search

appleple / react-modal-video

Accessible React Modal Video Component
https://appleple.github.io/react-modal-video/
MIT License
177 stars 86 forks source link

Fix - Remove Outdated stringify Package Due to Security Vulnerability #97

Open FabioDiCeglie opened 3 months ago

FabioDiCeglie commented 3 months ago

Description: The stringify package in our repository is outdated, not utilized, and poses a potential security risk due to an identified vulnerability. Specifically, the package is no longer in use and contains a known vulnerability, the "kangax html-minifier REDoS vulnerability". This vulnerability, discovered in kangax html-minifier 4.0.0, exposes our system to Regular Expression Denial of Service (ReDoS) attacks via the candidate variable in htmlminifier.js.

Considering that the package serves no active purpose in our codebase and presents a security concern, it's imperative to remove it from the repository to mitigate any potential risks.

Action Plan:

  1. Removal of the stringify Package:
    • We propose removing the stringify package from this repository entirely.
    • This action will not impact any existing functionality as the package is not in use.
FabioDiCeglie commented 3 months ago

98

Rayanikhenache commented 3 months ago

It's such a shame to have this error for dead code. I had to spend time going back and analyzing the issue to understand.

Removing the dependency as soon as possible would save human time.

FabioDiCeglie commented 3 months ago

@1000-x-t30 you gonna release this?

1000-x-t30 commented 3 months ago

@FabioDiCeglie sorry. Released today!