search

GSA / smartpay-website

SmartPay website
https://federalist-ab31a10d-375d-4040-9324-1ae94e8a36b9.sites.pages.cloud.gov/site/gsa/smartpay-website/
3 stars 0 forks source link

Dependabot Alert: dset Prototype Pollution vulnerability #710

Open JennaySDavis opened 2 months ago

JennaySDavis commented 2 months ago

Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the objects in the program.

JennaySDavis commented 2 months ago

710 Acceptance Criteria

Pass/Fail Description
Pass Full Regression Testing

Comments/Additional Notes N/A

ADA Compliance (Automated scan via Chrome Lighthouse)

Criteria Score
Performance 97
Accessibility 100
Best Practices 100

Passed 09/20/2024 - JSD

johnbeallgsa commented 1 month ago

Thanks for the demo. Moving to Done.