-
-
Notifications
You must be signed in to change notification settings - Fork 4.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
"Regular Expression Denial of Service" security issues on dependencies #4266
Comments
@c3s4r am I correct in saying that it looks like all the potential issues you've found are in dependent projects, rather than parse-server itself? |
@montymxb yes, that's right. Anyways, since
The I would also recommend to add |
@c3s4r thanks for the recommendation! We're looking into adding this (or an equivalent like snyk) into the flow as part of our CI. This will stay open until we've settled on a solution. |
Closing as #4285 has been merged in to resolve this. Thanks again! |
Issue Description
Running
nsp check
using parse-server2.6.3
launches "Regular Expression Denial of Service" security warnings.Steps to reproduce
Create a new express application with the
parse-server
dependencyAdd
nsp
dependencyRun
nsp check
Expected Results
Not to show any security warning.
Actual Outcome
The following warnings are displayed:
Regular Expression Denial of Service
@0.0.1 > parse-server@2.6.3 > mime@1.4.0
https://nodesecurity.io/advisories/535
Regular Expression Denial of Service
@0.0.1 > parse-server@2.6.3 > express@4.15.3 > send@0.15.3 > mime@1.3.4
https://nodesecurity.io/advisories/535
Regular Expression Denial of Service
@0.0.1 > parse-server@2.6.3 > express@4.15.3 > fresh@0.5.0
https://nodesecurity.io/advisories/526
Regular Expression Denial of Service
@0.0.1 > parse-server@2.6.3 > express@4.15.3 > debug@2.6.7
https://nodesecurity.io/advisories/534
Regular Expression Denial of Service
@0.0.1 > parse-server@2.6.3 > parse-server-simple-mailgun-adapter@1.0.0 > mailgun-js@0.7.15 > debug@2.2.0
https://nodesecurity.io/advisories/534
Environment Setup
Server
Database
Logs/Trace
See above in the actual outcome.
The text was updated successfully, but these errors were encountered: