search

patorjk / figlet.js

A FIG Driver written in JavaScript which aims to fully implement the FIGfont spec.
MIT License
2.64k stars 170 forks source link

Examples directory of the repository is part of the NPM package #55

Closed jfcere closed 4 years ago

jfcere commented 4 years ago

Hi there,

Thanks for the library, ASCII art ftw 😄

That being said, my vulnerability check reported a problem with figlet because it found an old version of jQuery that has been flagged for security issues. I was surprised at first because I thought that the library has no dependency on jQuery but after inspecting the node_modules/figlet directory I noticed that the folder examples that contain jQuery is part of the NPM package.

Is there any plan to remove the examples folder from the distributed package?

image

patorjk commented 4 years ago

Thank you for the report on this. JQuery is only used for the front-end portion of the lib, and only for an Ajax call. However, now that fetch is widely supported that part can be refactored out (thus removing any need for jquery). I’ll try and take a look at this in the next day or two.

On Tue, Apr 21, 2020 at 4:27 PM Jean-Francois Cere notifications@github.com wrote:

Hi there,

Thanks for the library, ASCII art ftw 😄

That being said, my vulnerability check flagged a problem with figlet because it found an old version of jQuery that has been flagged for security issues. I was surprised at first because I thought that the library has no dependency on jQuery but after inspecting the node_modules/figlet directory that the folder examples that contain jQuery is part of the NPM package.

Is there any plan to remove the examples folder from the distributed package?

[image: image] https://user-images.githubusercontent.com/6987084/79910109-1705d480-83ec-11ea-9b7f-dd80f57dfaa5.png

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/patorjk/figlet.js/issues/55, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAD7ICHDPP2DM35OELEA7IDRNX6SXANCNFSM4MNS5EFA .

patorjk commented 4 years ago

Sorry, I was confused when I posted my first response (I was thinking of a little used font preloading function, but it doesn't cause jquery to be included). You were correct. I've refactored the example to not use jQuery so it's no longer included. Thanks for reporting this!

jfcere commented 4 years ago

@patorjk Thanks a lot, WhiteSource doesn't report the vulnerability anymore 👍