search

WebKit / Speedometer

An open source repository for the Speedometer benchmark
Other
592 stars 70 forks source link

CVE-2023-26159 in follow-redirects 1.15.2 #351

Closed issackjohn closed 7 months ago

issackjohn commented 7 months ago

Improper Input Validation - https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137

See: https://github.com/follow-redirects/follow-redirects/issues/235 for more details.

Upgrade follow-redirects to version 1.15.4 or higher.

issackjohn commented 7 months ago

I could take up this work. It appears that the source of the problem is http-proxy, which is a dependency of http-server, which is already updated to the latest version. Therefore, I suggest adding the appropriate version as a devDependency to update the package-lock.json file in all affected tests.

npm install follow-redirects@1.15.4 --save-dev

How does that sound? @camillobruni @flashdesignory

bgrins commented 7 months ago

Sounds good, thanks @issackjohn