search

ToothlessGear / node-gcm

A NodeJS wrapper library port to send data to Android devices via Google Cloud Messaging
https://github.com/ToothlessGear/node-gcm
Other
1.3k stars 208 forks source link

fix: avoid possible prototype override protection bypass #291

Closed arealmaas closed 7 years ago

arealmaas commented 7 years ago

The library qs has vulnerabilities at version 6.3.1 qs is a dependency in this project through request I believe. request version ~2.81 has an updated version of qs (~6.4) without the vulnerability.

https://snyk.io/vuln/npm:qs:20170213

eladnava commented 7 years ago

@hypesystem What do you think? I don't see any downside to this PR as long as all tests pass.

hypesystem commented 7 years ago

Yes! Can you check if the tests pass? If they do, let's get this out as 0.14.5 :-)

eladnava commented 7 years ago

@hypesystem Looks like we accidentally introduced a commit that broke tests: https://github.com/ToothlessGear/node-gcm/commit/41005018a86da3b656d433527e2a6770cd5965ee

The tests pass in {} as the message object which does not contain the message.params object.

I'll create a PR to fix this ASAP, and then I'll see if this breaks any tests as well.

hypesystem commented 7 years ago

Haha oh dear. Great! Good that we got an excuse to fix that 😛

eladnava commented 7 years ago

This PR does not break any tests, @hypesystem can we merge?

hypesystem commented 7 years ago

Woo!

Alright @eladnava do you wanna publish a new release?

eladnava commented 7 years ago

Sure, after we deal with #292. 👍