Update fbjs to 1.0.0 to fix ReDos Vulnerability #1978
Conversation
|
Thank you for your pull request and welcome to our community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. In order for us to review and merge your code, please sign up at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need the corporate CLA signed. If you have received this in error or have any questions, please contact us at cla@fb.com. Thanks! |
|
Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Facebook open source project. Thanks! |
I updated the yarn lock file but it looks like flow type for joinClasses in fbjs is incorrect as it's typed as joinClasses(className: mixed): string but the correct type would be joinClasses(...className: Array) as joinClasses function take an array of args and pass them inside of variable called className. because of this i had to add a flow fix me. |
There was a problem hiding this comment.
@niveditc has imported this pull request. If you are a Facebook employee, you can view this diff on Phabricator.
Summary: **Summary** draft-js was using older version of fbjs that uses older version ua-parser-js what has a vulnerability. https://app.snyk.io/vuln/npm:ua-parser-js:20180227 **Test Plan** 1. Run npm test and it passes 2. Run npm build and it passes Pull Request resolved: facebookarchive#1978 Differential Revision: D13746429 fbshipit-source-id: 636e9ad795f97781f6dc8a88125dcea0be005987
Summary: **Summary** draft-js was using older version of fbjs that uses older version ua-parser-js what has a vulnerability. https://app.snyk.io/vuln/npm:ua-parser-js:20180227 **Test Plan** 1. Run npm test and it passes 2. Run npm build and it passes Pull Request resolved: facebookarchive/draft-js#1978 Differential Revision: D13746429 fbshipit-source-id: 636e9ad795f97781f6dc8a88125dcea0be005987
Summary: **Summary** draft-js was using older version of fbjs that uses older version ua-parser-js what has a vulnerability. https://app.snyk.io/vuln/npm:ua-parser-js:20180227 **Test Plan** 1. Run npm test and it passes 2. Run npm build and it passes Pull Request resolved: facebookarchive/draft-js#1978 Differential Revision: D13746429 fbshipit-source-id: 636e9ad795f97781f6dc8a88125dcea0be005987
Summary
draft-js was using older version of fbjs that uses older version ua-parser-js what has a vulnerability.
https://app.snyk.io/vuln/npm:ua-parser-js:20180227
Test Plan