[Security Issues Collection] Security Findings Fixing about hyperview HOT 6 CLOSED

We have actually started exploring updating xmldom in this PR: #527

from hyperview.

I would close this ticket, as the url-parse issue has been fixed by #542 , and xmldom is being followed up in this PR #527.

from hyperview.

Hi @terryatgithub , I think it is safe to update url-parse. I checked that the API is unchanged, and we can QA the updated dependency. Do you want to submit a PR with this change?

Regarding xmldom library: my team will have to take a look at this. A while ago, we needed to fork the xmldom library to fix a parsing bug that caused the library to crash on certain valid inputs. It could be that the change was applied upstream already. But if not, we may need to pull down the latest version of xmldom into our fork. We will keep you posted.

from hyperview.

hi @adamstep
a pull request #542 has been raised to update url-parse to its latest version 1.5.10, please help review.
Looking forward to the progress of xmldom and greatly appreciate all your effort.

from hyperview.

Linking to issue #520

from hyperview.

@terryatgithub 0.66.1-rc.0 is available on npm with a patched version of xmldom. Note that I'm publishing this as a release candidate: we plan to QA this version extensively with the Instawork apps to make sure there are no regressions with the changes to the parsing library. I recommend you also test your apps with this release candidate before we make a full release.

from hyperview.