You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
christian-hawk
all the way I see this, we can split in 2 situations then.
1. XXE vulnerability mitigation, if it impacts passport
2. discuss passport-twitter replacement due non-maintanence
About number 1, if it does not impact passport, we don’t need further action.
The tree is
passport-twitter@1.0.4 › xtraverse@0.1.0 › xmldom@0.1.31
Xtraverse used by passport-twitter is also from jared.
xmldom mitigated the vulnerability already on version 0.5.0 so according to semver there is no breaking change.
About number 2:
I have to check the project, but maybe a simple fork and force updating xmldom should do it.
The text was updated successfully, but these errors were encountered:
xmldom lib has Misinterpretation of malicious XML input vulnerability which is used by
passport-twitter
we have 2 actions on this,
The text was updated successfully, but these errors were encountered: