search

garycourt / uri-js

An RFC 3986 compliant, scheme extendable URI parsing/validating/normalizing/resolving library for JavaScript
Other
305 stars 69 forks source link

Possible vulnerability #59

Closed pavoltravnik closed 3 years ago

pavoltravnik commented 3 years ago

https://nvd.nist.gov/vuln/detail/CVE-2020-7788

https://github.com/garycourt/uri-js/blob/master/yarn.lock#L1078

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

pavoltravnik commented 3 years ago

fixed ready to merge - please merge https://github.com/garycourt/uri-js/pull/56

garycourt commented 3 years ago

Done. Thanks!