Closed gjasny closed 3 years ago
Thanks for the report, I have some comments though:
hoek
has been deprecated for a very long time now, there's a warning you can't really miss on npm (https://www.npmjs.com/package/hoek)object.isAdmin
, which is not the case in hoek
nor in @hapi/hoek
Thank you for your comment. I'm a C++ developer, not a JavaScript one. I mostly interact with the JS world by triaging our internal static code analysis reports. Do I understand correctly that there is no vulnerability and you don't have to take any action?
Correct. Their report is a gross misunderstanding of how JS works, I'm not saying hoek is free of prototype pollution, but if that's the case we have no knowledge of that.
Closing as not an issue. Thanks for the report though.
Hello,
are you aware of the prototype pollution of
lib/merge.js
reported in 418sec/huntr#647? Could you please provide a fixed version?Thanks, Gregor