GitHub Advisoryadvisory · npm

GHSA-gf8q-jrpm-jvxq URL parsing in node-forge could lead to undesired behavior.

LOW Published 2022-01-08 Modified 2022-01-07 Official page ↗
Ecosystem
npm
Packages
node-forge
Severity
Low
Weaknesses
CWE-601
Reviewed
2022-01-07

Affected packages

• npm node-forge: < 1.0.0 → fixed in 1.0.0

Description

Impact The regex used for the `forge.util.parseUrl` API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior. Patches `forge.util.parseUrl` and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API. Workarounds Ensure code does not directly or indirectly call `forge.util.parseUrl` with untrusted input. References • https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae/ For more information If you have any questions or comments about this advisory: • Open an issue in forge • Email us at [email protected]

Related

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References