Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix ngx-bootstrap vulnerability #125

Closed
mjtravers opened this issue Feb 17, 2022 · 1 comment
Closed

Fix ngx-bootstrap vulnerability #125

mjtravers opened this issue Feb 17, 2022 · 1 comment

Comments

@mjtravers
Copy link
Contributor

mjtravers commented Feb 17, 2022

The ngx-bootstrap has an XSS vulnerability: https://app.circleci.com/pipelines/github/fecgov/fecfile-web-app/169/workflows/bcad3ac5-e317-4c95-a216-fe2fa42befbf/jobs/652

The vulnerability looks to be how the typeahead is being used. Fix the XSS issue for the typeahead either by using the ng-bootstrap library (also in use) has may have a better implementation of typeahead or by escaping data before use in the ngx-bootstrap typeahead.

Stretch goal: It'd be nice to have only one angular bootstrap library dependency, so while in the code, evaluate the level of effort to move the site entirely into ng-bootstrap

Acceptance Criteria
Snyk does not report a XSS vulnerability in its report.

QA Notes

null

DEV Notes

null

Design

null

@mjtravers mjtravers changed the title Remove ngx-bootstrap in favor of ng bootstrap library Remove ngx-bootstrap in favor of ng-bootstrap library Feb 17, 2022
@mjtravers mjtravers changed the title Remove ngx-bootstrap in favor of ng-bootstrap library Fix ngx-bootstrap vulnerability Feb 17, 2022
@mjtravers
Copy link
Contributor Author

This issue is no longer relevant as ngx-bootstrap has been removed from the app during the work preformed for issue #156.
Closing ticket.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant