Skip to content

Commit 69326cf

Browse files
QSchlegelQSchlegel
authored
Merge pull request #180 from MeshJS/feature/piniata-init
Feature/piniata init
2 parents d7eacf9 + 8fb65d4 commit 69326cf

File tree

50 files changed

+4458
-1226
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+4458
-1226
lines changed

‎SECURITY_VULNERABILITIES_ANALYSIS.md‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
# Security Vulnerabilities Analysis
2+
3+
## Overview
4+
This document traces the origin of all security vulnerabilities identified in the project's dependency tree.
5+
6+
## Vulnerability Summary
7+
- **Total Vulnerabilities**: 14 (1 low, 13 high)
8+
- **Fixed**: 9 vulnerabilities (reduced from 23)
9+
- **Remaining**: 14 vulnerabilities
10+
11+
---
12+
13+
## 1. `ip` Package Vulnerability (High Severity)
14+
15+
### Vulnerability Details
16+
- **CVE**: SSRF improper categorization in `isPublic` function
17+
- **Affected Version**: `[email protected]`
18+
- **Risk**: Server-Side Request Forgery (SSRF) attacks possible
19+
20+
### Dependency Chain
21+
```
22+
Root Project
23+
└── @meshsdk/[email protected]
24+
└── @fabianbormann/[email protected]
25+
└── @fabianbormann/[email protected]
26+
└── [email protected]
27+
├── [email protected]
28+
│ └── [email protected] ⚠️ VULNERABLE
29+
└── [email protected]
30+
└── [email protected]
31+
└── [email protected] ⚠️ VULNERABLE
32+
```
33+
34+
### Root Cause
35+
The `ip` package is pulled in by **WebTorrent**, which is used for peer-to-peer (P2P) connectivity in Cardano wallet connections. This is a transitive dependency from:
36+
- `@fabianbormann/cardano-peer-connect` → Used by MeshSDK for P2P wallet connections
37+
- `webtorrent` → BitTorrent protocol implementation for P2P networking
38+
- `bittorrent-tracker` → Tracker client that uses `ip` for IP address validation
39+
40+
### Impact Assessment
41+
- **Usage**: Only used when P2P wallet connection features are active
42+
- **Risk Level**: Medium-Low (only affects P2P connectivity features)
43+
- **Attack Vector**: Requires attacker to control IP addresses in P2P network context
44+
45+
### Mitigation Options
46+
1. **Wait for upstream fix**: Monitor `@fabianbormann/cardano-peer-connect` for updates
47+
2. **Use npm overrides**: Force a patched version of `ip` (risky, may break functionality)
48+
3. **Disable P2P features**: If not needed, consider removing MeshSDK P2P functionality
49+
4. **Contact maintainers**: Report to MeshSDK team about dependency updates
50+
51+
---
52+
53+
## 2. `brace-expansion` Vulnerability (ReDoS)
54+
55+
### Vulnerability Details
56+
- **CVE**: Regular Expression Denial of Service (ReDoS)
57+
- **Affected Versions**: `1.0.0 - 1.1.11 || 2.0.0 - 2.0.1`
58+
- **Risk**: CPU exhaustion through malicious regex patterns
59+
60+
### Dependency Chain
61+
```
62+
Root Project
63+
└── @meshsdk/[email protected]
64+
└── @cardano-sdk/[email protected]
65+
└── [email protected] ⚠️ BUNDLED DEPENDENCY
66+
├── [email protected]
67+
│ └── [email protected] ⚠️ VULNERABLE
68+
└── [email protected]
69+
├── [email protected]
70+
│ └── [email protected]
71+
│ └── [email protected] ⚠️ VULNERABLE
72+
└── [email protected]
73+
└── [email protected]
74+
└── [email protected]
75+
└── [email protected] ⚠️ VULNERABLE
76+
```
77+
78+
### Root Cause
79+
**Critical Finding**: `@cardano-sdk/[email protected]` includes `npm@^9.3.0` as a **production dependency**. This is highly unusual and problematic because:
80+
81+
1. **npm should not be a dependency**: npm is a package manager, not a library
82+
2. **Bundled vulnerabilities**: [email protected] bundles vulnerable versions of `brace-expansion` and `glob`
83+
3. **Cannot be fixed via project dependencies**: These are bundled inside npm itself
84+
85+
### Why npm is a dependency
86+
The `@cardano-sdk/crypto` package likely uses npm for:
87+
- Build tooling or scripts
88+
- Package management utilities
89+
- Development tooling (incorrectly marked as production dependency)
90+
91+
**This is a bug/misconfiguration in the Cardano SDK package.**
92+
93+
### Impact Assessment
94+
- **Usage**: Likely only used during build/development, not runtime
95+
- **Risk Level**: Low-Medium (ReDoS requires specific attack patterns)
96+
- **Attack Vector**: Requires attacker to provide malicious input to brace expansion functions
97+
98+
### Mitigation Options
99+
1. **Update npm globally**: `npm install -g npm@latest` (fixes bundled dependencies)
100+
2. **Report to Cardano SDK**: This is a packaging issue that should be fixed upstream
101+
3. **Use npm overrides**: Force newer versions (may break npm functionality)
102+
