Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

This has a qs vuln #34

Open
zoobot opened this issue Mar 11, 2023 · 2 comments
Open

This has a qs vuln #34

zoobot opened this issue Mar 11, 2023 · 2 comments

Comments

@zoobot
Copy link

zoobot commented Mar 11, 2023

qs vulnerable to Prototype Pollution - GHSA-hrpp-h998-j3pp
fix available via npm audit fix
node_modules/webpack-config-utils/node_modules/qs

1 high severity vulnerability

Looks like no one is updating this package anymore?
Thanks

@Banner-Keith
Copy link

Where this has an MIT license it's reasonable to pull the parts of this package you need into your own internal libraries. Just be sure that if you redistribute you understand how that works.

I extracted the few parts I use.

function ifProduction(env, option1, option2?) {
    if (env.production) {
        return option1;
    }

    return option2;
}

function ifNotProduction(env, option1, option2?) {
    if (env.production) {
        return option2;
    }

    return option1;
}

function removeEmpty(input) {
    let output
    if (Array.isArray(input)) {
        output = input.filter(item => typeof item !== 'undefined')
    } else {
        output = {}
        Object.keys(input).forEach(key => {
            const value = input[key]
            if (typeof value !== 'undefined') {
                output[key] = value
            }
        })
    }
    return output
}

@zoobot
Copy link
Author

zoobot commented Mar 24, 2023

Thanks @Banner-Keith Good idea!! Don't fear the mystery of the library!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants