Fix for DoS vulnerability GHSA-wgc6-9f6w-h8hx #15
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Please don't merge this.This is 1) a degredation of functionality, 2) improperly formatted, and 3) completely wrong. I even wonder if @asvd was even notified of anything remotely related to this CVE before it was filed. If not, then whomever filed it should be fired from their job if it was done on behalf of a security company. In an effort to fight back against the mockery that has become the CVE system I've filed a correction to this CVE here: github/advisory-database#5730 If the author of this CVE is reading, please do better in the future. |
|
Also why is one faceless user the author of the commit but another similarly named faceless user the author of the PR? What is happening here? It reeks of fraud. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes a denial-of-service vulnerability by adding a character limit to the text processed by microlight.js.