New fork resolving vulnerabilities and incorporating most current PRs
See original GitHub issueHi,
As issues had not received feedback here and the latest commit 3 years ago, I went ahead to make a fork and publish it as @brettz9/node-static.
Besides making a few of my own changes:
- (Breaking change) npm: Set
engines
to 10.11.0+ (allowing native URL to fix an issue and better flexibility in language features) - Security Update/fix: Use
URL
constructor over deprecatedurl.parse
; should fix Open Redirect issue https://www.npmjs.com/advisories/1207 - Optimization: ‘use strict’ directive
- Refactoring: Use safer non-prototype version of
colors
- (Also some plain, dev-facing changes; see our
CHANGES.md
)
…the fork also incorporates the following, indicating also the PR numbers here that they close:
User-facing
- Security: Fix dependency vulnerabilities by switching from
optimist
toneodoc
(@fidian); #222 - Security update:
mime
andcolors
(@fidian); #222 - Security update/fix: Protect
fs.stat
calls from bad path arguments; fixes Denial of Service issue https://www.npmjs.com/advisories/1208 (@brpvieira); #223; also avoids need for #213 - Fix: Support
bytes=0-0
Range header (@prajwalkman); #167 - Fix: Avoid octal (@bgao / @Ilrilan); #187, #215 ; also avoids need for #155
- Fix: For
spa
, allow dots after path (@gjuchault); #204 - Enhancement: Allow access with local ip (@flyingsky); #140
- Enhancement: Allow
serverInfo
to benull
(@martindale); #150 - Enhancement: Time display logging with leading 0 (@mauris); #154
- Enhancement: Respect static
--cache 0
(@matthew-andrews); #138 - Enhancement: New option:
defaultExtension
(@fmalk); #173 - Enhancement: Added glob matching for setting cache headers (@lightswitch05); #183
- Docs: Fix header example (@emmanouil); #156
- Docs: Sp. (@EdwardBetts); #194
Dev-facing
I also made some updates/improvements to the PRs:
- Expanded the
fs.stat
checking, adding one beyond that covered in the originalfs.stat
PR (#223), and covering the newly-added one in thedefaultExtension
PR (#173). - Updated
minimatch
(#183) - I avoided the Travis addition, as figured might use GitHub Actions if someone wants to do so.
These remaining prexisting PRs were not fully incorporated:
- #189 - the PR for #138 allowed for disabling of cache already; if you still want the
f
andfalse
aliases, feel free to file an issue - #184 - Looked like there were concerns
- #177 on README improvements; I figure some would be good, but would like to continue showing output and keeping headings (useful in navigation for users of HeadingsMap type browser add-ons, as well as for accessibility in general)
- #172 - There is no longer a need for avoiding the reserved
static
keyword, as I renamed the examples (to usestatik
). - #166 - I guess we could protect overwrites to
writeHead
, but what’s to prevent someone from rewritingsetHeader
? If it’s a common enough use case to overwritewriteHead
, I could add the preventative measure, esp. with a test.
Remaining steps:
- The Unauthorized File Access issue https://www.npmjs.com/advisories/1206 does not appear to be an issue per testing (if it ever was); if you can provide a test case where it fails, please report
- I’ve added
nyc
for coverage, but I’m not sure that withvows
, we can do binary file testing. I’m thinking whether we should switch tomocha
for this (I prefer that to jest for the ecosystem). Ideally we’d get to full coverage, including the binary.
Issue Analytics
- State:
- Created 2 years ago
- Reactions:6
- Comments:33 (15 by maintainers)
Top Results From Across the Web
Test your PRs for vulnerabilities before merging - Snyk's docs
Test your PRs for vulnerabilities before merging. Snyk integrates with your preferred Git repository to scan your manifest files for any new code...
Read more >Mitigating known security risks in open source libraries - O'Reilly
This chapter focuses on all you should know about fixing vulnerable packages, including remediation options, tooling, and various nuances. Note ...
Read more >Getting started with Semgrep App
Get started with Semgrep App to scan for security vulnerabilities on both local and remote repositories hosted on GitHub and GitLab.
Read more >A summary number of filtered clients grouped by their update pattern ...
Fixatives, Vulnerability and Propagation | ResearchGate, the professional ... On the other hand, External PRs also cover new features (380 out of 384...
Read more >Keep all your packages up to date with Dependabot
With the launch of version updates, security alerts for vulnerable dependencies and automated security updates have new names: Dependabot alerts ...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
I’m well aware of supply chain attacks… but basically a big part of that responsibility is on users auditing their dependencies. I did my duty of making sure @brettz9 is a legitimate contributor to the open source community (which he clearly is), and so I think he will do a great job. I wouldn’t have given write access to someone with no credentials or github history!
@cloudhead I did it! I converted all history since 2018 (i.e. everything @brettz9 pushed) into a linear tree. You can take my cleaned history with:
You can then go ahead and do an interactive rebase with
git rebase -i 83aac2e
to clean the history to your liking.