Skip to content

Switch from filenamify-url to filenamify#395

Merged
tschaub merged 2 commits intotschaub:mainfrom
tw0517tw:filenamify
Jun 21, 2021
Merged

Switch from filenamify-url to filenamify#395
tschaub merged 2 commits intotschaub:mainfrom
tw0517tw:filenamify

Conversation

@tw0517tw
Copy link
Copy Markdown
Contributor

@tw0517tw tw0517tw commented Jun 16, 2021

to prevent URL check failures blocking publishing.

related #394 #392

As my finding ( #394 (comment) ) that filenamify-url is doing URL check but git repo URLs may fail the check and this dependency is only used to generate cache filename. I think it is safe to use only filenamify.

Fixes #392.

@kevcenteno
Copy link
Copy Markdown

@tschaub This looks like a reasonable change. Can we get the workflows to run and possibly get it merged?

@tschaub
Copy link
Copy Markdown
Owner

tschaub commented Jun 21, 2021

Thanks for the fix, @tw0517tw. I added a test in 6ea427b.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

high severity vulnerabilities from normalize-url library (ReDoS issue)

3 participants