halacious
halacious copied to clipboard
bleupen
Transitive dependency uglify.js is vulnerable is Regular Expression Injection
Halacious 3.4.0 (latest available version) depends on swig in version 1.4.2 (latest available version, but no longer maintained) which depends on uglify-js in version ~2.4.0
Versions of uglify < 2.6.0 are vulnerable to Regular Expression Denial of Service.
Below the result of nsp check
> nsp check
(+) 1 vulnerabilities found
┌───────────────┬───────────────────────────────────────────────────────┐
│ │ Regular Expression Denial of Service │
├───────────────┼───────────────────────────────────────────────────────┤
│ Name │ uglify-js │
├───────────────┼───────────────────────────────────────────────────────┤
│ Installed │ 2.4.24 │
├───────────────┼───────────────────────────────────────────────────────┤
│ Vulnerable │ <2.6.0 │
├───────────────┼───────────────────────────────────────────────────────┤
│ Patched │ >=2.6.0 │
├───────────────┼───────────────────────────────────────────────────────┤
│ Path │ swig > uglify-js │
├───────────────┼───────────────────────────────────────────────────────┤
│ More Info │ https://nodesecurity.io/advisories/48 │
└───────────────┴───────────────────────────────────────────────────────┘
@bleupen Hey! Have you devised any plan regarding this? Thanks in advance for your feedback!
Hello, I plan to take a look in the morning once I'm back at my desk.
Sent from my iPhone
On Nov 29, 2015, at 7:06 PM, Em. [email protected] wrote:
@bleupen Hey! Have you devised any plan regarding this? Thanks in advance for your feedback!
— Reply to this email directly or view it on GitHub.
That’s too bad about swig. Sounds like switching to nunjucks might be the way to go. What do you think?
On Nov 29, 2015, at 7:06 PM, Em. [email protected] wrote:
@bleupen https://github.com/bleupen Hey! Have you devised any plan regarding this? Thanks in advance for your feedback!
— Reply to this email directly or view it on GitHub https://github.com/bleupen/halacious/issues/79#issuecomment-160484440.
Unfortunately, I do not know nunjucks.
/cc @yoshylord @sroccaserra-octo Thoughts?