HelloZeroNet / HelloZeroNet/ZeroNet
ReDoS in built-in file editor (UiFileManager) due to outdated codemirror lib
- Langage dominant
- JavaScript
- Étoiles
- 18.8k
- Forks
- 2.3k
- Métriques de merge des PR
- Aucune PR mergée en 30 j
Description
the fix is here: https://github.com/zeronet-conservancy/zeronet-conservancy/commit/d16c71966b119c3c456e0614e32615eb9fa0f008
test here: http://127.0.0.1:43110/list/1J5aZqN5rx9Nez74cbjPud9fPF6CZDkvZ/?file=test.js
upstream vulnerability link: https://security.snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937
why it happened: codemirror js library was copypasted into source tree instead of being fetched as third-party dependency, thus it wasn't updated when fix was issued
Guide de contribution
Aucun guide de contribution indexé pour ce dépôt
Piste de recherche
Start with the UiFileManager implementation and the copied CodeMirror library, then compare them with the fix in commit d16c71966b119c3c456e0614e32615eb9fa0f008. Use the provided local file-editor URL and the Snyk advisory to verify that the ReDoS vulnerability is addressed.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- javascript
- Domaine
- frontend, security
- Type d'issue
- Bug
- Difficulté
- 3/5
- Temps estimé
- 1-2 jours
- Activité
- À l'abandon
- Clarté
- Plutôt claire
- Accessibilité débutants
- 35/100