Skip to content

[Snyk] Security upgrade rss-parser from 3.12.0 to 3.13.0 - #321

Open
dotam99 wants to merge 1 commit into
mainfrom
snyk-fix-5ec6731b74710e7a68c985052bdb9a4f
Open

[Snyk] Security upgrade rss-parser from 3.12.0 to 3.13.0#321
dotam99 wants to merge 1 commit into
mainfrom
snyk-fix-5ec6731b74710e7a68c985052bdb9a4f

Conversation

@dotam99

Copy link
Copy Markdown
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
SeverityPriority Score (*)IssueBreaking ChangeExploit Maturity
medium severity658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3
Prototype Pollution
SNYK-JS-XML2JS-5414874
NoProof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: rss-parser The new version differs by 26 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

@guardrails

Copy link
Copy Markdown

⚠️ We detected 1069 security issues in this pull request:

Mode: paranoid | Total findings: 1069 | Considered vulnerability: 1069

Insecure File Management (206)
SeverityDetailsDocs
HighTitle: Use of non-literal fs filename
const{ data }=frontmatter(fs.readFileSync(homepage,'utf8'))
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(dir))return
📚
HighTitle: Use of non-literal fs filename
const{ data }=frontmatter(fs.readFileSync(toc,'utf8'))
📚
HighTitle: Use of non-literal fs filename
constbuffer=fs.readFileSync(absFilePath)
📚
HighTitle: Use of non-literal fs filename
filename=>[filename,fs.readFileSync(filename,'utf8')]
📚
HighTitle: Use of non-literal require
constmiddleware=require(path.resolve(__dirname,'../middleware',relativePath))
📚
HighTitle: Use of non-literal fs filename
constcontent=fs.readFileSync(fullPath,'utf8')
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(path.join(dist,'react'))){
📚
HighTitle: Use of non-literal fs filename
fs.mkdirSync(path.join(dist,'react'),{recursive: true})
📚
HighTitle: Use of non-literal fs filename
constcontent=transform(fs.readFileSync(file.path,'utf8'))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(path.join(dist,file.path),content)
📚
HighTitle: Use of non-literal fs filename
module.exports=util.promisify(fs.readFile)
📚
HighTitle: Use of non-literal fs filename
fs.readdirSync(schemasPath)
📚
HighTitle: Use of non-literal require
constvalue=require(path.join(schemasPath,filename))
📚
HighTitle: Use of non-literal fs filename
returnawaitfs.readdir(path.join(__dirname,'indexes'))
📚
HighTitle: Use of non-literal fs filename
.then(content=>fs.writeFile(
📚
HighTitle: Use of non-literal fs filename
.then(content=>fs.writeFile(
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(cacheFile,JSON.stringify(index,null,2))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(
📚
HighTitle: Use of non-literal fs filename
constversions=fs.readdirSync(staticDir)
📚
HighTitle: Use of non-literal require
set(payloadsPerVersion,payloadPath,formatAsJsonCodeBlock(require(payloadFile)))
📚
HighTitle: Use of non-literal fs filename
if(fs.existsSync(destDir)){
📚
HighTitle: Use of non-literal fs filename
dirStats=fs.statSync(earlyAccessLocalRepoDir)
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(sourceDir)){
📚
HighTitle: Use of non-literal fs filename
fs.symlinkSync(sourceDir,destDir,'junction')
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(destDir)){
📚
HighTitle: Use of non-literal fs filename
if(!fs.lstatSync(destDir).isSymbolicLink()){
📚
HighTitle: Use of non-literal fs filename
if(!fs.statSync(destDir).isDirectory()){
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(earlyAccessContentAndDataFiles)){
📚
HighTitle: Use of non-literal fs filename
constoldContents=fs.readFileSync(file,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(file,newContents)
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(variablePath))returnfalse
📚
HighTitle: Use of non-literal fs filename
constvariableFileContent=yaml.safeLoad(fs.readFileSync(variablePath,'utf8'))
📚
HighTitle: Use of non-literal fs filename
returnfs.existsSync(`${path.posix.join(earlyAccessData,reusablePath)}.md`)
📚
HighTitle: Use of non-literal fs filename
returnfs.existsSync(path.posix.join(earlyAccessImages,imagePath))
📚
HighTitle: Use of non-literal fs filename
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(fullPathToArchivalRepo)){
📚
HighTitle: Use of non-literal fs filename
fs.mkdirSync(finalDirectory,{recursive: true})
📚
HighTitle: Use of non-literal fs filename
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(path.posix.join(finalDirectory,'redirects.json'),JSON.stringify(redirectsPerVersion,null,2))
📚
HighTitle: Use of non-literal fs filename
📚
HighTitle: Use of non-literal require
require(path.join(process.cwd(),removeUnusedAssetsScript))
📚
HighTitle: Use of non-literal fs filename
constoldContents=fs.readFileSync(file,'utf8')
📚
HighTitle: Use of non-literal fs filename
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(newSchemaFile)){
📚
HighTitle: Use of non-literal require
constpreviews=require(previewsFile)
📚
HighTitle: Use of non-literal require
📚
HighTitle: Use of non-literal require
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(previewsFile,JSON.stringify(previews,null,2))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(changesFile,JSON.stringify(changes,null,2))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(objectsFile,JSON.stringify(objects,null,2))
📚
HighTitle: Use of non-literal fs filename
fs.readdirSync(srcDir).forEach(file=>{
📚
HighTitle: Use of non-literal fs filename
📚
HighTitle: Use of non-literal fs filename
if(!fs.readdirSync(destDir).length){
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(oldDereferencedFile)){
📚
HighTitle: Use of non-literal fs filename
constoldDereferencedContent=fs.readFileSync(oldDereferencedFile,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(newDereferencedFile,newDereferenceContent)
📚
HighTitle: Use of non-literal require
constdereferencedSchema=require(path.join(process.cwd(),newDereferencedFile))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(newDecoratedFile,JSON.stringify(operations,null,2))
📚
HighTitle: Use of non-literal fs filename
fs.readdirSync(srcDir).forEach(file=>{
📚
HighTitle: Use of non-literal fs filename
📚
HighTitle: Use of non-literal fs filename
if(!fs.readdirSync(destDir).length){
📚
HighTitle: Use of non-literal fs filename
constdataContent=fs.readFileSync(file,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(file,newDataContent)
📚
HighTitle: Use of non-literal fs filename
const{ data, content }=frontmatter(fs.readFileSync(file,'utf8'))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(file,frontmatter.stringify(newContent,data,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
constreleaseCandidateData=yaml.safeLoad(fs.readFileSync(releaseCandidateYaml,'utf8'))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(releaseCandidateYaml,yaml.safeDump(releaseCandidateData))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(localisedAbsPath,toWrite)
📚
HighTitle: Use of non-literal fs filename
if(fs.existsSync(categoryDir)){
📚
HighTitle: Use of non-literal fs filename
constpreviousChangelogString=fs.readFileSync(targetPath)
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(targetPath,JSON.stringify(previousChangelog,null,2))
📚
HighTitle: Use of non-literal fs filename
constpreviousUpcomingChanges=yaml.safeLoad(fs.readFileSync(upcomingChangesPath,'utf8'))
📚
HighTitle: Use of non-literal fs filename
constpreviousSchemaString=fs.readFileSync(schemaPath,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(filepath,content,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(tempSchemaFilePath,latestSchema)
📚
HighTitle: Use of non-literal fs filename
fs.unlinkSync(tempSchemaFilePath)
📚
HighTitle: Use of non-literal fs filename
constinputObjectIncludeFile=fs.readFileSync(path.join(includes,'graphql-input-object.html'),'utf8')
📚
HighTitle: Use of non-literal fs filename
constobjectIncludeFile=fs.readFileSync(path.join(includes,'graphql-object.html'),'utf8')
📚
HighTitle: Use of non-literal fs filename
assert(fs.existsSync(oldCategoryDir),`directory does not exist: ${oldCategoryDir}`)
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(productDir)){
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(productTocPath,matter.stringify(content,data,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
consttocContents=fs.readFileSync(oldProductTocPath,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(oldProductTocPath,matter.stringify(newContent,data,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
constarticleContents=fs.readFileSync(file,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(file,newContents)
📚
HighTitle: Use of non-literal fs filename
constfileContent=fs.readFileSync(fullPath,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(markdownFilename,value)
📚
HighTitle: Use of non-literal fs filename
if(batchFile&&!fs.existsSync(batchFile)){
📚
HighTitle: Use of non-literal fs filename
fs.readFileSync(batchFile,'utf8')
📚
HighTitle: Use of non-literal fs filename
constcontents=fs.readFileSync(categoryIndex,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(categoryIndex,frontmatter.stringify(content,data,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
