Security issue on jsonpath plus

[josephjclark]

Taken at face value this looks very serious indeed:

https://github.com/OpenFn/adaptors/security/dependabot/104
https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884

It provides an attack vector into the runtime sandbox, allowing arbitry execution of commands (via process, child_process, etc).

The affected APIs are widely-used functions in common, like each and dataValue. Anything that accepts a JSON path.

A fix to all adaptors would be required, but this would not affect legacy adaptors in production right now. We may have to back port a fix to common 1.0 too

[josephjclark]

Yep, running in the CLI, I can get my environment with:

const CMD = "console.log(process.env)";
const ATTACK  = `$[(this.constructor.constructor("${CMD}")())]`

each(ATTACK, fn((state) => {
    console.log(state.data)
    return state;
}))

I can presumably do what I want from here - run shell commands or whatever.

[josephjclark]

I've merged in fixes for latest adaptor releases, including a legacy common 1.15.2 patch.

That means that our latest adaptors are at least secure.

[josephjclark]

My best idea so far for a safe legacy fix is to add logic to the compiler.

If we detect a json path string like $.a.b.c with anything weird in it, like parenthesis, the compiler could throw.

Workflows which do use jsonpath strings should really only be using super simple expressions, and I'd be reasonably happy to throw if anything looks amiss in those strings. I think the pattern is fairly strong.

This doesn't help us on v1, although since the compiler uses the same basic technologies I suppose we could backport a fix.