search

aliyun / alibaba-cloud-sdk-go

Alibaba Cloud SDK for Go
Apache License 2.0
1.16k stars 271 forks source link

Updated gopkg.in/ini.v1 to fix MomentJS Vulnerability #547

Closed micah-dumont-tm closed 2 years ago

micah-dumont-tm commented 2 years ago

The Security Issue: The gopkg.in/ini.v1 package imports goconvey, an old testing library that imports MomentJS 2.11.2. This library contains a vulnerability as outlined below by an X-Ray Scan: The duration function in the moment package before 2.11.2 for node.js allows remote attackers to cause a denial of service (cpu consumption) via a long string, aka a "regular expression denial of service (redos). This causes anyone using the alibaba-cloud-sdk-go api in Go to receive high level security vulnerability warnings.

The Fix: This vulnerability can be avoided by updating that gopkg dependency to the latest version, which will cause it to use testify, rather than goconvey for its testing.

CLAassistant commented 2 years ago

CLA assistant check
All committers have signed the CLA.

JacksonTian commented 2 years ago

@micah-dumont-tm thanks for your contribution.