Vulnerability in transitive dependency underscore.string #5152

Activity

1. shockey

   added

   cat: security

   P1

   on Feb 5, 2019
2. shockey commented on Feb 7, 2019

   

   shockey

   on Feb 7, 2019

   Last edited by shockey

   Contributor

   More actions

   @nulltoken, as always thanks for filing an issue!

   I'm deprioritizing this based on upstream analysis (that I agree with) that this is not a realistic security concern:

   Unless you are planning on attacking yourself by entering a 100k string in the terminal while running the CLI, this is not even remotely a vulnerability or security concern for remarkable.

   This means that if you pass a long string (50k characters?), that might look like a date, to the remarkable cli, your experience might be degraded by about 2 seconds.

   jonschlinkert/remarkable#312 (comment)

   Further, for us: argparse is used in Remarkable's CLI, which is not used in Swagger UI at all. There's simply no way that this "vulnerability" could cause problems for us here.

   👍React with 👍2Reacted by Brian Woodward and Jose Tabares
3. shockey

   added

   P3

   type: housekeeping

   and removed

   P1

   on Feb 7, 2019
4. Racer159 commented on Aug 1, 2019

   

   Racer159

   on Aug 1, 2019

   Last edited by Racer159

   More actions

   Just FYI, but upstream remarkable closed their issue related to this as of 10 days ago. Not too big of a deal (given the low risk of this vuln), but just wanted to make sure y'all were aware so that hopefully NPM audit can finally be happy again.

   jonschlinkert/remarkable#310

   👍React with 👍1Reacted by kyle shockey
5. shockey commented on Aug 2, 2019

   

   shockey

   on Aug 2, 2019

   Contributor

   More actions

   Indeed @Racer159, this is resolved, we grabbed the new Remarkable version in #5509.

   Closing!

   🎉React with 🎉1Reacted by Wayne Starr
6. shockey

   closed this as completedon Aug 2, 2019