blocks|key|97128|text|我使用：rm+package-lock.json+&&+npm+update+&&+npm+install。对我来说，这个更新后的4.2.1+hoek也包含修复程序(per+this+comment.)|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|97129|编辑：在另一个应用程序中，我运行了rm+package-lock.json和npm+i+hoek+&&+npm+up+&&+npm+i+&&+npm+un+hoek或npm+i+hoek+&&+npm+un+hoek+&&+npm+up+&&+npm+i+(无法调用订单)，后者更符合with+this+comment+(from+JamesSingleton)。|BOLD|97130|(rm+package-lock.json只有在它存在的情况下才会存在。)|97131|编辑：在第三个应用中，我检查了npm+outdated，发现我必须将react-scripts-ts从2.13.0升级到2.15.1。为此，我手动更新了package.json，然后运行npm+i。一旦完成，hoek就会更新到4.2.1.+(专门针对那个坚持/主要组件)。|97132|Zurb编辑：+My+solution+for+a+Zurb+Foundation+6+Site：|97133|我使用npm+outdated将我所有的包更新到它们的主要版本。然后我运行：|97134|npm+i+hoek@latest+--save+&&+npm+up+hoek|97135|npm+i+boom+hawk+sntp+uncss+gulp-uncss+--save+&&+npm+up+boom+hawk+sntp+uncss+gulp-uncss+&&+npm+un+boom+hawk+sntp+gulp-uncss+uncss+--save|97136|有两个顽固不化的人：browser-sync+:+2.23.7和node-sass+:+4.9.0，都是最新版本。不要紧:提交后解决了GitHub警告。|97137|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/request/request/issues/2926#issuecomment-384853637|1|https://github.com/Microsoft/vscode/issues/48783#issuecomment-384873041^0|4|K|S|P|1T|5|1Z|4|2B|G|0|0|0|3|H|K|12|18|2B|18|3Y|13|1|0|1|K|0|0|3|F|C|Y|G|1F|6|1O|6|24|C|2L|5|2W|4|35|6|0|0|3|C|0|0|13|0|0|3R|0|A|L|W|H|0^^$0|@$1|2|3|4|5|6|7|16|8|@$9|17|A|18|B|C]|$9|19|A|1A|B|C]|$9|1B|A|1C|B|C]|$9|1D|A|1E|B|C]]|D|@$9|1F|A|1G|1|1H]]|E|$]]|$1|F|3|G|5|6|7|1I|8|@$9|1J|A|1K|B|H]|$9|1L|A|1M|B|C]|$9|1N|A|1O|B|C]|$9|1P|A|1Q|B|C]]|D|@$9|1R|A|1S|1|1T]]|E|$]]|$1|I|3|J|5|6|7|1U|8|@$9|1V|A|1W|B|C]]|D|@]|E|$]]|$1|K|3|L|5|6|7|1X|8|@$9|1Y|A|1Z|B|H]|$9|20|A|21|B|C]|$9|22|A|23|B|C]|$9|24|A|25|B|C]|$9|26|A|27|B|C]|$9|28|A|29|B|C]|$9|2A|A|2B|B|C]|$9|2C|A|2D|B|C]|$9|2E|A|2F|B|C]]|D|@]|E|$]]|$1|M|3|N|5|6|7|2G|8|@]|D|@]|E|$]]|$1|O|3|P|5|6|7|2H|8|@$9|2I|A|2J|B|C]]|D|@]|E|$]]|$1|Q|3|R|5|6|7|2K|8|@$9|2L|A|2M|B|C]]|D|@]|E|$]]|$1|S|3|T|5|6|7|2N|8|@$9|2O|A|2P|B|C]]|D|@]|E|$]]|$1|U|3|V|5|6|7|2Q|8|@$9|2R|A|2S|B|C]|$9|2T|A|2U|B|C]]|D|@]|E|$]]|$1|W|3|-4|5|6|7|2V|8|@]|D|@]|E|$]]]|X|$Y|$5|Z|10|11|E|$12|13]]|14|$5|Z|10|11|E|$12|15]]]]

I used: <code>rm package-lock.json</code> &amp;&amp; <code>npm update &amp;&amp; npm install</code>. For me this updated <code>hoek</code> to <code>4.2.1</code>, which also contains the fix (<a href="https://github.com/request/request/issues/2926#issuecomment-384853637" rel="noreferrer">per this comment</a>.)

Edit: In another app, I ran <code>rm package-lock.json</code> and either <code>npm i hoek &amp;&amp; npm up &amp;&amp; npm i &amp;&amp; npm un hoek</code> or <code>npm i hoek &amp;&amp; npm un hoek &amp;&amp; npm up &amp;&amp; npm i</code> (can't recall order), which is more aligned <a href="https://github.com/Microsoft/vscode/issues/48783#issuecomment-384873041" rel="noreferrer">with this comment (from JamesSingleton)</a>.

(<code>rm package-lock.json</code> is only if it exists.)

Edit: In yet a 3rd app, I checked <code>npm outdated</code> and found I had to upgrade <code>react-scripts-ts</code> from <code>2.13.0</code> to <code>2.15.1</code>. For this, I updated the <code>package.json</code> manually, then just ran <code>npm i</code>. Once done, <code>hoek</code> updated to <code>4.2.1.</code> (specifically targeting that one holdout/primary component).

Edit: My solution for a Zurb Foundation 6 Site:

I updated all my packages to their major versions using <code>npm outdated</code>. I then ran:

<code>npm i hoek@latest --save &amp;&amp; npm up hoek</code>

<code>npm i boom hawk sntp uncss gulp-uncss --save &amp;&amp; npm up boom hawk sntp uncss gulp-uncss &amp;&amp; npm un boom hawk sntp gulp-uncss uncss --save</code>

There were two holdouts; <code>browser-sync : 2.23.7</code> and <code>node-sass : 4.9.0</code>, both at their latest versions. No matter: the GitHub warning resolved after commit.

blocks|key|100080|text|我使用npm+update+hoek+&&+npm+install+hoek，包被更新到5.0.3。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|100081|在那之后，漏洞警报从我的github+Repo中消失了。|100082|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

I used npm update hoek &amp;&amp; npm install hoek and the package was updated to 5.0.3.

The vulnerability alert disappeared from my github Repo after that.

blocks|key|100253|text|找到解决方案here。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|100254|基本上，在git+bash中，cd到你的项目文件夹，输入以下代码：|style|CODE|100255|npm+i+hoek++
npm+uninstall+hoek+
npm+update+
npm+install++|code-block|syntax|javascript|100256|然后|100257|git+add+.
git+commit+-m+'update-hoek'
git+push+origin+master+|100258|现在再次检查您的GitHub项目页面，警告应该会消失。|100259|致以问候。|100260|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/Microsoft/vscode/issues/48783^0|6|4|0|0|F|2|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|12|8|@]|9|@$A|13|B|14|1|15]]|C|$]]|$1|D|3|E|5|6|7|16|8|@$A|17|B|18|F|G]]|9|@]|C|$]]|$1|H|3|I|5|J|7|19|8|@]|9|@]|C|$K|L]]|$1|M|3|N|5|6|7|1A|8|@]|9|@]|C|$]]|$1|O|3|P|5|J|7|1B|8|@]|9|@]|C|$K|L]]|$1|Q|3|R|5|6|7|1C|8|@]|9|@]|C|$]]|$1|S|3|T|5|6|7|1D|8|@]|9|@]|C|$]]|$1|U|3|-4|5|6|7|1E|8|@]|9|@]|C|$]]]|V|$W|$5|X|Y|Z|C|$10|11]]]]

Found a solution <a href="https://github.com/Microsoft/vscode/issues/48783" rel="nofollow noreferrer">here</a>. 

Basically in git bash, <code>cd</code> to your project folder, type the following codes:

<pre><code>npm i hoek 
npm uninstall hoek 
npm update 
npm install 
</code></pre>

then 

<pre><code>git add .
git commit -m 'update-hoek'
git push origin master 
</code></pre>

Now check your GitHub project page again, the warning should disappear. 

Regards.

blocks|key|100138|text|如果易受攻击的包被声明为直接项目的依赖项，则npm+update应该只工作于。但通常(就像hoek的情况一样)，漏洞会将放在那些包中，这些包的位于您的子依赖关系树中。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|BOLD|entityRanges|data|100139|由于在我的示例中，我决定不更新项目的所有依赖项(通过删除和重新构建整个package-lock.json文件)，我采用了以下方法(当然，也更耗时)：|100140|在my+package-lock.json|100141|follow+up和依赖关系树中重新安装有漏洞的软件包的所有版本，以查找哪些版本的顶级软件包导入了them|unordered-list-item|100142|
|100143|uninstall和，并使用相同的次要版本重新安装那些顶级软件包|100144|100145|像这样：|100146|npm+r+package-1+package-2+&&+npm+i+package-1@%5E1.2.3+package-2@%5E1.2.3|code-block|syntax|javascript|100147|只有在修复并发布了易受攻击的包，并且使用的包使用loose+version+number+open+to+patch+or+minor+versions导入易受攻击的包时，此方法才有效。|100148|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/22343224/whats-the-difference-between-tilde-and-caret-in-package-json?utm_medium=organic&utm_source=google_rich_qa&utm_campaign=google_rich_qa^0|M|A|19|4|12|19|0|0|22|Z|H|0|0|L|4|H|0|0|1H|0|0|0|W|0|0|0|4|0|0|0|2L|O|1G|0|0^^$0|@$1|2|3|4|5|6|7|19|8|@$9|1A|A|1B|B|C]|$9|1C|A|1D|B|C]|$9|1E|A|1F|B|D]]|E|@]|F|$]]|$1|G|3|H|5|6|7|1G|8|@$9|1H|A|1I|B|D]|$9|1J|A|1K|B|C]]|E|@]|F|$]]|$1|I|3|J|5|6|7|1L|8|@$9|1M|A|1N|B|D]|$9|1O|A|1P|B|C]]|E|@]|F|$]]|$1|K|3|L|5|M|7|1Q|8|@$9|1R|A|1S|B|D]]|E|@]|F|$]]|$1|N|3|O|5|6|7|1T|8|@]|E|@]|F|$]]|$1|P|3|Q|5|M|7|1U|8|@$9|1V|A|1W|B|D]]|E|@]|F|$]]|$1|R|3|-4|5|6|7|1X|8|@]|E|@]|F|$]]|$1|S|3|T|5|6|7|1Y|8|@$9|1Z|A|20|B|D]]|E|@]|F|$]]|$1|U|3|V|5|W|7|21|8|@]|E|@]|F|$X|Y]]|$1|Z|3|10|5|6|7|22|8|@$9|23|A|24|B|D]]|E|@$9|25|A|26|1|27]]|F|$]]|$1|11|3|-4|5|6|7|28|8|@]|E|@]|F|$]]]|12|$13|$5|14|15|16|F|$17|18]]]]

<code>npm update</code> should work only if the vulnerable package is declared as direct project's dependency. But usually (as in the case of <code>hoek</code>) vulnerabilities lay in those packages which live down in you sub-dependencies tree.

Since in my case I decided to not update all the dependencies of my project (by deleting and rebuilding the entire <code>package-lock.json</code> file), I went for the following (and, of course, more time consuming) approach:

<ul>
<li>find all the occurrencies of the vulnerable package in my <code>package-lock.json</code></li>
<li>follow up the dependency tree to find which top-level packages import them</li>
<li>uninstall and re-install those top-level packages using the same minor version</li>
</ul>

Like:

<pre><code>npm r package-1 package-2 &amp;&amp; npm i package-1@^1.2.3 package-2@^1.2.3
</code></pre>

This approach will work only if the vulnerable package was fixed and released and the consuming packages import the vulnerable one with a <a href="https://stackoverflow.com/questions/22343224/whats-the-difference-between-tilde-and-caret-in-package-json?utm_medium=organic&amp;utm_source=google_rich_qa&amp;utm_campaign=google_rich_qa">loose version number open to patch or minor versions</a>.

blocks|key|100152|text|尝试在项目中运行npm+install+hoek@4.2.x或npm+install+hoek@5。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|100153|这将在package.json依赖项中安装所需的hoek的最新版本，并覆盖包-lock.json中的hoek版本。|100154|entityMap^0|8|M|V|I|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@$9|K|A|L|B|C]|$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|O|8|@]|D|@]|E|$]]|$1|H|3|-4|5|6|7|P|8|@]|D|@]|E|$]]]|I|$]]

Try run <code>npm install hoek@4.2.x</code> or <code>npm install hoek@5</code> in your project.

That will install the required latest version of hoek into package.json dependencies overwriting above hoek version in package-lock.json.

blocks|key|100156|text|以上这些对我来说都不起作用。我的hoek依赖在子树中很深。我首先做了npm+ls+hoek，得到的结果是这样的：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|100157|├──+hoek@5.0.3
└─┬+watson-developer-cloud@2.42.0
++├─┬+request@2.83.0
++│+└─┬+hawk@6.0.2
++│+++├─┬+boom@4.3.1
++│+++│+└──+hoek@4.2.1++deduped
++│+++├─┬+cryptiles@3.1.2
++│+++│+└─┬+boom@5.2.0
++│+++│+++└──+hoek@4.2.1++deduped
++│+++├──+hoek@4.2.1
++│+++└─┬+sntp@2.1.0
++│+++++└──+hoek@4.2.1++deduped
++└─┬+solr-client@0.7.0
++++└─┬+request@2.81.0
++++++└─┬+hawk@3.1.3
++++++++├─┬+boom@2.10.1
++++++++│+└──+hoek@2.16.3++deduped
++++++++├──+hoek@2.16.3
++++++++└─┬+sntp@1.0.9
++++++++++└──+hoek@2.16.3++deduped|code-block|syntax|javascript|100158|然后我发现真正需要更新的是watson-developer-cloud，因为这就是在顶层使用hoek的原因。|100159|然后我做了npm+install+watson-developer-cloud@latest，解决了这个问题。|100160|entityMap^0|Y|B|0|0|D|M|0|5|15|0^^$0|@$1|2|3|4|5|6|7|Q|8|@$9|R|A|S|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|T|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|U|8|@$9|V|A|W|B|C]]|D|@]|E|$]]|$1|M|3|N|5|6|7|X|8|@$9|Y|A|Z|B|C]]|D|@]|E|$]]|$1|O|3|-4|5|6|7|10|8|@]|D|@]|E|$]]]|P|$]]

None of the above worked for me. My hoek dependency was deep in the subtrees. I first did <code>npm ls hoek</code> and got something like this: 

<pre><code>├── hoek@5.0.3
└─┬ watson-developer-cloud@2.42.0
 ├─┬ request@2.83.0
 │ └─┬ hawk@6.0.2
 │ ├─┬ boom@4.3.1
 │ │ └── hoek@4.2.1 deduped
 │ ├─┬ cryptiles@3.1.2
 │ │ └─┬ boom@5.2.0
 │ │ └── hoek@4.2.1 deduped
 │ ├── hoek@4.2.1
 │ └─┬ sntp@2.1.0
 │ └── hoek@4.2.1 deduped
 └─┬ solr-client@0.7.0
 └─┬ request@2.81.0
 └─┬ hawk@3.1.3
 ├─┬ boom@2.10.1
 │ └── hoek@2.16.3 deduped
 ├── hoek@2.16.3
 └─┬ sntp@1.0.9
 └── hoek@2.16.3 deduped
</code></pre>

I then saw that what really needs to be updated is <code>watson-developer-cloud</code> since that is what using hoek at the top level. 

I then did <code>npm install watson-developer-cloud@latest</code> and that solved it.

