[BUG] axios version lesser than 1.6.0 has Cross-Site Request Forgery vulnerability about openapi-generator-cli HOT 20 CLOSED

any updates please?

from openapi-generator-cli.

AFAIK upgrading to 2.0.0 is not enough and we need nestjs/axios 3.0.1 to get the fix. I tried to make a PR, but can't even run yarn install on Apple Sillicon running macOS 14.1. It fails trying to run node-gyp to compile fsevents. I do not have access to an intel machine.

from openapi-generator-cli.

@kay-schecker what is missing for this to be adressed?

from openapi-generator-cli.

Do we have an ETA as to when this will be fixed?

from openapi-generator-cli.

Hi @wing328 , @axtx4869, I just had a look at the PR and it seems a node upgrade is required as well. A quick fix would be to update the node-version from 17.x to 18.x in the build.yaml file. However a more robust fix would be to fix all the node version inconsistencies across the project.

I can see the project now have a mixture of different node versions.

• Node 12 - through nrwl/nx
• Node 16 - through @types/node and e2e environment in build.yaml
• Node 17 - build environment in build.yaml

A quick and less impactful fix would be to upgrade the node version of both build and e2e environments in the build.yaml to node 18.

from openapi-generator-cli.

thanks for reviewing

agreed with updating the build to node 18

from openapi-generator-cli.

thanks for advice
let me do this tonight

A quick and less impactful fix would be to upgrade the node version of both build and e2e environments in the build.yaml to node 18.

from openapi-generator-cli.

maybe this is missing: https://github.com/ndrsg/openapi-generator-cli/blob/feat/update-nestjs-axios/jest.config.js#L10

from openapi-generator-cli.

Any news here? Love to see it updated. Hope @wing328 can say something about this?
Thank you so much for all your work @wing328!

from openapi-generator-cli.

The upgrade to axios v1.6.0 (the first version with the fixed vulnerability) was incorporated in nestjs/axios in version 3.0.1: https://github.com/nestjs/axios/releases/tag/3.0.1 through PR nestjs/axios@4cdd3f0
I am not sure how much work it would be for openapi-generator-cli to jump from nestjs/axios 0.1.0 to 3.0.1

from openapi-generator-cli.

Same issue as #715

from openapi-generator-cli.

Hi @wvanderdeijl, do you have plans to make this upgrade and release a version? This is a vulnerability of moderate severity and we would like to have it fixed sooner than later.

from openapi-generator-cli.

there is already a PR updating nestjs/axios to 2.0.0 #704

from openapi-generator-cli.

Thanks @alexan for the update. Would it address the mentioned axios vulnerability? I can see there are fixed axios dependency on versions <1.6.0 in both this repo and @nestjs/axios repo.

from openapi-generator-cli.

Any idea when this will be addressed?

from openapi-generator-cli.

Any update on the release date?

from openapi-generator-cli.

please help test #722

the CI tests still failed, which is the last remaining issue to address.

if anyone has time to contribute a fix, please kindly reply to the PR

from openapi-generator-cli.

@dutta-arnab1 updated the workflow to use node 18 but tests still failed. I wonder if you can take another look when you've time.

from openapi-generator-cli.

@wing328 sorry I was out for the rest of last year. What @alexan has pointed out seems to be the right solution, has this been incorporated? @axtx4869

from openapi-generator-cli.

PR merged. Thanks @elmarbeckmann.

from openapi-generator-cli.