Replace vulnerable `squel` package
Open
Nobody has claimed this yet.
DevX
- Dominant language
- JavaScript
- Stars
- 24
- Forks
- 41
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 12
Description
language-mysql has a dependency on squel which is vulnerable to SQL injection. Unfortunately, squel has been shuttered as of 2021, so a patch is unlikely to be forthcoming. As a result, the only choice is to replace it - but I am not sure with what.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names the language-mysql adaptor and its squel dependency but no files or tests. Start by locating that adaptor's dependency declaration and squel usage, then review the linked security advisory and possible replacements. Done means squel is removed, the adaptor continues to work, and the SQL-injection vulnerability is addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, sql
- Domain
- databases, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100