for(constarticleFileNameoffs.readdirSync(categoryDirPath)){
📚
HighTitle: Use of non-literal fs filename
constarticleContents=fs.readFileSync(articlePath,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(articlePath,frontmatter.stringify(articleContent,articleData,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
constproductIndexContents=fs.readFileSync(productIndexPath,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(productIndexPath,frontmatter.stringify(revisedProductIndex,productIndexData,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
fs.renameSync(categoryDirPath,newPath)
📚
HighTitle: Use of non-literal fs filename
const{ data, content }=frontmatter(fs.readFileSync(oldFullPath,'utf8'))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(newFullPath,frontmatter.stringify(content,data))
📚
HighTitle: Use of non-literal fs filename
📚
HighTitle: Use of non-literal fs filename
: fs.unlinkSync(reusablePath)
📚
HighTitle: Use of non-literal fs filename
: fs.unlinkSync(imagePath)
📚
HighTitle: Use of non-literal fs filename
constenterpriseDatesString=fs.readFileSync(enterpriseDatesFile,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(enterpriseDatesFile,formattedDatesString)
📚
HighTitle: Use of non-literal fs filename
const{ data, content }=frontmatter(fs.readFileSync(file,'utf8'))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(file,frontmatter.stringify(newContent,data,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
constreadmeComment=fs.readFileSync(fullPath,'utf8')
📚
HighTitle: Use of non-literal fs filename
if(template===fs.readFileSync(readme,'utf8')){
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(readme,template)
📚
HighTitle: Use of non-literal fs filename
constcontent=fs.readFileSync(file,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(file,newContent)
📚
HighTitle: Use of non-literal fs filename
const{ data, content }=frontmatter(fs.readFileSync(file,'utf8'))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(file,frontmatter.stringify(newContent,data,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
constcontents=fs.readFileSync(productIndex,'utf8')// TODO move to async
📚
HighTitle: Use of non-literal require
schemaForCurrentVersion: require(`../../lib/graphql/static/schema-${graphqlVersion}`),
📚
HighTitle: Use of non-literal require
constwebhookPayloads=require(path.join(process.cwd(),'lib/webhooks'))
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(fullPath)){
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(fullPath,fs.readFileSync(englishFullPath))
📚
HighTitle: Use of non-literal fs filename
fs.appendFileSync(logFile,JSON.stringify(result)+'\n')
📚
HighTitle: Use of non-literal fs filename
constarticleContents=fs.readFileSync(filePath,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(filePath,newContents)
📚
HighTitle: Use of non-literal fs filename
if(fs.existsSync(existingFileToCompare)){
📚
HighTitle: Use of non-literal fs filename
constexistingImageToCompare=awaitfs.readFileSync(existingFileToCompare)
📚
HighTitle: Use of non-literal fs filename
constenterpriseImage=awaitfs.readFileSync(file)
📚
HighTitle: Use of non-literal fs filename
if(compareResult===0)fs.unlinkSync(file)
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(existingFileToCompare)){
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(newDirectoryName)){
📚
HighTitle: Use of non-literal fs filename
fs.mkdirSync(newDirectoryName,{recursive: true})
📚
HighTitle: Use of non-literal fs filename
fs.renameSync(file,existingFileToCompare)
📚
HighTitle: Use of non-literal fs filename
constnewContents=fs.readFileSync(file,'utf8')
📚
HighTitle: Use of non-literal fs filename
📚
HighTitle: Use of non-literal fs filename
letcategoryIndexContent=fs.readFileSync(categoryIndexFile,'utf8')
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(oldTopicFile))continue
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(newTopicDirectory))fs.mkdirSync(newTopicDirectory)
📚
HighTitle: Use of non-literal fs filename
const{ data, content }=frontmatter(fs.readFileSync(oldTopicFile,'utf8'))
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(`${oldTopicDirectory}/${article}.md`))return
📚
HighTitle: Use of non-literal fs filename
fs.renameSync(`${oldTopicDirectory}/${article}.md`,newArticlePath)
📚
HighTitle: Use of non-literal fs filename
constarticleContents=frontmatter(fs.readFileSync(newArticlePath,'utf8'))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(newArticlePath,frontmatter.stringify(articleContents.content.trim(),articleContents.data,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(`${newTopicDirectory}/index.md`,frontmatter.stringify(topicContent.trim(),data,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(categoryIndexFile,categoryIndexContent)
📚
HighTitle: Use of non-literal fs filename
fs.unlinkSync(oldTopicFile)
📚
HighTitle: Use of non-literal fs filename
if(fs.existsSync(imagePath))fs.unlinkSync(imagePath)
📚
HighTitle: Use of non-literal fs filename
if(fs.existsSync(imagePath))fs.unlinkSync(imagePath)
📚
HighTitle: Use of non-literal fs filename
fs.unlinkSync(imageFullPath)
📚
HighTitle: Use of non-literal fs filename
fs.unlinkSync(imageFullPath)
📚
HighTitle: Use of non-literal fs filename
fs.unlinkSync(imageFullPath)
📚
HighTitle: Use of non-literal fs filename
fs.unlinkSync(imageFullPath)
📚
HighTitle: Use of non-literal fs filename
fs.unlinkSync(path.join(process.cwd(),directoryImage))
📚
HighTitle: Use of non-literal fs filename
const{ data, content }=frontmatter(fs.readFileSync(file,'utf8'))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(file,frontmatter.stringify(newContent,data,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
const{ data, content }=frontmatter(fs.readFileSync(indexFile,'utf8'))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(indexFile,frontmatter.stringify('',data,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
constglossary=yaml.safeLoad(fs.readFileSync(inputFile,'utf8'))
📚
HighTitle: Use of non-literal fs filename
📚
HighTitle: Use of non-literal fs filename
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(sourceDir)){
📚
HighTitle: Use of non-literal fs filename
fs.renameSync(sourceDir,destDir)
📚
HighTitle: Use of non-literal fs filename
assert(fs.existsSync(translationFilePath),`file does not exist: ${translationFilePath}`)
📚
HighTitle: Use of non-literal fs filename
assert(fs.existsSync(englishFile),`file does not exist: ${englishFile}`)
📚
HighTitle: Use of non-literal fs filename
constenglishContent=fs.readFileSync(englishFile,'utf8')
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(translationFilePath,englishContent)
📚
HighTitle: Use of non-literal fs filename
constrelativePath=fs.existsSync(pathArg)
📚
HighTitle: Use of non-literal require
constschemas=files.map(filename=>require(filename))
📚
HighTitle: Use of non-literal fs filename
constschemas=fs.readdirSync(dereferencedPath)
📚
HighTitle: Use of non-literal fs filename
if(!fs.existsSync(githubRepoDir)){
📚
HighTitle: Use of non-literal require
constschema=require(path.join(dereferencedPath,filename))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(path.join(dereferencedPath,filename),JSON.stringify(schema,null,2))
📚
HighTitle: Use of non-literal require
constschema=require(path.join(dereferencedPath,filename))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(filename,JSON.stringify(operations,null,2))
📚
HighTitle: Use of non-literal fs filename
const{ content, data }=matter(fs.readFileSync(fullPath,'utf8'))
📚
HighTitle: Use of non-literal fs filename
fs.writeFileSync(fullPath,matter.stringify(content,newData,{lineWidth: 10000}))
📚
HighTitle: Use of non-literal fs filename
constfileContents=awaitfs.promises.readFile(fullPath,'utf8')
📚
HighTitle: Use of non-literal fs filename
.filter(link=>fs.existsSync(getPath(productDir,link,'index')))
📚
HighTitle: Use of non-literal fs filename
constchildEntries=awaitfs.promises.readdir(categoryDir,{withFileTypes: true})
📚
HighTitle: Use of non-literal fs filename
constgitignore=fs.readFileSync(gitignorePath,'utf8')
📚
HighTitle: Use of non-literal require
constschemaJsonPerVersion=require(`../../lib/graphql/static/schema-${version}`)
📚
HighTitle: Use of non-literal fs filename
awaitfs.stat(filepath)
📚
HighTitle: Use of non-literal fs filename
awaitfs.writeFile(newFile,'newvalue: bar')
📚
HighTitle: Use of non-literal fs filename
awaitfs.unlink(newFile)
📚
HighTitle: Use of non-literal fs filename
awaitfs.writeFile(testTargetPath,previousContents)
📚
HighTitle: Use of non-literal fs filename
returnyaml.load(fs.readFileSync(filename,'utf8'),{ filename })
📚
HighTitle: Use of non-literal fs filename
consttestDirectory=awaitfs.readdir(pathToTests)
📚
HighTitle: Use of non-literal fs filename
📚
HighTitle: Use of non-literal fs filename
constfilenames=(awaitfs.readdir(referenceDir))
📚

This comment has been truncated due to comment length limitations, please go to the dashboard for further details.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@dotam99@snyk-bot