HelloZeroNet / HelloZeroNet/ZeroNet
ReDoS in built-in file editor (UiFileManager) due to outdated codemirror lib
Aperta
- Lingua principale
- JavaScript
- Stelle
- 18.8k
- Fork
- 2.3k
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
the fix is here: https://github.com/zeronet-conservancy/zeronet-conservancy/commit/d16c71966b119c3c456e0614e32615eb9fa0f008
test here: http://127.0.0.1:43110/list/1J5aZqN5rx9Nez74cbjPud9fPF6CZDkvZ/?file=test.js
upstream vulnerability link: https://security.snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937
why it happened: codemirror js library was copypasted into source tree instead of being fetched as third-party dependency, thus it wasn't updated when fix was issued
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Valutazione
Questa issue non è ancora stata valutata.