JKHeadley / JKHeadley/rest-hapi

Security vulnerability in rest-hapi > loggin > glob > minimatch, modules needs updating

Open
#145 1 comment 4 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
1.2k
Forks
155
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
There is a module that needs updating in order to patch a vulnerability

**Additional context**
```
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ minimatch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=3.0.2 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ rest-hapi │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ rest-hapi > loggin > glob > minimatch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/118 │
└───────────────┴──────────────────────────────────────────────────────────────┘
```

Additionally I would recommend setting up https://snyk.io/ or similar to automatically get PRs with fixes for such vulns.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the rest-hapi > loggin > glob > minimatch dependency path in the project’s dependency manifest. Update minimatch to a patched version (>=3.0.2) and verify that the vulnerable dependency is no longer present; consider the linked Snyk recommendation for automated vulnerability fixes.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
backend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.