webpack-dev-server: Missing Origin Validation during npm install

Operating System: Windows 10
Node Version: v11.1.0
NPM Version: 6.4.1
webpack Version: 3.12.0
webpack-dev-server Version: 3.1.10

This is a bug
This is a modification request

Code

N/A

Expected Behavior

npm install finishes without error

Actual Behavior

npm WARN deprecated browserslist@2.11.3: Browserslist 2 could fail on reading Browserslist >3.0 config used in other tools.
npm WARN deprecated browserslist@1.7.7: Browserslist 2 could fail on reading Browserslist >3.0 config used in other tools.

> node-sass@4.10.0 install C:\xampp\htdocs\laravue\node_modules\node-sass
> node scripts/install.js

Cached binary found at C:\Users\User\AppData\Roaming\npm-cache\node-sass\4.10.0\win32-x64-67_binding.node

> uglifyjs-webpack-plugin@0.4.6 postinstall C:\xampp\htdocs\laravue\node_modules\webpack\node_modules\uglifyjs-webpack-plugin
> node lib/post_install.js


> node-sass@4.10.0 postinstall C:\xampp\htdocs\laravue\node_modules\node-sass
> node scripts/build.js

Binary found at C:\xampp\htdocs\laravue\node_modules\node-sass\vendor\win32-x64-67\binding.node
Testing binary
Binary is fine
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN img-loader@3.0.1 requires a peer of imagemin@^5.0.0 || ^6.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN ajv-keywords@3.2.0 requires a peer of ajv@^6.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@1.2.4 (node_modules\fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@1.2.4: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"})

added 1189 packages from 698 contributors and audited 11710 packages in 196.717s
found 1 high severity vulnerability
  run `npm audit fix` to fix them, or `npm audit` for details

For Bugs; How can we reproduce the behavior?

On Windows environment, launch cmd and run the following commands ::

composer create-project --prefer-dist laravel/laravel laravel

And then run

npm install

For Features; What is the motivation and/or use-case for the feature?

About this issue

Original URL
State: closed
Created 6 years ago
Reactions: 5
Comments: 47 (2 by maintainers)

Most upvoted comments

I’m getting this directly when just installing webpack-dev-server. I create a new folder, run npm init then npm install webpack-dev-server --save and i get:

                       === npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Missing Origin Validation                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.1.11                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/725                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 high severity vulnerability in 3441 scanned packages
  1 vulnerability requires manual review. See the full report for details.

when i run npm audit

What’s interesting is that the link https://nodesecurity.io/advisories/725 informs me that this is regarding version 3.1.6 and earlier, but the latest i 3.1.14 right? is NPM maybe interpreting 3.1.1* as lower that 3.1.6?

millenjo on Jan 1, 2019

npm install laravel-mix@beta fixes the problem

SharakPL on Dec 7, 2018

Same here.

JhumanJ on Nov 21, 2018

I’m also getting the same issues. Althought I was update webpack-dev-server@3.1.14 . But I can’t run npm run dev. TypeError: Cannot destructure property compile of 'undefined' or 'null'.

quang5566 on Jan 3, 2019

This was due to a typo in the vulnerability database apparently: https://npm.community/t/advisory-725-inconsistently-marks-affected-versions/4333/3

evalineBai on Jan 2, 2019

Seeing the same. This issue hasn’t been fixed yet.

connecteev on Nov 21, 2018

Any chance the security fix will get backported to webpack-dev-server@2.x.x? We’re still on react-scripts@1.x.x yet which relies on this version range. Thanks for your consideration.

=== npm audit security report ===                        
                                                                                
# Run  npm install react-scripts@2.1.1  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Missing Origin Validation                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-scripts > webpack-dev-server                           │
├───────────────┼─���────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/725                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

tanx on Nov 12, 2018

If you run ‘npm install’ on Node v8.12.0, the following error appears. (npm v6.4.1)


┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Missing Origin Validation                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.1.11                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack-dev-server [dev]                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/725                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 high severity vulnerability in 10268 scanned packages
  1 vulnerability requires manual review. See the full report for details.

‘npm install’ on Node v6.14.4 does not output an error. (npm v3.10.10)

falsy on Jan 2, 2019

Issue still persist. Using fresh copy of create-react-app on Mac OS High sierra

amitozdeol on Dec 31, 2018

As am I, latest CRA is using webpack-dev-server@3.1.9 so I notified them in the existing issue that was opened https://github.com/facebook/create-react-app/issues/5777#issuecomment-450684848

ealexhaywood on Dec 31, 2018

I can confirm. I’m using create-react-app.

vldmrkl on Dec 31, 2018