You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Recently, the Cloud.gov platform engineers scanned Cloud.gov to determine if any applications hosted in Cloud.gov were vulnerable to the polyfill.io attack (see https://fossa.com/blog/polyfill-supply-chain-attack-details-fixes/). The scan was performed by searching for the term "polyfill.io" in the application code deployed to platform. The ecmps-ui in the perf environment was flagged as having the vulnerability. After reviewing the finding and the code it appears that this term is used in a warning message produced by the react-router-dom library (see remix-run/react-router#11733). Although the code is not vulnerable to this attack we should update the library to remove the reference to the polyfill.io website.
Need to update to at least version 6.24.1.
The text was updated successfully, but these errors were encountered:
mark-hayward-erg
changed the title
Update the react-router-dom library to remove the polyfill.io term in the warning message
Update the react-router-dom library to remove the polyfill.io term in the warning message (ECMPS/CAMPD 2.0)
Aug 5, 2024
The easey-design-system has @storybook/router as a Dev dependency, which has react-router and react-router-dom as dependencies. As a dev dependency, however, it will not be bundled into easey-design-system builds, and so it will not be in easey-ecmps-ui or easey-campd-ui application code.
We may still want to update storybook in easey-design-system at a later time, but this involves two major versions so it will require more effort.
mark-hayward-erg
changed the title
Update the react-router-dom library to remove the polyfill.io term in the warning message (ECMPS/CAMPD 2.0)
Update the react-router-dom library to remove the polyfill.io term in the warning message (ECMPS 2.0)
Aug 22, 2024
Recently, the Cloud.gov platform engineers scanned Cloud.gov to determine if any applications hosted in Cloud.gov were vulnerable to the polyfill.io attack (see https://fossa.com/blog/polyfill-supply-chain-attack-details-fixes/). The scan was performed by searching for the term "polyfill.io" in the application code deployed to platform. The ecmps-ui in the perf environment was flagged as having the vulnerability. After reviewing the finding and the code it appears that this term is used in a warning message produced by the react-router-dom library (see remix-run/react-router#11733). Although the code is not vulnerable to this attack we should update the library to remove the reference to the polyfill.io website.
Need to update to at least version 6.24.1.
The text was updated successfully, but these errors were encountered: