Security Vulnerabilities
Open
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 5.8k
- Forks
- 704
- PR merge metrics
- No merged PRs in 30d
Description
System information
- node version: v14.17.5
- npm or yarn version: 6.14.14
- OS/version/architecture: Version 21H1(OS Build 19043.1165)
- Applicable nodegit version: 0.27.0
Problem description
Hi team,
I saw some dependencies used on node-git has security vulnerabilities or legal issues.
| Package | Affected versions | Patched versions | Overview |
|---|---|---|---|
| ini | < 1.3.6 | 1.3.6 | The ini npm package before version 1.3.6 has a Prototype Pollution vulnerability.If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context. |
| normalize-url | >= 4.3.0, < 4.5.1 | 4.5.1 | The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs. |
| tar | >= 4.0.0, < 4.4.15 | 4.4.15 | Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution |
| tar | >= 6.0.0, < 6.1.2 | 6.1.2 | |
| bl | < 1.2.3 | 1.2.3 | A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls. |
Can you update these dependencies?
References
https://github.com/advisories/GHSA-pp7h-53gx-mx7r
https://github.com/advisories/GHSA-r628-mhmh-qjhw
https://github.com/advisories/GHSA-qqgx-2p2h-9c37
https://github.com/advisories/GHSA-px4h-xg32-q955
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating nodegit's dependency manifests and checking the resolved versions of ini, normalize-url, tar, and bl. Update the dependency declarations or lockfile so each listed package reaches its patched version, then run the repository's available checks and confirm the vulnerabilities are no longer reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100