HelloZeroNet / HelloZeroNet/ZeroNet
ReDoS in built-in file editor (UiFileManager) due to outdated codemirror lib
- Dominant language
- JavaScript
- Stars
- 18.8k
- Forks
- 2.3k
- PR merge metrics
- No merged PRs in 30d
Description
the fix is here: https://github.com/zeronet-conservancy/zeronet-conservancy/commit/d16c71966b119c3c456e0614e32615eb9fa0f008
test here: http://127.0.0.1:43110/list/1J5aZqN5rx9Nez74cbjPud9fPF6CZDkvZ/?file=test.js
upstream vulnerability link: https://security.snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937
why it happened: codemirror js library was copypasted into source tree instead of being fetched as third-party dependency, thus it wasn't updated when fix was issued
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the UiFileManager implementation and the copied CodeMirror library, then compare them with the fix in commit d16c71966b119c3c456e0614e32615eb9fa0f008. Use the provided local file-editor URL and the Snyk advisory to verify that the ReDoS vulnerability is addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100