search

d-rec / drec-origin

D-REC Origin
https://d-rec.github.io/drec-origin/
GNU General Public License v3.0
8 stars 1 forks source link

Fix Required: xml2js is vulnerable to prototype pollution #145 #335

Open Aish1990 opened 5 months ago

Aish1990 commented 5 months ago

There are some libraries which has xml2js as it's peer dependency.

aws-sdk/2.1648.0 => xml2js: 0.6.2
@energyweb/origin-backend-utils/1.6.2-alpha.1634225870.0_ebqzonq2psrptj7354jhe34g5u => typeorm/0.2.34 => xml2js: 0.4.23
@energyweb/origin-backend/11.0.2-alpha.1634225870.0_swagger-ui-express@4.1.6 => typeorm/0.2.34 => xml2js: 0.4.23
@nestjs/typeorm/7.1.5_o4hmypqkokzsiznu3rz22eicba => typeorm/0.2.34 => xml2js: 0.4.23
@energyweb/issuer-api/0.6.2-alpha.1646058469.0_xopg3sgvptdwdhuxuxidphnbby => typeorm/0.2.41_pg@8.7.1 => xml2js: 0.4.23

[!NOTE] We have already upgraded the xml2js greater than the patched version >=0.5.0. But above @energyweb and @nestjs libraries are incompatible with the patched version.

So We need to resolve it only when the @energyweb and @nestjs releases which is compatible with xml2js>0.5.0.