search

JetBrains / svg-sprite-loader

Webpack loader for creating SVG sprites.
MIT License
2.01k stars 272 forks source link

Regular Expression Denial of Service in postcss (6.0.11) #490

Open Shramkoweb opened 2 years ago

Shramkoweb commented 2 years ago

Do you want to request a feature, report a bug or ask a question? Security issue.

What is the current behavior?

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /\s sourceMappingURL=(.*).

svg-sprite-loader@6.0.11 requires postcss@^5.2.17 via svg-baker@1.7.0

Please tell us about your environment:

NickWoodward commented 1 year ago

Did you find a decent fix for this? In the past I managed to override postcss used, but I'm now getting 

npm ERR! code EOVERRIDE
npm ERR! Override for postcss@^8.4.16 conflicts with direct dependency
Shramkoweb commented 1 year ago

Did you find a decent fix for this? In the past I managed to override postcss used, but I'm now getting

npm ERR! code EOVERRIDE
npm ERR! Override for postcss@^8.4.16 conflicts with direct dependency

No. Unfortunately, I am waiting for a fix.