[Snyk: high] Upgrade Watchify (Due 7/05/24)

[tmpayton]

Overview
Affected versions of this package are vulnerable to Prototype Pollution via the unset function in index.js, because it allows access to object prototype properties.

Details
Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

Unsafe Object recursive merge

Property definition by path

• Regular Expression Denial of Service (ReDoS) [Medium Severity][https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905] in [email protected]
  introduced by [email protected] > [email protected] > [email protected]
• Uncontrolled resource consumption (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727] in [email protected]
  introduced by [email protected] > [email protected] > [email protected] and 3 other path(s)
• Denial of Service (DoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-DECODEURICOMPONENT-3149970] in [email protected]
  introduced by [email protected] > [email protected] > [email protected] > [email protected] > [email protected] > [email protected] and 15 other path(s)
• Inefficient Regular Expression Complexity (new) [High Severity][https://security.snyk.io/vuln/SNYK-JS-MICROMATCH-6838728] in [email protected]
  introduced by [email protected] > [email protected] > [email protected] and 2 other path(s)
• Prototype Pollution [High Severity][https://security.snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660] in [email protected]
  introduced by [email protected] > [email protected] > [email protected] > [email protected] > [email protected] > [email protected] > [email protected] and 15 other path(s)

Completion Criteria

• Upgrade watchify to v4 if easy [This is only a dev dependency--will not effect external users]

[johnnyporkchops]

This will be resolved with changes related to the upcoming WebPack upgrade.. Since these are dev dependencies, it's not really a high threat as we don't run it in our built environments.
The security team has been notified and approves our temporary acceptance of the reported vulnerability given mitigating factors mentioned above.