blocks|key|100329|text|我尝试了上面所有的方法，但对我来说都不起作用，所以我继续检查我的根本原因。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|100330|我运行了npm+ls+hoek，它给了我：|offset|length|style|CODE|100331|├─┬+fuse-box@3.3.0
│+└─┬+request@2.81.0
│+++└─┬+hawk@3.1.3
│+++++├─┬+boom@2.10.1
│+++++│+└──+hoek@2.16.3
│+++++├──+hoek@2.16.3
│+++++└─┬+sntp@1.0.9
│+++++++└──+hoek@2.16.3
└──+hoek@5.0.3|code-block|syntax|javascript|100332|我注意到我的hawk版本与npm+hawk上的版本不同，所以我运行了npm+i+hawk+--save。之后，我再次运行正常的git命令：|100333|git+add+.
git+commit+-m+'whatever_message'
git+push+|100334|然后回到Github，我的安全漏洞被修复了。|BOLD|100335|entityMap|0|LINK|mutability|MUTABLE|url|https://www.npmjs.com/package/hawk^0|0|4|B|0|0|6|4|Y|H|D|8|0|0|0|D|4|0^^$0|@$1|2|3|4|5|6|7|11|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|12|8|@$D|13|E|14|F|G]]|9|@]|A|$]]|$1|H|3|I|5|J|7|15|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|16|8|@$D|17|E|18|F|G]|$D|19|E|1A|F|G]]|9|@$D|1B|E|1C|1|1D]]|A|$]]|$1|O|3|P|5|J|7|1E|8|@]|9|@]|A|$K|L]]|$1|Q|3|R|5|6|7|1F|8|@$D|1G|E|1H|F|S]]|9|@]|A|$]]|$1|T|3|-4|5|6|7|1I|8|@]|9|@]|A|$]]]|U|$V|$5|W|X|Y|A|$Z|10]]]]

I tried all the above, but non worked for me, so I went ahead to check the root cause of mine.

I ran <code>npm ls hoek</code> which gave me:

<pre><code>├─┬ fuse-box@3.3.0
│ └─┬ request@2.81.0
│ └─┬ hawk@3.1.3
│ ├─┬ boom@2.10.1
│ │ └── hoek@2.16.3
│ ├── hoek@2.16.3
│ └─┬ sntp@1.0.9
│ └── hoek@2.16.3
└── hoek@5.0.3
</code></pre>

I noticed the version of my <code>hawk</code> against the one on <a href="https://www.npmjs.com/package/hawk" rel="nofollow noreferrer">npm hawk</a>, so I ran <code>npm i hawk --save</code>. After which I again ran my normal git commands:

<pre><code>git add .
git commit -m 'whatever_message'
git push 
</code></pre>

And went back to Github and my security vulnerability was fixed.

blocks|key|100241|text|是的，CVE-2018-3728包存在漏洞。hoek+4.2.1和5.0.3之前的版本容易受到原型污染的影响。受影响的hoek版本是5.0.2之前的版本，补救措施是更新到4.2.1、5.0.3或更高版本。如需了解更多信息，请查看修复拉取请求：https://github.com/hapijs/hoek/pull/231/commits/5aed1a8c4a3d55722d1c799f2368857bf418d6df|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|100242|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/hapijs/hoek/pull/231/commits/5aed1a8c4a3d55722d1c799f2368857bf418d6df^0|3D|2G|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

Yes, the package CVE-2018-3728 is vulnerable. The versions of hoek prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.
The affected versions of hoek are until version 5.0.2, The remediation is to update to version 4.2.1, 5.0.3 or later.
For more information, you can view the fix pull request here: <a href="https://github.com/hapijs/hoek/pull/231/commits/5aed1a8c4a3d55722d1c799f2368857bf418d6df" rel="nofollow noreferrer">https://github.com/hapijs/hoek/pull/231/commits/5aed1a8c4a3d55722d1c799f2368857bf418d6df</a>

Today github is showing following error on my github repository:

<blockquote>
 We found a potential security vulnerability in one of your
 dependencies. A dependency defined in ./package-lock.json has known
 security vulnerabilities and should be updated.
</blockquote>

On clicking on Review vulnerable dependency button following message was displayed: 

<blockquote>
 hoek node module before 5.0.3 suffers from a Modification of
 Assumed-Immutable Data (MAID) vulnerability via 'merge'
</blockquote>

Till yesterday it was not showing such error. I have not done any push to this repository for more than 5 days. Any idea why it is happening.

Github potential security vulnerability error for hoek node module

GitHub

今天，github在我的github存储库中显示了以下错误：我们在您的一个依赖项中发现了一个潜在的安全漏洞。./package-lock.json中定义的依赖项具有已知的安全漏洞，应进行更新。单击Review vulnerable dependency按钮时，将显示以下消息： hoek节点模块5.0.3之前的版本存在通...

问hoek节点模块的Github潜在安全漏洞错误
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问hoek节点模块的Github潜在安全漏洞错误EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问hoek节点模块的Github潜在安全漏洞错误
EN