New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 5 vulnerabilities #54

Open

snyk-bot wants to merge 1 commit into master from snyk-fix-65cee6dbecf23168a6d8e7cac6f3384e

snyk-bot commented Mar 17, 2020

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Issue	Breaking Change	Exploit Maturity
	Arbitrary File Write via Archive Extraction (Zip Slip) npm:adm-zip:20180415	No	Mature
	Code Injection npm:dustjs-linkedin:20160819	No	No Known Exploit
	Cross-site Scripting (XSS) npm:marked:20150520	No	No Known Exploit
	Cross-site Scripting (XSS) npm:marked:20170112	No	No Known Exploit
	Prototype Override Protection Bypass npm:qs:20170213	No	No Known Exploit

Commit messages

Package name: adm-zip

The new version differs by 50 commits.

80d259f Version bump
3f00a03 Fixed [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#176
650e752 Fixed wrong date on files (issue [Snyk-dev Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#203)
d01fa8c Fixed bugs introduced with 0.4.9
c0cc85d Merge pull request [Snyk Update] New fixes for 2 vulnerable dependency paths snyk-labs/nodejs-goof#219 from jontore/master
39c83a2 Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#209 from poshta1900/fix
b94c5dd Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#227 from hhaidar/master
c95c553 Merge pull request [Snyk Update] New fixes for 16 vulnerable dependency paths snyk-labs/nodejs-goof#228 from jmcollin78/patch-1
cda668c Fix issue [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#218
0f2cb41 Fix octal literals so they work in strict mode
888931d To support strict mode use 0o prefix to octal numbers
89b6f67 Update package.json
9592298 Update README.md
ce59e5a Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#215 from grnd/master
38cb4a4 fix: resolve both target and entry path
18c3d31 Update package.json
666adec Update package.json
499d59b Update package.json
62f6400 Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#212 from aviadatsnyk/master
6f4dfeb fix: prevent extracting archived files outside of target path
ef0abe6 add try-catch around fs.writeSync
e116bc1 Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#208 from pmuens/patch-1
12d2099 Fix data accessing example in README
032566b Merge pull request [Snyk-dev Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#204 from BridgeAR/master

See the full diff

Package name: body-parser

The new version differs by 221 commits.

0f1bed0 1.17.1
0532096 lint: remove unreachable code branches
b34aab5 build: [email protected]
77b1ca1 build: [email protected]
e51dbc5 deps: [email protected]
79bc939 1.17.0
e6140e1 build: [email protected]
42f467d deps: [email protected]
4954aec build: test against Node.js 8.x nightly
e2050df build: [email protected]
2f941c4 build: [email protected]
6549617 build: [email protected]
d1c2c7f deps: http-errors@~1.6.1
e7b86ba build: [email protected]
7b630f7 1.16.1
de574bf build: [email protected]
889bcc9 build: [email protected]
dba8ac4 deps: [email protected]
95a3ebb docs: fix history file with incorrect qs version
c5a73d5 1.16.0
9744dda deps: [email protected]
7807757 deps: [email protected]
0e44768 lint: use standard style in the README
14952be build: [email protected]

See the full diff

Package name: express

The new version differs by 231 commits.

d43b074 4.15.2
05fd1e4 deps: update example dependencies
85c96fd deps: [email protected]
d32ed68 4.15.1
57d3dfd examples: merge the jade example into ejs
eece385 tests: use path.join instead of concatenation
8eb95ae examples: use path.join instead of concatenation
67168fe deps: [email protected]
c0089d9 deps: [email protected]
dc8acc8 tests: use supertest expect for simple assertions
7027b37 lint: remove unused err argument
b4550fb Use ejs instead of jade within engine jsdoc
4012846 examples: use static assets in search example
6d9b127 build: [email protected]
504a51c 4.15.0
7f96896 deps: update example dependencies
f59de6a build: [email protected]
7247554 build: [email protected]
146a13e build: [email protected]
9722202 Add next("router") to exit from router
51f5290 Fix case where router.use skipped requests routes did not
8b6dc6c Use "%o" in path debug to tell types apart
081b811 perf: add fast match path for "*" route
1f71fae tests: add lone "*" route tests

See the full diff

Package name: marked

The new version differs by 13 commits.

2a92083 Release 0.3.7
753a7bd 0.3.7
635e45c Merge pull request feat: add open redirect and xss vulns in code snyk-labs/nodejs-goof#960 from chjj/github-templates
d24427e Add issue template
8f9d0b7 Merge pull request [Snyk-dev] Security upgrade npmconf from 0.0.24 to 1.0.1 snyk-labs/nodejs-goof#844 from chjj/data_link_fix
cd2f6f5 added data: link fix to prevent xss
38f1727 Merge pull request [Snyk-local] Fix for 3 vulnerabilities snyk-labs/nodejs-goof#728 from nehero/patch-1
eddec20 v0.3.6
fd0d1a2 Merge pull request [Snyk] Fix for 3 vulnerable dependencies snyk-labs/nodejs-goof#592 from matt-/xss_html_entities
0fa05b6 Merge pull request [Snyk] Fix for 44 vulnerabilities #1 from rsp/fix/xss_html_entities_semicolon
31c7799 add optional semicolon in html entities regex
6470e8b Update readme example to reflect defaults
2cff859 added explicit matching for HTML entities to prevent XSS

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:

🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


          fix: package.json & package-lock.json to reduce vulnerabilities

ab5b18e

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/npm:adm-zip:20180415
- https://snyk.io/vuln/npm:dustjs-linkedin:20160819
- https://snyk.io/vuln/npm:marked:20150520
- https://snyk.io/vuln/npm:marked:20170112
- https://snyk.io/vuln/npm:qs:20170213

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet