Can XMLDOM be bumped to version 0.7.0?

[ryan-WORK]

Expected behaviour:

Expected behavior is that there are no vulnerabilities after installing mssql.

Actual behaviour:

  Moderate        Misinterpretation of malicious XML input                      

  Package         xmldom                                                        

  Patched in      >=0.7.0                                                       

  Dependency of   mssql                                                         

  Path            mssql > tedious > @azure/ms-rest-nodeauth > adal-node >       
                  xmldom                                                        

  More info       https://npmjs.com/advisories/1769                             


  Moderate        Misinterpretation of malicious XML input                      

  Package         xmldom                                                        

  Patched in      >=0.7.0                                                       

  Dependency of   mssql                                                         

  Path            mssql > tedious > adal-node > xmldom                          

  More info       https://npmjs.com/advisories/1769                             

found 2 moderate severity vulnerabilities in 1074 scanned packages
  2 vulnerabilities require manual review. See the full report for details.

Configuration:

npm i mssql

Software versions

• NodeJS: v14.17.3
• node-mssql: 7.2.0
• SQL Server:

[psoleckimoj]

Seconded, all our security workflows in CircleCI have just thrown this up.

[dhensby]

1. This is the wrong repo to bring this up in, it is not a dependency of this library
2. Have you reviewed the vulnerability to see if it actually applies / is used in a way that the vulnerability can be exploited when used in conjunction with this library
3. "Expected behavior is that there are no vulnerabilities after installing mssql." - I disagree with this expected behaviour, there is no such expectation within this library.

Additional reading for those that are interested - https://overreacted.io/npm-audit-broken-by-design/

[dhensby]

Just to add, given this is a dependency of @azure/ms-rest-nodeauth I expect this is only even potentially an issue if you're using some azure based authentication and not standard MSSQL auth. And even then whatever the vulnerability is, you'd have to be exposed to it

[dhensby]

note we will need to wait for tediousjs/tedious#1328 to be merged in tedious before the vulnerability warning is going to be resolved