Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

A security patch to issue #127 #140

Closed
wants to merge 4 commits into from

Conversation

winterrdog
Copy link

What is this PR all about?

This is a security patch to fix the issue #127 which identified a web application vulnerability( cross-site request forgery or XSRF ) on the server-side which can be dangerous to user data since it can be leveraged by attacker to gain access elsewhere in the system.

Why all the fuss?

The biggest reason is avoid the use of 2 outdated and/or vulnerable packages whereby one( request ) no longer receives maintenance and updates while axios wasn't just updated via the package.json.
Thus I added this patch to address the web vulnerabilities( Server-Side Request Forgery in Request and Prototype Pollution vulnerability ) introduced by the tough-cookie library relied on by the now deprecated, request, library and the outdated axios library version(Axios Cross-Site Request Forgery Vulnerability). I essentially updated the deprecated libraries and aligned the code to use the new packages.

How did you do that?

I refactored and converted all the code that depended on request library and replaced it with code that uses the latest axios package. In the process, I allowed for backward compatibility to request library to avoid breaking other code that expected function return types similar to that of request library for example using aliases for properties

But, did you test your code?

Yes, I did.
All the tests passed successfully!

@winterrdog winterrdog closed this Jan 5, 2024
@winterrdog winterrdog deleted the fix-issue-#127 branch January 5, 2024 09:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant