HelloZeroNet / HelloZeroNet/ZeroNet
ReDoS in built-in file editor (UiFileManager) due to outdated codemirror lib
Open
- Dominant language
- JavaScript
- Stars
- 18.8k
- Forks
- 2.3k
- PR merge metrics
- No merged PRs in 30d
Description
the fix is here: https://github.com/zeronet-conservancy/zeronet-conservancy/commit/d16c71966b119c3c456e0614e32615eb9fa0f008
test here: http://127.0.0.1:43110/list/1J5aZqN5rx9Nez74cbjPud9fPF6CZDkvZ/?file=test.js
upstream vulnerability link: https://security.snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937
why it happened: codemirror js library was copypasted into source tree instead of being fetched as third-party dependency, thus it wasn't updated when fix was issued
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.