Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prototype Pollution in JSON5 #295

Closed
jdgregson opened this issue Dec 16, 2022 · 11 comments
Closed

Prototype Pollution in JSON5 #295

jdgregson opened this issue Dec 16, 2022 · 11 comments
Assignees
@jordanbtucker
Labels
bug 🐛

Comments

@jdgregson
Copy link

There is a Prototype Pollution vulnerability in JSON5 before and including version 2.2.1. There is no security policy that I can find for this project, so I am unsure of where to report it. Should I just post the details here?
@jordanbtucker
Copy link
Member

Thanks for reporting this. Is the vulnerability in the source code or in a dependency?

@aseemk I don't have control over the json.org domain, but maybe we should set up an email address for reporting security vulnerabilities.

@jordanbtucker jordanbtucker self-assigned this Dec 16, 2022
@jdgregson
Copy link
Author

jdgregson commented Dec 16, 2022 •
edited

The vulnerability is in the source code of the JSON5 library, specifically in the JSON5.parse method. I've found it to be exploitable in Node as well as in the browser.

@jordanbtucker
Copy link
Member

Thanks. Please send me the details at jordanbtucker@gmail.com, and I'll take a look.

@jdgregson
Copy link
Author

Got it, email sent.

@HolgerJeromin
Copy link

ref https://github.com/json5/json5/releases/tag/v2.2.2

@github-actions github-actions bot mentioned this issue Dec 26, 2022
Closed
@mxro mxro mentioned this issue Jan 1, 2023
Merged
@jancama2
Copy link

jancama2 commented Jan 2, 2023

@jordanbtucker not sure how to handle this, but the issue is fixed not only in 2.2.2 but in 1.0.2 (https://github.com/json5/json5/releases/tag/v1.0.2) too, right? But audit says the only way to fix it is to upgrade to 2.2.2 and higher. Can we do something about it? Don't want to add resolutions to higher major just for a sake of satisfying audit.

@ckalpakoglu ckalpakoglu mentioned this issue Jan 2, 2023
Open
@jordanbtucker
Copy link
Member

@jancama2 Yes, I created a pull request to have GitHub update the security advisory, but it hasn't been merged yet, probably due to the holidays.

ayinloya added a commit to smileidentity/smile-identity-core-js that referenced this issue Jan 4, 2023
@ayinloya
Upgrade json5 json5/json5#295
2833e8b
@TheKingTermux TheKingTermux mentioned this issue Jan 5, 2023
Closed
4 tasks
ayinloya added a commit to smileidentity/smile-identity-core-js that referenced this issue Jan 5, 2023
@ayinloya @mldangelo
Add typescript (#58)
ad6ef3d 
* Add typescript

* Add typescript config

* Convert src/constants.js to typescript

* Convert src/helpers to typescript

* Convert src/signature to ts

* Add shared.ts for shared types

* convert utilities to ts

* Convert web-token to s

* Convert id-api to ts

* Convert web-api to ts

* Convert index.js to ts

* Resolve id spread issue in webapi

* Add typescript support for jest
Change tests to typescript

* Remove es exports, defer to typescript export

* Chnange require to import
Fix test: object check error

* Add typescript lint support
Use es2021 in typescript config
Change tests to typescript

* Move examples into single folder
Fix lint issue
Update eslint config
Build js files in ci before test and deployment
Install example dependency before lint

* Fix failing test
Remove example package install from ci

* Fix types

* Change biometric kyc example to ts

* Fix lint

* change document verfication example to ts

* Fix lint

* Change enhasned kyc to typescript

* Change smart selfie example to typescript

* Update package.json

Co-authored-by: Michael <michael.l.dangelo@gmail.com>

* Fix helpers test

* remove npm build from workflow

* Export interface inline

* Add babel cli

* Compile js in prepublish using babel
Build declaration in prepublish
Add tsc check in lint
Remove comments from tsconfigs

* Change console error to warn, since execution will still continue

* Add tsconfig to generate single d.ts file for all declarations
Add js and type generation in prepublish

* Fix index path in package.json

* Add contributors field in package.json

* Use require for server.js

* Upgrade json5 json5/json5#295

* Add source map to config

* restrict sidServerMapping keys to number

Co-authored-by: Michael <michael.l.dangelo@gmail.com>
@jdmarshall jdmarshall mentioned this issue Jan 6, 2023
Merged
@jdmarshall
Copy link

@jdgregson Have you retested this vulnerability? I have some doubts about the implementation.

@jordanbtucker
Copy link
Member

jordanbtucker commented Jan 6, 2023 •
edited

Have you retested this vulnerability? I have some doubts about the implementation.

See #296 (comment)

@debricked debricked bot mentioned this issue Jan 10, 2023
Merged
@tstahn tstahn mentioned this issue Jan 10, 2023
Closed
@LodewijkIVX
Copy link

what does JSON looks like?

@jordanbtucker
Copy link
Member

@LodewijkIVX Are you asking what the JSON implementation looks like for parsing?

@jovancacvetkovic jovancacvetkovic mentioned this issue Jan 23, 2023
Closed
@diegopf diegopf mentioned this issue Jan 31, 2023
Merged
This was referenced Feb 17, 2023
Open
Open
@github-actions github-actions bot mentioned this issue Apr 4, 2023
Open
@yangricardo yangricardo mentioned this issue Apr 5, 2023
Closed
@github-actions github-actions bot mentioned this issue Apr 14, 2023
Merged
@ashleyfrieze ashleyfrieze mentioned this issue Apr 27, 2023
Closed
@debricked debricked bot mentioned this issue Jul 3, 2023
Open
@debricked debricked bot mentioned this issue Sep 13, 2023
Open
@sync-by-unito sync-by-unito bot mentioned this issue Jan 31, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jordanbtucker jordanbtucker

Labels
bug 🐛
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@jordanbtucker @jdmarshall @HolgerJeromin @jancama2 @jdgregson @LodewijkIVX