restify / restify/node-restify
Security issue with v8.6.1
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.7k
- Forks
- 975
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 5
Description
Snyk flagged this as a security vulnerability:
restify@8.6.1 › bunyan@1.8.14 › moment@2.29.1
restify-plugins@1.6.0 › bunyan@1.8.14 › moment@2.29.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
https://cwe.mitre.org/data/definitions/22.html
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24785
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the dependency chain for restify@8.6.1 and restify-plugins@1.6.0 through bunyan to moment@2.29.1. Inspect the project’s dependency declarations and verify that the resolved Moment version is patched at 2.29.2 or later, then confirm the security warning is gone.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100