dependency CVE-2021-32708 in league/flysystem

[markuman]

usr/src/nextcloud/3rdparty/composer.lock
========================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

+------------------+------------------+----------+-------------------+---------------+---------------------------------------+
|     LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+------------------+------------------+----------+-------------------+---------------+---------------------------------------+
| league/flysystem | CVE-2021-32708   | HIGH     | 1.1.3             | 2.1.1, 1.1.4  | Time-of-check Time-of-use (TOCTOU)    |
|                  |                  |          |                   |               | Race Condition in league/flysystem    |
|                  |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-32708 |
+------------------+------------------+----------+-------------------+---------------+---------------------------------------+

You should consider to include trivy into your pipeline for php/js dependency scan.

trivy fs --ignore-unfixed .

[kesselb]

cc @nextcloud/security 👋

[nickvergessen]

nextcloud/3rdparty#697

[LukasReschke]

@icewind1991 I do not see this dependency being used anywhere in the Nextcloud code base. Can we remove it?

PHPStorm shows only usages in our consumer file itself https://github.com/nextcloud/server/blob/master/lib/private/Files/Storage/Flysystem.php:

Sourcegraph shows no usages in the org:

See https://sourcegraph.com/search?q=context:global+repo:github.com/nextcloud/+Flysystem&patternType=literal&case=yes

[LukasReschke]

@icewind1991 Ping

[markuman]

It is still present in 21.0.4 and also in 22.1.0

[stp-bsh]

It is present in 22.2.0 as well.

[jqiuyin]

some applications will use it.
like this: hevelius/files_external_onedrive#66
Is there a better solution?
@LukasReschke

[markuman]

some applications will use it. like this: hevelius/files_external_onedrive#66 Is there a better solution? @LukasReschke

the external app must ship the dependency itself - IMO.

[nickvergessen]

Yes, as per above the app should ship the dependency itself.

Since the package is removed on our end I will also close this issue as the update is not needed anymore