Security Review Summary - Mapbox-gl-rtl-text - 2021-05-13

Overall, the current vendor code under consideration has an overall risk rating of: medium.
This project is not updated and has a lot of open vulnerabilities. However, since user data isn't collected and there don't seem to be other privacy concerns, I think usability for RTL languages is worth the medium risk. If possible, we should try to do the necessary updates and possibly help with maintenance of this project.

General Security Information

Vulnerable Packages
The tap package is extremely out of date, it's currently at version 5.8 and the latest version is at 15.0
It's only a dev dependency, but npm audit returned 54 vulnerabilities, including 17 high and 2 critical,
all from dependencies of the npm tap package
Similar to npm audit, snyk also found 8 high vulnerabilities from Istanbul, which is a dependency of tap
I think this is a medium risk, despite it being a dev package, there are too many open issues

Outdated Packages
As reported via npm outdated:
None reported

General Security Issues

1. There's an open issue about the build script that has yet to be addressed by the project maintainers - https://github.com/mapbox/mapbox-gl-rtl-text/pull/26
2. There's only 1 maintainer with over 10 commits and this project hasn't been updated in two years
3. As mentioned above, the tap package is out of date and has over 50 listed vulnerabilities. It's only a dev dependency, but with that many vulnerabilities it's really a risk
4. There is no package-lock.json file in the repo

@MSantos this is medium risk if it is still going to be used in a production capacity. In that case, we either need a mitigation plan to address the security issues or your manager/tech lead needs to accept the risk, which means that this project will be added to the WMF risk registry.

Thank you @Mstyles for doing the review. Just FYI, before thinking about accepting the risk we will be considering the following steps:

• RTL languages will be flagged to not use client-side rendering when available as part of the WIP language coverage report T281230: Benchmark language coverage for the mapbox-gl style in comparison with current production style
• We'll ask for maplibre-gl group to support it and wait for their decision, since we will be using maplibre instead of mapbox and they have been forking a lot of dependencies to maintain
• After all of that we will think about mitigating the risks involved and/or accept the remaining risks

This should keep stalled for now.

@MSantos - Does it look like this library will eventually be used within Wikimedia production? Or should we decline this task for now? Thanks.