Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix docsify vulnerability #87

Merged

Conversation

alexandre-lelain
Copy link
Contributor

Hello,

First of all, thank you for making this awesome library. I'm using it on a project and it really rocks.

The problem

There was a vulnerability spotted in one of docsify's dependency: marked.

WS-2019-0024
More information
moderate severity
Vulnerable versions: >= 0.5.0, < 0.6.1
Patched version: 0.6.1

A flaw was found in nodejs-marked versions from 0.5.0 to before 0.6.1. 
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS).
Input to the host variable is vulnerable when input contains parenthesis in link URIs, coupled with a high number of link tokens in a single line.

It was fixed in [email protected]: docsifyjs/docsify#934.

What this PR does

This PR bumps the version of docsify (previously >=3) to the version ^4.10.2 to fix the vulnerabilities audited in the project by npm.

The snapshots tests were updated accordingly.

@alexandre-lelain alexandre-lelain force-pushed the fix/docsify_vulnerability branch from 1d87de6 to 69a85cc Compare January 8, 2020 16:25
Copy link
Member

@anikethsaha anikethsaha left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎉

@anikethsaha anikethsaha merged commit ed6acdc into docsifyjs:master Jan 8, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants