search

brianreavis / sifter.js

A library for textually searching arrays and hashes of objects by property (or multiple properties). Designed specifically for autocomplete.
1.09k stars 125 forks source link

Possible MITM Vulnerability in node-csv dependency #43

Closed rliota closed 7 years ago

rliota commented 8 years ago

Hi - first off I'd like to thank you for this library. I noticed (just today) in checking out the latest patch version of selectize 0.12.2 that this project's node-csv dependency access protocol changed from https to git a while ago.

Is there a specific reason for the change to git: instead of the authenticated https protocol? I've read both https://github.com/brianreavis/sifter.js/issues/18 and https://github.com/brianreavis/sifter.js/pull/19 and I still don't understand why the protocol was changed.

Can it be changed back to https?

skeggse commented 8 years ago

Alternatively, one could use git+ssh://

sbabrass commented 8 years ago

Using git: also breaks the npm install command for me. Throws error Connection refused. Using git+ssh:// solves this issue for me. I am opening a pull request.

edit: So the npm install issue turned out to be a firewall issue on my network. I closed my pull request again because apparently Travis does not support adding ssh keys for public repos. So using git+ssh:// would break the Travis test.

http://stackoverflow.com/questions/27444891/how-to-add-ssh-key-in-travis-ci

brianreavis commented 7 years ago

Closed by https://github.com/brianreavis/sifter.js/pull/45