[$250] Fix security vulnerabilities in Expensify App

[hurali97]

Problem

Currently in Expensify App we have around 34 vulnerabilities in our dependencies of Critical, High and Moderate priorities. Even though, our App works fine but there's always a chance of some exploit in the future. Since Expensify is a FinTech App, the security vulnerabilities should be avoided and mitigated as much as possible.

Some examples of the vulnerabilities found via npm audit are:

• Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - CRITICAL
• Uncontrolled resource consumption in braces - HIGH
• fast-xml-parser vulnerable to ReDOS at currency parsing - HIGH
• follow-redirects' Proxy-Authorization header kept across hosts - MODERATE
• PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF - HIGH
• ws affected by a DoS when handling a request with many HTTP headers - HIGH
• Prototype Pollution in JSON5 via Parse Method - HIGH
• JSON-Patch Prototype Pollution vulnerability - HIGH

Solution

The links for the vulnerabilities also suggests the version that we can bump for that dependency in order to fix the vulnerability. Since most of the vulnerabilities are originating from transitive dependencies, we can use overrides property in package.json to use that pinned version for the specific dependency. For example, consider ws transitive dependency which can be bumped to 8.17.1 in order to fix the vulnerability. Below is how we can achieve this:

"devDependencies": {
  ....
},
"overrides": {
   "ws": "8.17.1"
}

Once we add the patched versions of the security vulnerabilities in overrides property, we need to do a QA to make sure there are no regressions introduced by the patched versions.

---

Apart from this, upgrading to newer versions can sometimes be useful as they come with bug fixes and performance improvements. For example, react-pdf comes with lots of improvements like optimized CPU and memory usage, see here. There's one edge case that I am not aware of and would like to discuss:

• We now don't have pdfjs-dist/legacy/build instead we have pdfjs-dist/build as react-pdf has dropped support for older browsers. In react-fast-pdf, which is maintained by Expensify here and in Expensfiy App, we have references to pdfjs-dist/legacy/build, which we can just change to pdfjs-dist/build. After this change, on my testing, I was able to send and view the PDF correctly, so everything looks correct but a QA in this area might come handy.

Edit: react-pdf update is already being tracked here. We have to make sure to verify updates to react-fast-pdf

Edit: I missed it the first time but we do have pdfjs-dist/legacy/build but we have .mjs instead of .js, so we still have to update react-fast-pdf to include the .mjs extension.

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~021843732810666984794
• Upwork Job ID: 1843732810666984794
• Last Price Increase: 2024-10-08

Issue Owner

Current Issue Owner: @

[CyberAndrii]

react-pdf upgrade is being tracked in #48124

[hurali97]

react-pdf upgrade is being tracked in #48124

@CyberAndrii wow, nice. So does it mean when your PR to react-pdf is merged, you'll be bumping it in Expensify App? Because if that happens we will have to take care of react-fast-pdf as well.

[CyberAndrii]

Yes I guess. Thanks for pointing this out

[melvin-bot]

Triggered auto assignment to @grgia, see https://stackoverflow.com/c/expensify/questions/7972 for more details.

[szymonrybczak]

Hey I’m Szymon from Callstack - can take this over from Hur!

[melvin-bot]

📣 @szymonrybczak! 📣
Hey, it seems we don’t have your contributor details yet! You'll only have to do this once, and this is how we'll hire you on Upwork.
Please follow these steps:

1. Make sure you've read and understood the contributing guidelines.
2. Get the email address used to login to your Expensify account. If you don't already have an Expensify account, create one here. If you have multiple accounts (e.g. one for testing), please use your main account email.
3. Get the link to your Upwork profile. It's necessary because we only pay via Upwork. You can access it by logging in, and then clicking on your name. It'll look like this. If you don't already have an account, sign up for one here.
4. Copy the format below and paste it in a comment on this issue. Replace the placeholder text with your actual details.
   
   Format:

Contributor details
Your Expensify account email: <REPLACE EMAIL HERE>
Upwork Profile Link: <REPLACE LINK HERE>

[hungvu193]

Hey I’m Szymon from Callstack - can take this over from Hur!

Ty. Can you update the PR with latest main?

[szymonrybczak]

@hungvu193 ✅

[szymonrybczak]

#48532 was merged, and currently, there are no security vulnerabilities on main! 🎉

❯ npm audit
found 0 vulnerabilities

[hungvu193]

@grgia PR went to prod 2 weeks ago, can you add a BZ to handle payment here? Ty

[melvin-bot]

Triggered auto assignment to @zanyrenney (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~021843732810666984794

[melvin-bot]

Current assignee @hungvu193 is eligible for the External assigner, not assigning anyone new.

[mallenexpensify]

Contributor+: @hungvu193 due $250 via NewDot.

Do we need/want any regression tests here? My gut says no but I'm new to the issue so erring on the safe side by asking.

[hungvu193]

Do we need/want any regression tests here? My gut says no but I'm new to the issue so erring on the safe side by asking.

Yes, I don't think we need regression test here, as we only see the security vulnerabilities through the command line.

[zanyrenney]

i agree we don't need a regression test here.

[zanyrenney]

Payment summary

$250 owed to @hungvu193 for this work. @hungvu193 is paid via ND requests so closing this issue and they can request payment via ND.

Thanks!

[mallenexpensify]

@zanyrenney for auditing purposes, so we know who's paid/due payment and where they're paid, can you plz use the format from the payment SO? Thx.

Contributor: @username paid $250 via Upwork
Contributor+: @username due $250 via NewDot

[garrettmknight]

$250 approved for @hungvu193