你好，组件依赖包webpack-dev-server存在漏洞

Happy-Coding-Clans / vue-easytable

A powerful data table based on vuejs. You can use it as data grid、Microsoft Excel or Google sheets. It supports virtual scroll、cell edit etc.

https://happy-coding-clans.github.io/vue-easytable/

MIT License

3.69k stars 738 forks source link

你好，组件依赖包webpack-dev-server存在漏洞 #254

Closed haishangfeie closed 5 years ago

haishangfeie commented 5 years ago

High Missing Origin Validation Package webpack-dev-server Patched in >=3.1.6

Dependency of vue-easytable

Path vue-easytable > webpack-dev-server

More info https://nodesecurity.io/advisories/725

ly525 commented 5 years ago

看了下 more info ，说的是 webpack-dev-server 的 websocket 数据来源没有经过验证，可能会引起源码被盗取。 easy-table 是开源代码，不存在代码被盗取这种情况，盗取了也没任何意义。感谢建议，我们近期会升级 webpack-dev-server 版本到 3.1.6 以上