-
-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Closed
Description
Describe the bug
Malicious code introduced in colors
version 1.4.1 and 1.4.2 causes Cucumber.js to fall into an infinite loop, printing gibberish to the terminal.
CC: @davidjgoss @aslakhellesoy @jbpros
To Reproduce
Use any feature that prints to the terminal, for example:
npx @cucumber/cucumber --version
Screenshots
If applicable, add screenshots to help explain your problem.
Desktop (please complete the following information):
- OS: any
- Browser any
- Version all (Serenity/JS runs tests against Cucumber 1.x to 8.x, the issue is present in all version of Cucumber because of the dependency on
cli-table3
and/orcolors
)
TO FIX
Short term:
- Pin dependency on
colors
to1.4.0
- see Zalgo issue withv1.4.44-liberty-2
release Marak/colors.js#285 (comment), or ideally"@dabh/colors": "1.4.0"
, since there's no guaranteecolors
1.4.0
will not get compromised next - Update
cli-table3
to^0.6.1
- seecolors.js
has issues cli-table/cli-table3#251
Long term:
- Consider replacing
colors
withchalk
Additional context
Add any other context about the problem here.
chhar11
Metadata
Metadata
Assignees
Labels
No labels