Bug DFBUGS-873: [CVE] Improper input validation in PostCSS

.eslintrc.js

@@ -86,6 +86,7 @@ module.exports = {
           '**/*.spec.tsx',
           './jest/setup.ts',
           './cypress/**',
+          './analyzeTest.ts',
         ],
         optionalDependencies: false,
         peerDependencies: false,

analyzeTest.ts

@@ -1,4 +1,5 @@
 import * as fs from 'fs';
+import { parseChunked } from '@discoveryjs/json-ext';
 
 const pluginName = process.env.PLUGIN;
 const MAX_ASSET_SIZE = 17; //17 MiB
@@ -12,17 +13,17 @@ const stringifyMiB = (value: ReturnType<typeof toMiB>): string =>
 
 const getParsedStatFile = () => {
   const filePath = getStatsFilePath();
-  const statsFile = fs.readFileSync(filePath, 'utf-8');
-  return JSON.parse(statsFile);
+
+  return parseChunked(fs.createReadStream(filePath, { encoding: 'utf8' }));
 };
 
 type BundleDataMap = Record<string, number>;
 
 // [Valid Bundles, Violating Bunldes]
-type GetBundleInformation = () => [BundleDataMap, BundleDataMap];
+type GetBundleInformation = () => Promise<[BundleDataMap, BundleDataMap]>;
 
-const getBundleInformation: GetBundleInformation = () => {
-  const statsData = getParsedStatFile();
+const getBundleInformation: GetBundleInformation = async () => {
+  const statsData = await getParsedStatFile();
   const validAssets = {};
   const violatingAssets = {};
 
@@ -39,8 +40,8 @@ const getBundleInformation: GetBundleInformation = () => {
   return [validAssets, violatingAssets];
 };
 
-const validateBuild = () => {
-  const [validAssets, violatingAssets] = getBundleInformation();
+const validateBuild = async () => {
+  const [validAssets, violatingAssets] = await getBundleInformation();
   if (Object.keys(violatingAssets).length > 0) {
     // eslint-disable-next-line no-console
     console.error('Assets are larger than expected', violatingAssets);

package.json

@@ -77,7 +77,7 @@
     "circular-dependency-plugin": "5.x",
     "classnames": "^2.3.1",
     "copy-webpack-plugin": "^7.0.0",
-    "css-loader": "0.28.x",
+    "css-loader": "^6.11.0",
     "eslint-config-airbnb": "18.2.1",
     "file-loader": "1.x",
     "fork-ts-checker-webpack-plugin": "^7.2.13",
@@ -109,7 +109,7 @@
     "sass": "^1.55.0",
     "sass-loader": "^13.0.2",
     "semver": "6.x",
-    "style-loader": "^0.23.1",
+    "style-loader": "^3.3.4",
     "thread-loader": "3.0.4",
     "ts-loader": "^9.4.1",
     "ts-node": "5.0.1",
@@ -124,6 +124,7 @@
   },
   "devDependencies": {
     "@cypress/webpack-preprocessor": "^5.9.1",
+    "@discoveryjs/json-ext": "0.6.1",
     "@swc/core": "1.3.19",
     "@swc/jest": "^0.2.23",
     "@testing-library/jest-dom": "^6.4.5",
@@ -166,21 +167,22 @@
     "mochawesome-merge": "^4.2.0",
     "prettier": "2.3.2",
     "read-pkg": "5.x",
-    "stylelint": "^13.13.1",
-    "stylelint-config-sass-guidelines": "^8.0.0",
-    "stylelint-config-standard": "^22.0.0",
-    "stylelint-order": "^4.1.0",
+    "stylelint": "^15.11.0",
+    "stylelint-config-sass-guidelines": "^10.0.0",
+    "stylelint-config-standard": "^34.0.0",
+    "stylelint-order": "^6.0.4",
     "webpack-dev-server": "^4.15.2"
   },
   "resolutions": {
-    "nanoid": "^3.3.8",
+    "cross-spawn": "^7.0.6",
     "jest-environment-jsdom/jsdom": "^20.0.3",
+    "nanoid": "^3.3.8",
+    "postcss": "^8.4.49",
+    "tough-cookie": "^4.1.3",
     "webpack": "5.94.0",
     "webpack-bundle-analyzer/ws": "^7.5.10",
     "webpack-dev-server/express": "^4.21.0",
-    "webpack-dev-server/ws": "^8.18.0",
-    "tough-cookie": "^4.1.3",
-    "cross-spawn": "^7.0.6"
+    "webpack-dev-server/ws": "^8.18.0"
   },
   "engines": {
     "node": ">=14.17.0"