Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Update querystringify to 2.1.1 to fix core bug with uncaught exception #175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
niftylettuce opened this issue Apr 24, 2019 · 4 comments
Closed

Update querystringify to 2.1.1 to fix core bug with uncaught exception #175

niftylettuce opened this issue Apr 24, 2019 · 4 comments

Comments

@niftylettuce
Copy link
Contributor

v2.1.1 of querystringify was released which fixes an issue where it does not match Node's graceful fallback for decoding URI

unshiftio/querystringify@30e1d19

per Node's built-in:

By default, the querystring.unescape() method will attempt to use the JavaScript built-in decodeURIComponent() method to decode. If that fails, a safer equivalent that does not throw on malformed URLs will be used.

https://nodejs.org/api/querystring.html#querystring_querystring_unescape_str
@niftylettuce
Copy link
Contributor Author

Also see unshiftio/querystringify#26

@niftylettuce
Copy link
Contributor Author

Basically you can crash Node apps that use this package server-side in middleware by passing %%%% percent signs to the URL...

@niftylettuce niftylettuce mentioned this issue Apr 25, 2019
Merged
@lpinca lpinca closed this as completed in 96662a3 Apr 25, 2019
@3rd-Eden
Copy link
Member

It's worth noting that the URL-parse library is designed to allow custom query string parsers instead of the bundled querystringify. So if the primary use-cases is usage on Node.js, and want better unescape fallback for the query strings it might be an option to do this.

@niftylettuce
Copy link
Contributor Author

@3rd-Eden could you add a deprecation notice please? I just checked and there wasn't one there yet.

npm deprecate url-parse@"<1.4.7" "Please upgrade to v1.4.7+ as an uncaught exception bug in querystringify has been fixed and may cause a vulnerability in server-side route middleware"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@3rd-Eden @niftylettuce