search

jsreport / jsreport-core

The minimalist jsreport rendering core
GNU Lesser General Public License v3.0
85 stars 24 forks source link

Upgraded reap to solve security issue with reap's dependency ms #28

Closed kamesh95 closed 6 years ago

kamesh95 commented 6 years ago

Upgraded reap module to solve ReDoS vulnerability - https://nodesecurity.io/advisories/46 with ms package. The vulnerability in ms package was patched in versions > 7.0.0 but was not updated in it's dependent reap module. So this pull request solves that security issue with reap by upgrading it to reap2.

pofider commented 6 years ago

Please check the failing ci and change the reap => reap2 also in the code. Thank you.

bjrmatos commented 6 years ago

@kamesh95 hmm so far i don't see any dev or dependency listed in the package.json of reap2 is that intended? seems like this would fail in a fresh npm install (after the CI pass of course the reap => reap2 issue)

bjrmatos commented 6 years ago

@kamesh95 just in case, you can see the all the original source files (and the content of each file) of reap here

kamesh95 commented 6 years ago

@pofider Oh yes. @bjrmatos Sorry. I just forgot to include it's actual dependencies in the newly created package.json I will fix this

kamesh95 commented 6 years ago

@pofider @bjrmatos Fixed!

pofider commented 6 years ago

Thank you.