[SECURITY] advisories/GHSA-mjr4-7xg5-pfvh for optional dependency `libxmljs2`

[artola]

https://github.com/CycloneDX/cyclonedx-javascript-library/pull/668/files#r1171603405

[jkowalleck]

seams to be fixed for a while. https://github.com/CycloneDX/cyclonedx-javascript-library/blob/309dd5ac4dbb96303759a1dcc083dd56dff3708d/package.json#L72C1-L72C44

[artola]

seams to be fixed for a while. https://github.com/CycloneDX/cyclonedx-javascript-library/blob/309dd5ac4dbb96303759a1dcc083dd56dff3708d/package.json#L72C1-L72C44

I do not think so, see:
https://github.com/marudor/libxmljs2/issues/210

See advisory: GHSA-mjr4-7xg5-pfvh

[jkowalleck]

you approach with no info, just drop a link to some outdated code from Apr 19, 2023
for an optional dependency.

• What is the observed behavior?
• What is the expected behavior?
• what is the problem you try to solve?
• What are use (edge-/none-)cases and (out-of-)scopes and?

[artola]

@jkowalleck is totally right. Perhaps this issue should be moved to the other @CycloneDX package, but since this is the initiator.

• About optional dependency:

  An optional dependency is installed by npm even if it's not listed under dependencies because it's listed under optionalDependencies.
  When you run npm install, npm will try to install all dependencies listed in both dependencies and optionalDependencies.
  The difference is that if an optional dependency fails to install, npm will not stop the installation process, whereas if a regular dependency fails to install, npm will throw an error and stop the installation.
  So, even though libxmljs2 is not listed under dependencies, it will still be installed because it's listed under optionalDependencies.

• What is the observed behavior?
  There is a vulnerability in libxmljs2 that is a transcend dependency of @cyclonedx/webpack-plugin.

   └─ @cyclonedx/webpack-plugin@npm:3.10.0 [6950a] (via npm:^3.8.2 [6950a])
      └─ @cyclonedx/cyclonedx-library@npm:6.6.0 (via npm:^6.5.0)
         └─ libxmljs2@npm:0.33.0 (via npm:^0.31 || ^0.32 || ^0.33)

├─ libxmljs2
│  ├─ ID: 1097224
│  ├─ Issue: libxmljs2 type confusion vulnerability when parsing specially crafted XML
│  ├─ URL: https://github.com/advisories/GHSA-mjr4-7xg5-pfvh
│  ├─ Severity: high
│  ├─ Vulnerable Versions: <=0.33.0
│  │ 
│  ├─ Tree Versions
│  │  └─ 0.33.0
│  │ 
│  └─ Dependents
│     └─ @cyclonedx/cyclonedx-library@npm:6.6.0
│
└─ libxmljs2
   ├─ ID: 1097230
   ├─ Issue: libxmljs vulnerable to type confusion when parsing specially crafted XML
   ├─ URL: https://github.com/advisories/GHSA-78h3-pg4x-j8cv
   ├─ Severity: high
   ├─ Vulnerable Versions: <=1.0.11
   │ 
   ├─ Tree Versions
   │  └─ 0.33.0
   │ 
   └─ Dependents
      └─ @cyclonedx/cyclonedx-library@npm:6.6.0

• What is the expected behavior?
  The expected behavior is for the package to have no known vulnerabilities.

• what is the problem you try to solve?
  The problem being addressed is the existence of vulnerabilities, which are detrimental for various reasons.

• What are use (edge-/none-)cases and (out-of-)scopes and?
  The package introduces a vulnerability for which we cannot estimate the impact. Additionally, the author has stated that they do not maintain the package nor possess the necessary expertise to address the issue.

[jkowalleck]

• What is the expected behavior?
  The expected behavior is for the package to have no known vulnerabilities.

to make this happen, we need an non-vulnerable release of libxmljs2 or use a replacement for the xml-purpose.
Will keep this open to track this.

[artola]

• What is the expected behavior?
  The expected behavior is for the package to have no known vulnerabilities.

to make this happen, we need an non-vulnerable release of libxmljs2 or use a replacement for the xml-purpose. Will keep this open to track this.

It seems that the author is not intended to work on this package. See for example in his comments:

• https://github.com/marudor/libxmljs2/issues/207#issuecomment-1983316873
• https://github.com/marudor/libxmljs2/issues/210#issuecomment-2096066889

Knowing that, it makes sense to think in a replacement of the package. May be:
https://www.npmjs.com/package/sax

[jkowalleck]

@artola could you craft any POC to showcase that the vulnerability affects this cyclonedx-javascript-library at all?
This will help with regression testing and justifying the efforts ...

[jkowalleck]

npm audit                                                                                                                                                        13.1s  2024-05-07 11:30:56
# npm audit report

libxmljs2  *
Severity: high
libxmljs2 type confusion vulnerability when parsing specially crafted XML - https://github.com/advisories/GHSA-mjr4-7xg5-pfvh
libxmljs vulnerable to type confusion when parsing specially crafted XML - https://github.com/advisories/GHSA-78h3-pg4x-j8cv