search

Roave / SecurityAdvisories

:closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily
MIT License
2.72k stars 106 forks source link

Unclear why laravel-filemanager is marked as insecure #89

Closed MaxKorlaar closed 2 years ago

MaxKorlaar commented 2 years ago

Hi,

I noticed that unisharp/laravel-filemanager has been added to the conflicts in the following commit: https://github.com/Roave/SecurityAdvisories/commit/5369c567667640bc617d0c6b1ba7c156128ccec5. The commit description links to a codeigniter security advisory, which doesn't seem relevant for this package. I've noticed the following issue on the filemanager's repository: https://github.com/UniSharp/laravel-filemanager/issues/1096, does it have anything to do with this?

Ocramius commented 2 years ago

Related: https://github.com/Roave/SecurityAdvisoriesBuilder/issues/451

As for the specific advisory, see https://github.com/advisories/GHSA-f8x6-m9f5-ffp8

MaxKorlaar commented 2 years ago

Thanks! I missed that one. Too bad it's not shown on https://github.com/UniSharp/laravel-filemanager/security/advisories, which is where I looked first.

Ocramius commented 2 years ago

The advisory at https://github.com/advisories/GHSA-f8x6-m9f5-ffp8 is not linked to the repo.

MaxKorlaar commented 2 years ago

Noticed, thanks again!

mfn commented 2 years ago

I too was surprised how @Ocramius even found that advisory 🤷‍♀️

Ocramius commented 2 years ago

Please read https://github.com/Roave/SecurityAdvisoriesBuilder/issues/451

This contains all the advisories at https://github.com/advisories, and composer.json is re-generated every hour.

mfn commented 2 years ago

Thank you 🙏🏼