Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign uppython_2_eol.html template uses vulnerable moment version #1832
Comments
|
I don't think this affects us because the use is pretty match hardcoded... But feel free to send a PR upgrading moment.js! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I'm submitting a ...
Do you want to request a feature or report a bug?
Reporting a Bug
What is the current behavior?
python_2_eol.htmltemplate uses vulnerable moment version (v2.18.1 moment.js is vulnerable to regular expression denial of service via a crafted date string)If the current behavior is a bug, please provide the steps to reproduce and if possible a screenshots and logs of the problem. If you can, show us your code.
See: https://github.com/cherrypy/cherrypy/blob/1980247/docs/_templates/python_2_eol.html#L78
What is the expected behavior?
Upgrade moment version to a new version (ie. 2.22.2)
What is the motivation / use case for changing the behavior?
v2.18.1 of moment.js is vulnerable to regular expression denial of service via a crafted date string
Please tell us about your environment:
Not required
Other information (e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, e.g. stackoverflow, gitter, etc.)
Not required