mean-expert-official / loopback-sdk-builder

Tool for auto-generating Software Development Kits (SDKs) for LoopBack
Other
399 stars 178 forks source link

Upgrade ejs to fix security vulnerabilities #584

Closed djabif closed 6 years ago

djabif commented 6 years ago

ejs 1.0.0 has known security vulnerabilities and should be updated to at least 2.5.5

What type of pull request are you creating?

How many unit test did you write for this pull request?

none

Write a reason if none (e.g just fixed a typo):

Please add a description for your pull request:

ejs 1.0.0 has known security vulnerabilities and should be updated to at least 2.5.5 See:

jonathan-casarrubias commented 6 years ago

@djabif I sent an answer for this in Twitter, but I'll answer in here as well,

In order to accept this patch we need to make sure that the ejs filters used in the builder are migrated.

https://github.com/mean-expert-official/loopback-sdk-builder/blob/master/lib/angular2/index.js#L20

Since those filters are deprecated in newer versions of EJS.

If you are able to fix that, I'll be glad to accept this patch

Cheers Jon