npm audit
=== npm audit security report ===
# Run npm update terser-webpack-plugin --depth 3 to resolve 1 vulnerability
Moderate Cross-Site Scripting
Package serialize-javascript
Dependency of @angular-devkit/build-angular [dev]
Path @angular-devkit/build-angular > webpack >
terser-webpack-plugin > serialize-javascript
More info https://npmjs.com/advisories/1426
Manual Review
Some vulnerabilities require your attention to resolve
Visit https://go.npm.me/audit-guide for additional guidance
Moderate Cross-Site Scripting
Package serialize-javascript
Patched in >=2.1.1
Dependency of @angular-devkit/build-angular [dev]
Path @angular-devkit/build-angular > copy-webpack-plugin >
serialize-javascript
More info https://npmjs.com/advisories/1426
Moderate Cross-Site Scripting
Package serialize-javascript
Patched in >=2.1.1
Dependency of @angular-devkit/build-angular [dev]
Path @angular-devkit/build-angular > terser-webpack-plugin >
serialize-javascript
More info https://npmjs.com/advisories/1426
found 3 moderate severity vulnerabilities in 18591 scanned packages
run `npm audit fix` to fix 1 of them.
2 vulnerabilities require manual review. See the full report for details.
package.json
{
"name": "client",
"version": "0.0.1",
"author": "Ionic Framework",
"homepage": "https://ionicframework.com/",
"scripts": {
"ng": "ng",
"start": "ng serve",
"build": "ng build",
"test": "ng test",
"lint": "ng lint",
"e2e": "ng e2e"
},
"private": true,
"dependencies": {
"@angular/common": "8.1.2",
"@angular/compiler": "8.1.2",
"@angular/core": "8.1.2",
"@angular/fire": "5.2.3",
"@angular/forms": "8.1.2",
"@angular/platform-browser": "8.1.2",
"@angular/platform-browser-dynamic": "8.1.2",
"@angular/router": "8.1.2",
"@ionic-native/camera": "5.12.0",
"@ionic-native/contacts": "5.12.0",
"@ionic-native/core": "5.0.0",
"@ionic-native/facebook": "5.12.0",
"@ionic-native/file": "5.12.0",
"@ionic-native/firebase-x": "5.12.0",
"@ionic-native/http": "5.13.0",
"@ionic-native/splash-screen": "5.0.0",
"@ionic-native/status-bar": "5.0.0",
"@ionic/angular": "4.11.5",
"@ionic/storage": "2.2.0",
"@nomadreservations/ngx-stripe": "1.2.0-beta.0",
"angular-cropperjs": "1.0.1",
"cordova-android": "8.0.0",
"cordova-ios": "5.0.1",
"cordova-plugin-advanced-http": "2.1.1",
"cordova-plugin-androidx": "1.0.2",
"cordova-plugin-androidx-adapter": "1.1.0",
"cordova-plugin-camera": "4.1.0",
"cordova-plugin-contacts": "3.0.1",
"cordova-plugin-device": "2.0.2",
"cordova-plugin-facebook4": "6.0.0",
"cordova-plugin-file": "6.0.2",
"cordova-plugin-firebasex": "6.0.7",
"cordova-plugin-ionic-keyboard": "2.1.3",
"cordova-plugin-ionic-webview": "4.1.1",
"cordova-plugin-splashscreen": "5.0.2",
"cordova-plugin-statusbar": "2.4.2",
"cordova-plugin-whitelist": "1.3.3",
"cordova-sqlite-storage": "^3.4.1",
"core-js": "2.5.4",
"firebase": "7.4.0",
"ionic": "5.4.6",
"jsurl": "0.1.5",
"lodash": "^4.17.15",
"moment": "^2.24.0",
"ngx-image-cropper": "1.4.1",
"ngx-moment": "^3.5.0",
"rxjs": "6.5.3",
"socket.io": "2.2.0",
"tslib": "1.10.0",
"zone.js": "0.9.1"
},
"devDependencies": {
"@angular-devkit/architect": "0.801.2",
"@angular-devkit/build-angular": "^0.801.2",
"@angular-devkit/core": "8.1.2",
"@angular-devkit/schematics": "8.1.2",
"@angular/cli": "8.1.2",
"@angular/compiler-cli": "8.1.2",
"@angular/language-service": "8.1.2",
"@ionic/angular-toolkit": "^2.1.1",
"@types/jasmine": "3.3.8",
"@types/jasminewd2": "2.0.3",
"@types/node": "8.9.4",
"codelyzer": "5.0.0",
"cordova-plugin-device": "2.0.2",
"cordova-plugin-ionic-keyboard": "2.1.3",
"cordova-plugin-ionic-webview": "4.1.1",
"cordova-plugin-splashscreen": "5.0.2",
"cordova-plugin-statusbar": "2.4.2",
"cordova-plugin-whitelist": "1.3.3",
"jasmine-core": "3.4.0",
"jasmine-spec-reporter": "4.2.1",
"karma": "4.1.0",
"karma-chrome-launcher": "2.2.0",
"karma-coverage-istanbul-reporter": "2.0.1",
"karma-jasmine": "2.0.1",
"karma-jasmine-html-reporter": "1.4.0",
"protractor": "5.4.0",
"ts-node": "7.0.0",
"tslint": "5.15.0",
"typescript": "3.4.5"
},
"description": "An Ionic project",
"cordova": {
"plugins": {
"cordova-plugin-whitelist": {},
"cordova-plugin-statusbar": {},
"cordova-plugin-device": {},
"cordova-plugin-splashscreen": {},
"cordova-plugin-ionic-webview": {
"ANDROID_SUPPORT_ANNOTATIONS_VERSION": "27.+"
},
"cordova-plugin-ionic-keyboard": {},
"cordova-plugin-camera": {
"ANDROID_SUPPORT_V4_VERSION": "27.+"
},
"cordova-plugin-firebasex": {
"ANDROID_ICON_ACCENT": "#FF00FFFF",
"ANDROID_PLAY_SERVICES_TAGMANAGER_VERSION": "17.0.0",
"ANDROID_FIREBASE_CORE_VERSION": "17.0.0",
"ANDROID_FIREBASE_MESSAGING_VERSION": "19.0.0",
"ANDROID_FIREBASE_CONFIG_VERSION": "18.0.0",
"ANDROID_FIREBASE_PERF_VERSION": "18.0.0",
"ANDROID_FIREBASE_AUTH_VERSION": "18.0.0",
"ANDROID_CRASHLYTICS_VERSION": "2.10.1",
"ANDROID_CRASHLYTICS_NDK_VERSION": "2.1.0",
"ANDROID_SHORTCUTBADGER_VERSION": "1.1.22"
},
"cordova-plugin-contacts": {},
"cordova-plugin-advanced-http": {
"OKHTTP_VERSION": "3.10.0"
},
"cordova-plugin-facebook4": {
"APP_ID": "412958516026250",
"APP_NAME": "Peeps",
"FACEBOOK_HYBRID_APP_EVENTS": "false",
"FACEBOOK_ANDROID_SDK_VERSION": "5.2.0"
},
"cordova-sqlite-storage": {}
},
"platforms": [
"ios",
"android"
]
}
}
跨站点脚本 serialize-javascript
npm doc：https://www.npmjs.com/advisories/1426
它说：
概述
2.1.1之前的
serialize-javascript版本容易受到跨站点脚本（XSS）的攻击。该软件包无法清除序列化的正则表达式。此漏洞不会影响Node.js应用程序。修复
升级到2.1.1或更高版本。
但是我没有在serialize-javascript文件上使用package.json。我怎样才能解决这个问题？
答案 0 :(得分：3)
OP的反馈
我们也需要添加它：
"scripts": {
"preinstall": "npx npm-force-resolutions"
}
原始
这似乎与Angular依赖关系有关，对我来说似乎很新，因此Angular团队可能很快会解决。 解决方法是，尝试自行解决依赖关系。
首先，您需要第三方帮助程序： https://github.com/rogeriochaves/npm-force-resolutions
然后在您的package.json上添加：
"resolutions": {
"serialize-javascript": "^2.1.1"
}
最后：
rm -r node_modules
npx npm-force-resolutions
npm install
答案 1 :(得分：0)
@angular-devkit/build-angular v8.3.21已发布。 npm audit fix现在可以自动修复此漏洞。
参考：https://github.com/angular/angular-cli/issues/16414#issuecomment-567990763