Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

apply backtrack protection to version 3.2.0 because of nestjs #317

Closed
danielehrhardt opened this issue Sep 10, 2024 · 6 comments
Closed

Comments

@danielehrhardt
Copy link

nestjs uses this package in version 3.2.0 could someone apply the patch: for this version.

29b96b4
nestjs/nest#13955

@Piet-verdriet
Copy link

Bump. Please can someone look into this.

I don't think upgrading to v8.0.0 or downgrading to v0.1.10 in NestJS is feasible. It could introduce breaking changes which could delay the vulnerability fix from being applied in NestJS. The best short-term solution imho is to patch v3.2.0 which would allow NestJS to get the fix sooner.

@blakeembrey
Copy link
Member

It's extremely unlikely you are affected, see GHSA-9wv6-86v2-598j for the attack vector. It's also a non-issue as an attack vector in a browser, you'd just be DoSing your own browser.

Unfortunately I've spent months on this already and I don't have the income to support myself continuing to work on every release. If you would like to sponsor work on old versions that might be a possibility.

@blakeembrey
Copy link
Member

I also just created a 3.x branch in case you'd like to open a PR to port the patch. You need to be aware that the 0.1.x patch was a breaking change for some users, it's not possible to do this patch without a breaking change.

@blakeembrey
Copy link
Member

blakeembrey commented Sep 10, 2024

I have published a 3.3.0 with backtracking protection, but please beware that some use-cases may be broken as a result or have changed what it matches partially (due to avoiding backtracking, e.g. /:a-:b with input /1-2-3 now matches 1-2 and 3, before 1 and 2-3). I suspect over 99% of usage won't change, but feel free to let me know if something looks off.

@pseudoralph
Copy link

@blakeembrey i'm curious, the CVE still lists the patched version as being >8 — although it's now been resolved in 3.3.0. How does/will this GHSA-9wv6-86v2-598j be updated to include v3.3.0 as a patched version to this vuln?

@blakeembrey
Copy link
Member

I honestly don't know, I updated it on my side but it's the first time I've tried to do this after an audit and there's no way to manually update the published advisory now.

From https://github.blog/changelog/2019-12-20-edit-github-security-advisories-after-publish/, it looks like I'm waiting for a GitHub review manually:

Edits of advisories in public repos are reviewed by GitHub. Upon review, we may use the updates to send security alerts to affected repositories and redistribute the advisory and its updates through GitHub Advisory Database, our API, and our Atom feed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants