Remediation Required for Checkmarx Findings – Chart.js SAST Finding and Uppy SCA Vulnerability #10813

2 Answer(s)

• 

  0

  AI-Bot created 2 months ago

  Support Team ABP Agent

  (1) Chart.js SAST finding (chart.umd.js in wwwroot/libs)

  • In ABP, files under wwwroot/libs/* are typically vendor copies produced by tooling (e.g., ABP CLI abp install-libs) rather than code you should patch inline. ABP’s own guidance is to re-generate/update the library source instead of manually editing it.
  • Remediation approach (ABP-aligned):
    1. Update the Chart.js dependency at the source (where it comes from in your frontend build / node_modules), then
    2. Re-copy/re-generate wwwroot/libs/chart.js/* (e.g., re-run the equivalent of ABP’s library installation/copy step used in your pipeline) so the minified/UMD file in wwwroot/libs matches the updated upstream library.
    3. Ensure your CI/CD does not keep an old wwwroot/libs snapshot pinned forever.
  • Mitigation/compensating controls if you can’t upgrade immediately:
    • Treat this as a client-side DoS/performance risk: ensure you do not accept arbitrary, attacker-controlled datasets/sizes for charts.
    • Enforce server-side limits on any API that feeds chart data (max points / max series / max payload size / pagination).
    • Add request throttling/rate limiting and payload size limits on endpoints that deliver chart data (so attackers can’t force huge datasets to be rendered).
    • Consider a WAF rule / API gateway policy limiting response sizes or query ranges for chart endpoints.
  • False-positive / exploitability note:
    • This type of finding often triggers because Chart.js iterates over input “data”; if your app never passes untrusted/attacker-controlled large arrays into chart rendering, exploitability is reduced. However, since it’s still a third-party library copy under wwwroot, the clean remediation is upgrading/regenerating the vendor asset rather than trying to justify it away.
  • I do not have an ABP-verified document that states a specific “safe Chart.js version” for this exact Checkmarx rule in a React UI setup.

  (2) Uppy SCA finding (uppy@5.2.4, CWE-843 / CVE published Apr 2026)

  • I cannot verify from ABP sources whether your ABP React application “actively uses” uppy@5.2.4, because that depends on your solution’s package.json / lockfile and whether you implemented an Uppy-based upload UI.
  • ABP-side position: ABP Framework itself doesn’t require Uppy as a mandatory React dependency (it would be part of your frontend dependencies if you added it).
  • Remediation approach:
    1. Search and remove/replace Uppy if it’s unused (drop dependency and rebuild).
    2. If used, upgrade Uppy to a fixed version per the advisory your SCA tool references (your security team’s feed should indicate the first patched version). After upgrading, rebuild and re-run SCA.
    3. If you cannot upgrade immediately: constrain upload inputs (max file size/count), enforce server-side validation/scanning, and isolate the upload UI route behind authentication/authorization—these don’t “fix” a type confusion bug but reduce practical exploit surface.
  • I don’t have a verified ABP source (docs/support ticket) that maps this CVE to a specific fixed Uppy version.

  ---

  Links (validated):

  • ABP Angular Chart component note (shows Chart.js is typically consumed as a dependency and loaded lazily rather than hand-maintained): https://abp.io/docs/latest/framework/ui/angular/chart-component
  • ABP support example illustrating wwwroot/libs artifacts are managed as copied vendor files (context for “don’t patch in place”): https://abp.io/support/questions/5067
  • ABP React UI docs (architecture/background): https://abp.io/docs/10.4/framework/ui/react

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created one month ago

  Support Team Fullstack Developer

  Hi,

  Both of these are third-party frontend assets that ABP copies into wwwroot/libs — neither is ABP server-side code, and neither needs an ABP/NuGet change. Here's where each one stands.

  Finding 1 — Chart.js "Unchecked Input For Loop Condition" (SAST)

  This is a Checkmarx SAST/taint rule, not a CVE. It flags that data flows into a loop condition inside chart.umd.js. That is the library's normal behavior — it iterates over whatever dataset arrays you pass it — so no Chart.js release clears this rule. There is no fixed version to move to; even the latest Chart.js 4.x still loops over datasets.

  On version, for completeness: @abp/chart.js declares chart.js as ^4.5.0, and the latest 4.x is 4.5.1. Moving to it is version hygiene, not a fix for this finding. If you do want to refresh the copied asset, update/verify your frontend lockfile first, then re-run abp install-libs — the copy step uses whatever your lockfile has resolved, it doesn't bump versions on its own.

  The realistic exposure here is client-side, in the end user's own browser, and only if the app feeds attacker-controlled, unbounded arrays into a chart. So the actionable checks are:

  • Confirm your app doesn't pass untrusted, unbounded datasets straight into Chart.js. If any path does, cap the series/points count at the application boundary (or paginate the underlying API).
  • Close the finding as a false positive / non-exploitable with that justification. If you exclude vendored minified bundles (wwwroot/libs/**) from SAST, keep those files under SCA/SBOM so you don't lose third-party dependency coverage.

  Finding 2 — Uppy CWE-843 Type Confusion (SCA)

  This is the same CVE as your earlier ticket #10670 — CVE-2025-70023. The public record for it is thin:

  • NVD names only transloadit uppy v0.25.6, a 2017 0.x release: https://nvd.nist.gov/vuln/detail/CVE-2025-70023
  • The GitHub advisory lists affected and patched versions as Unknown, and the only reference is a bare gist with no PoC or attack path
  • Snyk shows uppy@5.2.4 with no direct vulnerabilities

  Checkmarx's own AppSec research widened the affected range to reach 5.2.4, which is exactly the "differs from NVD" note in your report. To your specific questions:

  • Upgrade path to a fixed version? There isn't one to move to. @abp/uppy declares uppy as ^5.1.2, and 5.2.4 is already the latest Uppy release — there is no higher or patched version published.
  • Is it used? Uppy comes in through @abp/cms-kit.admin and the Pro upload UIs (File Management, Identity user import, Account profile picture). Whether it's actually reached at runtime depends on which of those screens your app exposes — the dependency being installed doesn't mean the upload UI is in use.
  • Mitigation / closure. Since public records don't currently list the 5.x line as affected and there's no PoC or published fix, the defensible path is to dispute the finding with Checkmarx and ask them to share the specific code path in 5.2.4 and the basis for their expanded affected range. Until they provide that, this is vendor-clarification-pending rather than a confirmed exposure. As structural context you can include: Uppy is a client-side file picker running in the end user's own browser; uploaded files still pass through ABP's server-side authentication, authorization, and BlobStoring layer, so a client-side type-confusion doesn't bypass those.

  To keep Uppy tracking the latest 5.x over time, keep your @abp/* npm packages current rather than pinning Uppy yourself — pinning to 5.2.4 wouldn't change what you already have and would only block a future compatible 5.x patch.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel