Add nsprc file to npm-audit with expiration for ip vulnerability

[dlpzx]

Feature or Bugfix

• Bugfix

Detail

• Add .nsprc file for ignored vulnerabilities in better-npm-audit.
• Added ip package to ignored vulnerabilities with expiration 2024/02/28: https://www.cve.org/CVERecord?id=CVE-2023-42282

The vulnerability found in ip affects us because we use the react-native-community/cli package. In this package repository an issue reporting the vulnerabilty was already raised.

Update: ip team is working on a fix: indutny/node-ip#138

Relates

• https://www.cve.org/CVERecord?id=CVE-2023-42282

Security

Please answer the questions below briefly where applicable, or write N/A. Based on
OWASP 10.

• Does this PR introduce or modify any input fields or queries - this includes
  fetching data from storage outside the application (e.g. a database, an S3 bucket)?
  • Is the input sanitized?
  • What precautions are you taking before deserializing the data you consume?
  • Is injection prevented by parametrizing queries?
  • Have you ensured no eval or similar functions are used?
• Does this PR introduce any functionality or component that requires authorization?
  • How have you ensured it respects the existing AuthN/AuthZ mechanisms?
  • Are you logging failed auth attempts?
• Are you using or adding any cryptographic features?
  • Do you use a standard proven implementations?
  • Are the used keys controlled by the customer? Where are they stored?
• Are you introducing any new policies/roles/users?
  • Have you used the least-privilege principle? How?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[noah-paige]

looks good - hope there is a patch for this soon! Approving this PR since we are not affected by this vulnerability

[levpachmanov]

Hi @dlpzx ,

The node-ip library seems to be unmaintained - the last commit is from 2 years ago and vulnerability was published after the maintainer haven't responded within 90 days

We're part of a startup called Seal Security that mitigates software vulnerabilities in older open source versions by backporting/creating standalone security patches - enabling more straightforward remediation in cases like this. We created an ip 1.1.8-sp and 2.0.0-sp1 that's vulnerability-free. As with all of our patches, it's open-source and available for free.

If relevant, check out our GitHub repo if you wish to learn more, or start using our app.

Please feel free to reach us at [email protected] if you have any requests/questions.

[dlpzx]

Hi @levpachmanov, thank you for reaching out :)

We are keeping an eye on node-ip and on this PR, where I see you also commented. We will assess your solution as well. One question, in our case we do not use ip directly, it is a dependency of a dependency. Do you have any recommendations/drawbacks for such cases?