4. **Consider alternative**: Evaluate if `@cardano-sdk/crypto` is necessary or if there's an alternative
103+
104+
---
105+
106+
## 3. `glob` Vulnerability (High Severity)
107+
108+
### Vulnerability Details
109+
- **CVE**: Command injection via `-c/--cmd` executes matches with `shell:true`
110+
- **Affected Versions**: `[email protected] - 10.4.5`
111+
- **Risk**: Command injection attacks
112+
113+
### Dependency Chain
114+
```
115+
Root Project
116+
└── @meshsdk/[email protected]
117+
└── @cardano-sdk/[email protected]
118+
└── [email protected] ⚠️ BUNDLED DEPENDENCY
119+
├── [email protected] ⚠️ VULNERABLE
120+
└── [email protected]
121+
└── (uses older glob versions)
122+
```
123+
124+
### Root Cause
125+
Same as `brace-expansion` - bundled in [email protected] which is incorrectly included as a dependency of `@cardano-sdk/crypto`.
126+
127+
### Impact Assessment
128+
- **Usage**: Only if npm CLI features are used at runtime (unlikely)
129+
- **Risk Level**: Low (requires CLI usage with malicious input)
130+
- **Attack Vector**: Command injection through glob CLI usage
131+
132+
### Mitigation Options
133+
Same as `brace-expansion` - update npm globally or report to Cardano SDK maintainers.
134+
135+
---
136+
137+
## 4. Previously Fixed Vulnerabilities
138+
139+
### ✅ `axios` (Fixed)
140+
- **Was**: Vulnerable versions in `@cardano-sdk/util-dev`
141+
- **Fixed**: Updated MeshSDK packages to `1.9.0-beta.87`
142+
- **Status**: Resolved
143+
144+
### ✅ `tar-fs` (Fixed)
145+
- **Was**: Vulnerable versions in `dockerode`
146+
- **Fixed**: Updated MeshSDK packages
147+
- **Status**: Resolved
148+
149+
---
150+
151+
## Recommendations
152+
153+
### Immediate Actions
154+
1. ✅ **Update MeshSDK packages** - Already completed (all at `1.9.0-beta.87`)
155+
2. ⚠️ **Update npm globally**: `npm install -g npm@latest`
156+
3. 📝 **Report to Cardano SDK**: File issue about npm being a production dependency
157+
158+
### Long-term Actions
159+
1. **Monitor dependencies**: Set up automated dependency scanning
160+
2. **Evaluate alternatives**: Consider if Cardano SDK crypto package is necessary
161+
3. **Review P2P features**: Assess if `cardano-peer-connect` is required for your use case
162+
4. **Use npm overrides**: If needed, add overrides for critical vulnerabilities (with caution)
163+
164+
### npm Overrides Example (Use with Caution)
165+
```json
166+
{
167+
"overrides": {
168+
"ip": "^2.0.2",
169+
"brace-expansion": "^2.0.2",
170+
"glob": "^10.4.6"
171+
}
172+
}
173+
```
174+
175+
---
176+
177+
## Dependency Tree Visualization
178+
179+
### Critical Paths
180+
```
181+
Root → @meshsdk/react → @fabianbormann/cardano-peer-connect → webtorrent → ip ⚠️
182+
Root → @meshsdk/core-cst → @cardano-sdk/crypto → npm → brace-expansion/glob ⚠️
183+
```
184+
185+
### Key Packages
186+
- **@meshsdk/react**: Main MeshSDK React integration
187+
- **@fabianbormann/cardano-peer-connect**: P2P wallet connectivity
188+
- **@cardano-sdk/crypto**: Cryptographic utilities (incorrectly includes npm)
189+
- **webtorrent**: BitTorrent protocol for P2P
190+
- **npm**: Package manager (should not be a dependency!)
191+
192+
---
193+
194+
## Conclusion
195+
196+
The security vulnerabilities stem from:
197+
1. **Transitive dependencies** in MeshSDK's P2P connectivity features (`ip` vulnerability)
198+
2. **Packaging error** in Cardano SDK (`npm` as production dependency causing `brace-expansion`/`glob` issues)
199+
200+
Most vulnerabilities are low-risk for production use, but should be addressed through:
201+
- Updating npm globally
202+
- Reporting issues to upstream maintainers
203+
- Monitoring for package updates
204+
205+

‎next.config.js‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,6 @@ const config = {
1212
defaultLocale: "en",
1313
},
1414
transpilePackages: ["geist"],
15-
eslint: {
16-
// Warning: This allows production builds to successfully complete even if
17-
// your project has ESLint errors.
18-
ignoreDuringBuilds: true,
19-
},
2015
typescript: {
2116
// Warning: This allows production builds to successfully complete even if
2217
// your project has type errors.
@@ -36,8 +31,18 @@ const config = {
3631
protocol: "https",
3732
hostname: "ipfs.io",
3833
},
34+
{
35+
protocol: "https",
36+
hostname: "gateway.pinata.cloud",
37+
},
3938
],
4039
},
40+
// Turbopack configuration (Next.js 16+)
41+
// Empty config silences the warning about webpack/turbopack conflict
42+
// WebAssembly support is enabled by default in Turbopack
43+
turbopack: {},
44+
45+
// Webpack config for builds that explicitly use webpack (e.g., with --webpack flag)
4146
webpack: function (config, options) {
4247
config.experiments = {
4348
asyncWebAssembly: true,

0 commit comments

Comments
 (0)