c647191a79
Comprehensive security analysis and fixes addressing multiple vulnerabilities identified in code and dependencies. Security Fixes: - LS47: Replace Math.random() with crypto.getRandomValues() for padding - GOST: Add warning when falling back to insecure Math.random() - Both maintain backward compatibility with graceful fallbacks Documentation: - SECURITY_ANALYSIS.md: Comprehensive audit of 35 npm vulnerabilities - SECURITY_FIXES_APPLIED.md: Detailed changelog of all security improvements - scripts/security-fix.sh: Automated dependency update script Key Findings: - 35 npm vulnerabilities (8 critical, 8 high, 11 moderate, 8 low) - Critical: eval() usage in OutputWaiter.mjs (requires review) - Medium: 20+ innerHTML usages (most properly escaped) - Low: Math.random() in crypto contexts (now fixed) Recommendations: 1. Run ./scripts/security-fix.sh to update dependencies 2. Review eval() usage for CSP implementation 3. Audit innerHTML sources in App.mjs 4. Enable automated security scanning (Dependabot/Snyk) Impact: - Improved cryptographic security in LS47 and GOST operations - Better visibility of fallback RNG usage - Clear security documentation for maintainers - Automated tools for dependency management All changes are backward compatible with graceful degradation.
78 lines
2.5 KiB
Bash
Executable File
78 lines
2.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# Security Fix Script for CyberChef
|
|
# This script updates vulnerable dependencies identified in the security audit
|
|
|
|
set -e # Exit on error
|
|
|
|
echo "🔒 CyberChef Security Auto-Fix"
|
|
echo "================================"
|
|
echo ""
|
|
|
|
# Colors for output
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m' # No Color
|
|
|
|
# Check if we're in the right directory
|
|
if [ ! -f "package.json" ]; then
|
|
echo -e "${RED}Error: package.json not found. Please run this script from the CyberChef root directory.${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
# Backup package-lock.json
|
|
echo -e "${YELLOW}📋 Creating backup of package-lock.json...${NC}"
|
|
if [ -f "package-lock.json" ]; then
|
|
cp package-lock.json package-lock.json.backup
|
|
echo -e "${GREEN}✓ Backup created: package-lock.json.backup${NC}"
|
|
else
|
|
echo -e "${YELLOW}⚠ No package-lock.json found, skipping backup${NC}"
|
|
fi
|
|
|
|
echo ""
|
|
echo -e "${YELLOW}📦 Updating critical security dependencies...${NC}"
|
|
echo ""
|
|
|
|
# Update @babel packages (ReDoS vulnerability)
|
|
echo "1. Updating @babel/runtime (GHSA-968p-4wvh-cqc8)..."
|
|
npm install @babel/runtime@^7.26.10 || echo -e "${RED}Failed to update @babel/runtime${NC}"
|
|
|
|
echo "2. Updating @babel/helpers (GHSA-968p-4wvh-cqc8)..."
|
|
npm install --save-dev @babel/helpers@^7.26.10 || echo -e "${RED}Failed to update @babel/helpers${NC}"
|
|
|
|
# Update webpack-dev-server (Source code theft vulnerability)
|
|
echo "3. Updating webpack-dev-server (GHSA-9jgg-88mc-972h)..."
|
|
npm install --save-dev webpack-dev-server@^5.2.2 || echo -e "${RED}Failed to update webpack-dev-server${NC}"
|
|
|
|
# Update tmp (Symlink vulnerability)
|
|
echo "4. Updating tmp (GHSA-52f5-9888-hmc6)..."
|
|
npm install --save-dev tmp@^0.2.5 || echo -e "${RED}Failed to update tmp${NC}"
|
|
|
|
# Update bcryptjs (Recommended update)
|
|
echo "5. Updating bcryptjs (recommended)..."
|
|
npm install bcryptjs@^3.0.3 || echo -e "${RED}Failed to update bcryptjs${NC}"
|
|
|
|
echo ""
|
|
echo -e "${YELLOW}🔍 Running npm audit fix...${NC}"
|
|
npm audit fix || echo -e "${YELLOW}⚠ npm audit fix completed with warnings${NC}"
|
|
|
|
echo ""
|
|
echo -e "${YELLOW}📊 Final security audit:${NC}"
|
|
echo "================================"
|
|
npm audit || true
|
|
|
|
echo ""
|
|
echo -e "${GREEN}✅ Security fixes applied!${NC}"
|
|
echo ""
|
|
echo -e "${YELLOW}⚠️ IMPORTANT: Please test the application thoroughly before deploying.${NC}"
|
|
echo ""
|
|
echo "Next steps:"
|
|
echo " 1. Run: npm test"
|
|
echo " 2. Run: npm run build"
|
|
echo " 3. Test all critical functionality"
|
|
echo ""
|
|
echo "If you encounter any issues, restore the backup:"
|
|
echo " mv package-lock.json.backup package-lock.json"
|
|
echo " npm install"
|
|
echo ""
|