renovate[bot] commented 3 years ago

This PR contains the following updates:

Package	Change
ini	`1.3.5` -> `1.3.6`

GitHub Vulnerability Alerts

CVE-2020-7788

Overview

The ini npm package before version 1.3.6 has a Prototype Pollution vulnerability.

If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Patches

This has been patched in 1.3.6.

Steps to reproduce

payload.ini

[__proto__]
polluted = "polluted"

poc.js:

var fs = require('fs')
var ini = require('ini')

var parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8'))
console.log(parsed)
console.log(parsed.__proto__)
console.log(polluted)

> node poc.js
{}
{ polluted: 'polluted' }
{ polluted: 'polluted' }
polluted

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

codecov[bot] commented 3 years ago

Codecov Report

Merging #291 (4f2d9ee) into master (e8a6d6f) will increase coverage by 0.01%. The diff coverage is n/a.

@@            Coverage Diff             @@
##           master     #291      +/-   ##
==========================================
+ Coverage   90.75%   90.76%   +0.01%     
==========================================
  Files         273      273              
  Lines       14789    14789              
  Branches     1794     1794              
==========================================
+ Hits        13421    13422       +1     
  Misses        862      862              
+ Partials      506      505       -1

Impacted Files	Coverage Δ
lib/vpt/flipper/flipper-hit.ts	`82.61% <0.00%> (+0.26%)`	:arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update e8a6d6f...4f2d9ee. Read the comment docs.

renovate[bot] commented 1 year ago

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

vpdb / vpx-js

chore(deps): update dependency ini to 1.3.6 [security] - abandoned #291