GitHub Advisoryadvisory · npm

GHSA-vxjg-hchx-cc4g @simonsmith/cypress-image-snapshothas fix for insecure snapshot file names

MEDIUM Published 2023-08-01 Modified 2023-08-04 Official page ↗
Aliases
CVE-2023-38695
Ecosystem
npm
Packages
@simonsmith/cypress-image-snapshot
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2023-08-01

Affected packages

• npm @simonsmith/cypress-image-snapshot: < 8.0.2 → fixed in 8.0.2

Description

Impact It's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. Example: ```js cy.get('h1').matchImageSnapshot('../../../ignore-relative-dirs') ``` The above will create an `ignore-relative-dirs.png` three levels up Patches Fixed in `8.0.2` Workarounds Validate all the existing uses of `matchImageSnapshot` to ensure correct use of the filename argument. Example: ```js // snapshot name will be the test title cy.matchImageSnapshot(); // snapshot name will be the name passed in cy.matchImageSnapshot('login'); ``` References https://github.com/simonsmith/cypress-image-snapshot/issues/15

Related

Alias · CVE (1)

  • CVE-2023-38695 cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References