[GHSA-9c47-m6qq-7p4h] Prototype Pollution in JSON5 via Parse Method

[BGehrels]

Updates

• Affected products
• Description

Comments
The fix has been backported to the v1 branch:
json5/json5#298
https://github.com/json5/json5/releases/tag/v1.0.2

[github]

Hi there @jdgregson and @jordanbtucker! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our highly-trained Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[jordanbtucker]

Thanks for reporting this, but please close this as it is a duplicate of #1541

[BGehrels]

@jordanbtucker Sure.

@github What would be great, though, would be a way to see this in advance: The whole GHSA Website hides the underlying Github repo through it's proxy UI. So until you hit submit, You have no way to see that the form will result in

• A PR to be opened
• Against another Github Repo
• That you did not even know exists
• so you have no chance to search for duplicates in advance
• leading to unnecessary work on your side
• as well as wasted time on the reporters side

Which is a bit annoying, because there are way better ways to spend my time.

[jordanbtucker]

@BGehrels I understand your frustration, and the appropriate place to voice this is at https://github.com/community/community.

Can you please close this PR.

[kenkku]

@jordanbtucker Sure.

@github What would be great, though, would be a way to see this in advance: The whole GHSA Website hides the underlying Github repo through it's proxy UI. So until you hit submit, You have no way to see that the form will result in

• A PR to be opened
• Against another Github Repo
• That you did not even know exists
• so you have no chance to search for duplicates in advance
• leading to unnecessary work on your side
• as well as wasted time on the reporters side

Which is a bit annoying, because there are way better ways to spend my time.

The exact same thing happened to me. I guess it didn't do much harm, but at least I missed that I am making an immediate public contribution.. Now that I look at the form again, it actually does say in three places that it's creating a pull request. And we both still missed it. I'm not an expert, but it could be because the form is so big and complex that you tend to miss everything around it because you focus on what's in the form.