20.2
CVE-2024-21536	http-proxy-middleware-0.19.1
CVE-2024-47764	cookie-0.6.0
CVE-2024-29415	ip-1.1.9
CVE-2024-29180	webpack-dev-middleware-3.7.2
CVE-2024-52798	path-to-regexp-0.1.7
CVE-2024-45296	path-to-regexp-0.1.7
CVE-2024-43800	serve-static-1.15.0
CVE-2024-43799	send-0.18.0

Issues Resolved

fixes #389

Verification

I was able to diff the dist artifacts with and without these changes. The only change across all of the generated artifacts is in the charts_theme module.

/******/ 	// Load entry module and return exports
- /******/ 	return __webpack_require__(__webpack_require__.s = "./themes/charts/themes.ts");
+ /******/ 	return __webpack_require__(__webpack_require__.s = 0);
/******/ })

I've validated that the imported chart theme object is identical as is the type definition file.

I've also manually validated the docs pages.

Check List

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Daniel Rowe <[email protected]>

virajsanghvi

How have we tested the impact of this change? Can we validate it doesn't have impact on generated artifacts?

virajsanghvi · 2024-12-10T18:25:26Z

CHANGELOG.md

@@ -40,6 +40,7 @@

 ### 🛡 Security
 - Update cross-spawn to address CVE ([#1469](https://github.com/opensearch-project/oui/pull/1469))
+- Update webpack and webpack-dev-server to address CVEs ([#1473](https://github.com/opensearch-project/oui/pull/1473))


We'd want to to move the existing unreleased items to 1.18 and then add this to the unreleased section

Makes sense, I'll update this

package.json

d-buckner · 2024-12-10T20:29:05Z

How have we tested the impact of this change? Can we validate it doesn't have impact on generated artifacts?

I've done cursory testing with the integration tests and by running the dev server. I'm planning on also doing the following

update webpack-cli since I realize it's mismatched with webpack itself. One breaking change I know I'll have to address is the deprecation of the --output-library-target override we use to compile the charts to commonjs.
diff the dist folder with a build with and without this change.

@virajsanghvi Let me know if this doesn't properly address your comment.

Signed-off-by: Daniel Rowe <[email protected]>

d-buckner · 2024-12-11T22:13:21Z

I've updated with the webpack-cli update and I've added the verification process in the PR description.

d-buckner · 2024-12-11T22:18:34Z

scripts/compile-charts.js

+        --env filename=${outputFilename} \
+        --env library-target=commonjs`,


These are no longer directly configurable from the cli after the update. I've updated these to get passed into the webpack config.

nit: Anything you see around /* OUI -> EUI Aliases */ was semi-automatically added when we were adding aliases and are meant to be semi-automatically removable. Pulling this into a util function, while the originals code blocks will be removed with the next major release, the util will be left over.

PS: noticed that it would still be used by the OUI version after the next major version.

Gotcha. The util is also used for the non-aliased build.

yarn.lock

Signed-off-by: Daniel Rowe <[email protected]>

* (security): update webpack & webpack-dev-server Signed-off-by: Daniel Rowe <[email protected]> * update changelog, fix types Signed-off-by: Daniel Rowe <[email protected]> * revert webpack-cli upgrade Signed-off-by: Daniel Rowe <[email protected]> * address breaking changes with webpack-cli upgrade Signed-off-by: Daniel Rowe <[email protected]> * update changelog Signed-off-by: Daniel Rowe <[email protected]> * revert change to main webpack release Signed-off-by: Daniel Rowe <[email protected]> --------- Signed-off-by: Daniel Rowe <[email protected]> (cherry picked from commit b2005bd) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> # Conflicts: # CHANGELOG.md

* (security): update webpack & webpack-dev-server Signed-off-by: Daniel Rowe <[email protected]> * update changelog, fix types Signed-off-by: Daniel Rowe <[email protected]> * revert webpack-cli upgrade Signed-off-by: Daniel Rowe <[email protected]> * address breaking changes with webpack-cli upgrade Signed-off-by: Daniel Rowe <[email protected]> * update changelog Signed-off-by: Daniel Rowe <[email protected]> * revert change to main webpack release Signed-off-by: Daniel Rowe <[email protected]> --------- Signed-off-by: Daniel Rowe <[email protected]> (cherry picked from commit b2005bd) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> # Conflicts: # CHANGELOG.md Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

(security): update webpack & webpack-dev-server

e209f51

Signed-off-by: Daniel Rowe <[email protected]>

github-actions bot added the first-time-contributor label Dec 9, 2024

d-buckner added 2 commits December 9, 2024 14:17

update changelog, fix types

4bad86e

Signed-off-by: Daniel Rowe <[email protected]>

revert webpack-cli upgrade

4a10319

Signed-off-by: Daniel Rowe <[email protected]>

d-buckner marked this pull request as ready for review December 10, 2024 18:02

d-buckner requested review from AMoo-Miki, bandinib-amzn, ashwin-pc, joshuarrrr and virajsanghvi as code owners December 10, 2024 18:02

virajsanghvi reviewed Dec 10, 2024

View reviewed changes

d-buckner added 2 commits December 11, 2024 13:51

address breaking changes with webpack-cli upgrade

624ea4e

Signed-off-by: Daniel Rowe <[email protected]>

update changelog

e76bbb0

Signed-off-by: Daniel Rowe <[email protected]>

d-buckner commented Dec 11, 2024

View reviewed changes

AMoo-Miki reviewed Dec 12, 2024

View reviewed changes

yarn.lock Outdated Show resolved Hide resolved

revert change to main webpack release

e24a4b0

Signed-off-by: Daniel Rowe <[email protected]>

d-buckner changed the title ~~(security): update webpack & webpack-dev-server~~ (security): update webpack-dev-server to address cves Dec 12, 2024

AMoo-Miki approved these changes Dec 12, 2024

View reviewed changes

virajsanghvi approved these changes Dec 12, 2024

View reviewed changes

virajsanghvi merged commit b2005bd into opensearch-project:main Dec 12, 2024
16 checks passed

virajsanghvi added the backport 1.x label Dec 12, 2024

opensearch-trigger-bot bot mentioned this pull request Dec 12, 2024

[Backport 1.x] (security): update webpack-dev-server to address cves #1477

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

(security): update webpack-dev-server to address cves #1473

(security): update webpack-dev-server to address cves #1473

d-buckner commented Dec 9, 2024 •

edited

Loading

virajsanghvi left a comment

virajsanghvi Dec 10, 2024

d-buckner Dec 10, 2024

d-buckner commented Dec 10, 2024

d-buckner commented Dec 11, 2024

d-buckner Dec 11, 2024

AMoo-Miki Dec 11, 2024 •

edited

Loading

d-buckner Dec 12, 2024

		--env filename=${outputFilename} \
		--env library-target=commonjs`,

(security): update webpack-dev-server to address cves #1473

(security): update webpack-dev-server to address cves #1473

Conversation

d-buckner commented Dec 9, 2024 • edited Loading

Description

Issues Resolved

Verification

Check List

virajsanghvi left a comment

Choose a reason for hiding this comment

virajsanghvi Dec 10, 2024

Choose a reason for hiding this comment

d-buckner Dec 10, 2024

Choose a reason for hiding this comment

d-buckner commented Dec 10, 2024

d-buckner commented Dec 11, 2024

d-buckner Dec 11, 2024

Choose a reason for hiding this comment

AMoo-Miki Dec 11, 2024 • edited Loading

Choose a reason for hiding this comment

d-buckner Dec 12, 2024

Choose a reason for hiding this comment

d-buckner commented Dec 9, 2024 •

edited

Loading

AMoo-Miki Dec 11, 2024 •

edited

Loading