I scan a Docker image build by Wappler for vulnerabilities using snyk scan and this is what I found

Wappler General
1

To my Wappler sharp shooters @George @patrick @Teodor

So, recently I have been testing and using snyk to scan all Docker images I build using Wappler to see if there are vulnerability that are introduce from other packages dependencies in any of the Node.js projects that I am using Wappler to spin up and test.

Here are some screenshots of the snyk report and I was wondering if these finding are something that the Wappler team can speak to or keep an eye out for, when fix are available or how to protect against?
…

image
image1621×846 151 KB

…
image
image1411×686 49.3 KB

…
express-fileupload
knex
knex: Learn about this type of vulnerability
…
image
image1357×855 166 KB

…
image
image1369×956 135 KB

…
As I continue to add more dependencies to this image and rebuild it and scan it I will report back here with screenshot but for now I just want to see how significant these finding are? Looking forward to here if this is something I should be worrying about.

1 Like
2

Here are other breakdown from other files.

…

image
image1653×895 197 KB

…
image
image1218×870 57.7 KB

…
image
image1192×847 61 KB

…
image
image1182×825 60.6 KB

…
image
image1204×826 56.1 KB

…
image
image1191×838 59.7 KB

…
image
image1197×403 28.2 KB

…

1 Like
3

Thank you for taking the time to upload and share all of these.

I’m curious if Snyk understand the JS Execution Context when it flags these - especially the ones in the second post.

My own Snyk results were similar on a test run and some of the flags seemed to be protected or somewhat unlikely to be a problem given the context of the specific functions.

4

Yeah good question @nomad, I am curious to see what the Wappler Team thoughts are on it too because I too was wondering the same thing.

1 Like
5

To the Wappler Team @George @patrick

So, Snyk has suggested a fix for the SQL injection vulnerability for the package.json (connect-session-knex and knex) dependencies. They suggest a version update for those dependencies.

My question is, If I go ahead and update the dependencies version in my test project will it cause any significant breaking to functionalities?

image
image963×798 37.6 KB

6

We recently updates most of those NodeJS packages, so if you open and update your project in Wappler and redeploy all the new packages will be used.

1 Like
7

Thanks @George I will do that.

8

I have found this useful to ‘force’ patch package vulnerabilities, but of course it could break stuff…
“You can now specify an overrides property in your package.json to override and enforce nested dependency versions.”*

{
 "overrides": {
  "bar@2.0.0": {
    "foo": "1.0.0"
  }
 }
}

*https://www.stefanjudis.com/today-i-learned/how-to-override-your-dependencys-dependencies/