search

anacronw / multer-s3

multer storage engine for amazon s3
MIT License
662 stars 193 forks source link

The package uses a vulnerable version of file-type #186

Open Christian-Toney opened 2 years ago

Christian-Toney commented 2 years ago

185 could fix it, but will that break anything?

orangeiris commented 2 years ago

I'm having 2 moderate severity vulnerabilities because of this

kitman20022002 commented 2 years ago

Same here

jbinto commented 2 years ago

Upgrading file-type (e.g. through yarn resolutions) will not work, the API was changed to be async in 13.x, and since multer-s3 is heavily stream/callback based that's not a drop-in or trivial change.

That being said, I looked through the multer-s3 code. Default installations are not affected by the file-type vulnerability, unless your installation is opting into the AUTO_CONTENT_TYPE constant. That is the only place in the library where file-type is called.