Address npm audit vulnerabilities (nodemailer, multer, express deps)
维护者通常 7 天内回复
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 35/100
- Issue 类型
- 重构
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- express, javascript, mysql, nodejs, sqlite
- 领域
- backend, build-system, security
调研方向
Start with app/package.json and run npm audit to see which advisories remain. The payload names app/uploader.js (multer limits) and app/emailer.js with app/endpoints/manage_event.js (nodemailer use) as the code that changes, and the sqlite3 and hugo-installer install paths are separate. Done means the audit count drops, the test suite passes, and image upload and the confirmation email work locally. Major-version bumps (nodemailer, sqlite3, faker) need changelog review, so expect to ask maintainers before merging.
由索引模型根据 Issue 内容生成。
描述
npm audit reports 34 vulnerabilities (4 critical, 24 high, 4 moderate, 2 low).
Most are in dev, build, or install-time dependencies, but a few affect the production backend.
Production exposure
- nodemailer
~7.0.11: the event confirmation email (app/endpoints/manage_event.js) sends to a user-supplied name and address, which is the input targeted by the addressparser DoS and recipient-domain bypass advisories.
Fixed in 10.x (major). - multer
~2.1.1: the public image upload endpoint is exposed to several DoS advisories via crafted field names.
app/uploader.jslimits file count and size, but notfields,parts, orfieldNameSize.
Fixed in 2.4.0. - qs / body-parser / express: query string DoS, reachable on every request.
Fixed bynpm audit fix. - proxy-addr (critical): low impact here since we set
trust proxytotrueand don't readreq.ip.
Fixed bynpm audit fix. - mysql2
~3.14.0: requires a malicious or impersonated database server.
Fixed in 3.24.6. - lodash
~4.17.21: we only usepickBy, so not affected, but cheap to bump to 4.18.1.
Install, dev, and build only
- tar / node-gyp / cacache (critical) via
sqlite3@5, used at install time only; production uses MySQL.
Fixed in sqlite3 6.x (major). - decompress / semver (critical) via
hugo-installer, which extracts the Hugo release archive duringpostinstall.
npm audit fixupdates decompress; ignore the--forcesuggestion, which downgrades hugo-installer. - @faker-js/faker in
tools/;helpers.fakeisn't used.
Fixed in 10.x (major). - @vue/server-renderer:
cal/is client-side only. - shell-quote, braces, micromatch, brace-expansion, nanoid, source-map-js, http-cache-semantics, ip-address: dev and build tooling only.
Proposed fix
- Run
npm audit fix(non-breaking). - Bump ranges in
app/package.json: multer~2.4.0, mysql2~3.24.6, lodash~4.18.1. - Upgrade nodemailer to 10.x and check
app/emailer.jsagainst the changelog. - Upgrade sqlite3 to 6.x and
@faker-js/fakerto 10.x. - Add
fields,parts, andfieldNameSizelimits to the multer config inapp/uploader.js. - Run the test suite and verify image upload and the confirmation email locally.
- 主要语言
- JavaScript
- 星标
- 30
- 派生
- 26
- 平均合并
- 6 天 24 分钟
- 30 天内合并 PR
- 6
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
shift-org/shift-docs 的其他 Issue
-
Unknown --db values report a TypeError instead of the intended error可能已有人在做 @gangster 于 71 天前认领。 未关闭
难度 1/5 1 小时以内 新手友好度 88/100
shift-org/shift-docs#1091 ·
维护者通常 7 天内回复
-
validateRideLength accepts any Object.prototype key as a ride length可能已有人在做 @gangster 于 71 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
shift-org/shift-docs#1089 ·
维护者通常 7 天内回复
-
Favorites page fetches every favorite because getDaily's guard is inverted可能已有人在做 @gangster 于 71 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
shift-org/shift-docs#1087 ·
维护者通常 7 天内回复
-
Add an endpoint for Biiikes to check whether an email address organizes an event可能重新可做 关联的 PR 已关闭且未合并。 未关闭
难度 4/5 3-5 天 新手友好度 25/100
shift-org/shift-docs#1106 · 1 条评论 ·
维护者通常 7 天内回复
-
sitemap.xml emits relative <loc> values, so search engines reject it可能已有人在做 @dduugg 于 97 天前认领。 未关闭
难度 4/5 3-5 天 新手友好度 68/100
shift-org/shift-docs#1082 ·
维护者通常 7 天内回复
查看 shift-org/shift-docs 的全部 Issue
相似的 Issue
-
Add: EUROTV NEWS未关闭channels:add check:passed
难度 2/5 1-3 小时 新手友好度 70/100
-
curriculum documentation quality
难度 2/5 1-3 小时 新手友好度 78/100
githubnext/gh-aw-workshop#4638 ·
维护者通常 1 天内回复
-
clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro impact:ux-friction issue-rating: 🦞 diamond lobster no-stale P2
难度 2/5 1-3 小时 新手友好度 65/100
openclaw/openclaw-enterprise#2571 · 1 条评论 · 1 个 reaction ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
fabriziosalmi/certmate#1247 ·
维护者通常 1 天内回复
-
[guide] docs/metrics/index.md names retired 'Import reference architectures' workflow as the metrics refresh path可能已有人在做 @hivecommons-hive 今天认领。 未关闭agent/guide documentation hive/covered-by-pr hive/hosted-available-lke648397-260827-5n31
难度 1/5 1 小时以内 新手友好度 70/100
维护者通常 1 天内回复