Security Vulnerability with adal-node dependency in botframework-connector

[Mitko-Kerezov]

Github issues should be used for bugs and feature requests. Use Stack Overflow for general "how-to" questions.

Versions

What package version of the SDK are you using.
botbuilder@4.15.0
botframework-connector@4.15.0
What nodejs version are you using
v14.19.1
What browser version are you using
N/A
What os are you using
Linux

Describe the bug

Give a clear and concise description of what the bug is.
botframework-connector requires adal-node@0.2.3. adal-node@0.2.3 requires the async library version 2. All versions of async < 3.2.2 are vulnerable to prototype pollution.

Potential Fix

Unaware if adal-node is even maintained - maybe it could be replaced with something like @azure/msal-node? See #2782

[tracyboehrer]

@Mitko-Kerezov Thanks! This also showed up in our security checks. We will need to schedule this for a patch release after 4.16.0 which is about to come out. The fix is to migrate to MSAL since adal-node is deprecated. This will be a larger change, but we'll prioritize it.

[tracyboehrer]

@JuanAr @ceciliaavila Can we research this, in light of the comments in #2782 about incompatibility of MSAL with older versions of TypeScript.

[sw-joelmut]

@JuanAr @ceciliaavila Can we research this, in light of the comments in #2782 about incompatibility of MSAL with older versions of TypeScript.

Hi @tracyboehrer, we've been reviewing and testing this specific case, and we consider that the PR #4194 provided by @BruceHaley will address this security vulnerability as a temporary solution before migrating adal-node to @azure/msal-node.