Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(NOJIRA-123): update node to v20 for standards adoption #62

Closed
wants to merge 531 commits into from

Conversation

siminino
Copy link

No description provided.

luin and others added 21 commits May 13, 2024 10:24
Co-authored-by: Zihua Li <635902+luin@users.noreply.github.com>
Co-authored-by: Zihua Li <635902+luin@users.noreply.github.com>
Co-authored-by: Zihua Li <635902+luin@users.noreply.github.com>
Co-authored-by: Zihua Li <635902+luin@users.noreply.github.com>
Co-authored-by: Zihua Li <635902+luin@users.noreply.github.com>
@siminino siminino requested a review from a team as a code owner February 20, 2025 15:47
@tf-security
Copy link

tf-security commented Feb 20, 2025

Snyk checks have failed. 1 issues have been found so far.

Icon Severity Issues
Critical 0
High 1
Medium 0
Low 0

⚠️ security/snyk check encountered an error. (View Details)

⚠️ license/snyk check encountered an error. (View Details)

code/snyk check is complete. 1 issues have been found. (View Details)

@siminino siminino force-pushed the NOJIRA-123/update-node-20 branch from 2bceb2b to ebe16ca Compare February 20, 2025 16:34
const bindings = (this.bindings[evt.key] || []).concat(
this.bindings[evt.which] || [],
);
const matches = bindings.filter(binding => Keyboard.match(evt, binding));
const matches = bindings.filter((binding) =>
Keyboard.match(evt, binding),

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  Regular Expression Denial of Service (ReDoS)

Unsanitized user input from an event flows into match, where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack (reDOS).

Line 187 | CWE-400 | Priority score 760 | Learn more about this vulnerability
Data flow: 4 steps

Step 1 - 2

return binding.key === evt.key || binding.key === evt.which;

Step 3 - 4

Keyboard.match(evt, binding),

@siminino siminino closed this Feb 20, 2025
@siminino siminino deleted the NOJIRA-123/update-node-20 branch February 20, 2025 16:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.