High Advisory On npm audit
- Dominant language
- JavaScript
- Stars
- 7.2k
- Forks
- 621
- PR merge metrics
- No merged PRs in 30d
Description
### Details of Audit
On 17th August 2020, there was been a security issue that was raised with `url-regex`. Details are as follows:
```
High Regular Expression Denial of Service
Package url-regex
Patched in No patch available
Dependency of backstopjs [dev]
Path backstopjs > merge-img > jimp > url-regex
More info https://npmjs.com/advisories/1550
```
Unfortunately, backstopjs is last in the queue for updates as awaiting for the following to be completed:
https://github.com/oliver-moran/jimp/issues/926
https://github.com/preco21/merge-img/issues/15
## Replication Steps
Run npm audit
Notice the "high" severity vulnerability
Contributor guide
Research direction
Run npm audit and inspect the dependency path backstopjs > merge-img > jimp > url-regex. Read npm advisory 1550 and the linked jimp issue 926 and merge-img issue 15 to determine whether upstream changes are available. Done means the high-severity url-regex advisory is no longer reported for backstopjs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100