ZeroNet
ZeroNet copied to clipboard
ReDoS in built-in file editor (UiFileManager) due to outdated codemirror lib
the fix is here: https://github.com/zeronet-conservancy/zeronet-conservancy/commit/d16c71966b119c3c456e0614e32615eb9fa0f008 test here: http://127.0.0.1:43110/list/1J5aZqN5rx9Nez74cbjPud9fPF6CZDkvZ/?file=test.js upstream vulnerability link: https://security.snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937 why it happened: codemirror js library was copypasted into source tree instead of being fetched as third-party dependency, thus it wasn't updated when fix was issued