From b3a7d746124d72a19b5c3b9bfb633f81d675c90e Mon Sep 17 00:00:00 2001 From: himsgupta1122 <115103225+himsgupta1122@users.noreply.github.com> Date: Thu, 3 Nov 2022 18:25:46 -0700 Subject: [PATCH] Security-CVEs fixes guidelines (#2674) * Security-CVEs fixes guidelines Signed-off-by: himsgupta1122 * styling Signed-off-by: himsgupta1122 * add example Signed-off-by: himsgupta1122 * add documention Signed-off-by: himsgupta1122 Signed-off-by: himsgupta1122 Signed-off-by: Ajay Gupta --- SECURITY.md | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 0b85ca04ed2..f450e11235b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,3 +1,27 @@ ## Reporting a Vulnerability -If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do **not** create a public GitHub issue. \ No newline at end of file +- If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do **not** create a public GitHub issue. + +- For Security-CVE related fix - + - For direct dependency - Use ```yarn upgrade package``` to update the package and in order to enforce as sub-deps please add nested-dep step2. + + - For nested dependency/sub-deps - In order to enforce package above Vx.y.z, we can add version in the resolutions [section](https://classic.yarnpkg.com/lang/en/docs/selective-version-resolutions/) for all the package sub-deps or specific package sub-dep. For more on version updates please see +[Why](https://classic.yarnpkg.com/lang/en/docs/selective-version-resolutions/#toc-why-would-you-want-to-do-this) and [How](https://classic.yarnpkg.com/lang/en/docs/selective-version-resolutions/#toc-how-to-use-it) to upgrade. + - To add the CVEs fix to previous versions, add label ex: backport 1.x. + + ``` + Example: foobar@1.x vulnerable package and 1.y is the fix + step 1: + For direct dependency checks: + run: yarn upgrade foobar@1.y to update the package.json + and yarn install to update the yarn.lock file + Step 2. + Check for sub deps foobar in other package. + If foobar@1.x exists for subdeps in yarn.lock file + Then edit the package.json file and add **/foobar@1.y in resolution section as shown below to enforce the 1.y. + 'resolutions': { "**/foobar": "^1.y", + "**/foo": "^2.x" , + "**/bar": "^3.k"} + Then run: yarn install for updating yarn.lock file + + \ No newline at end of file