Restore A9 vulnerability

[rcowsill]

The A9 - Insecure Components example requires [email protected]; that's the newest version affected by the XSS described in the tutorial. After A9 was implemented the package.json got updated to use [email protected], and that stopped the example exploit from working.

This changes the package.json to specify [email protected] so the tutorial example works as expected.

Fixes #199

[lirantal]

Good catch! 👏

[lirantal]

@UlisesGascon do you know anything about flakiness of tests?
the signup tests fail here on this PR and also on master on changes that are unrelated it seems.

[UlisesGascon]

LGTM! 👍

[UlisesGascon]

Yeah @lirantal seems like there are some issues with the timeouts in the Cypress flow. I will re-run the test for now, but I will tweak the Cypress setup soon :)

[lirantal]

Cool, thanks!

[rcowsill]

Speaking of tests, I was considering adding one to verify that the A9 vulnerability is present.

It's basically the Should memo be generated (memos_spec.js) test, but using the XSS payload from the A9 tutorial. It checks that the expected link exists has the correct text/href. I tried it locally and it passes on [email protected] and fails on [email protected]. Would you like that adding to this pull request?

[lirantal]

@rcowsill yeah that would be a great idea. let me merge this one PR so we don't hold up on it and you can send a new one with the test.

[rcowsill]

Great! I'll look into adding the test sometime this weekend.