【安全漏洞】NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks

[xiaweiss]

ali-oss@6.20.0 => urllib@2.41.0 => ip@1.1.5

[xiaweiss]

see pr: #1292

[taltal78]

Hi ,
I see the PR #1292 got closed... will this be handled ?

[I072744]

This vulnerability still exists... how would this be handled ?
urllib latest version is available which is free from vulnerability
Thanks

[borisLipmanovich]

Hi @xiaweiss , any updates on this topic?
I see the PR #1292 got closed... will this be handled?

[xiaweiss]

@borisLipmanovich PR #1292 closed, but not merged. holy shit!

urllib version is still 2.41.0
https://github.com/ali-sdk/ali-oss/blob/master/package.json#L156

[borisLipmanovich]

@xiaweiss, indeed :) Can anyone handle it?

[xiaweiss]

@borisLipmanovich
No one is dealing with it, Alibaba doesn't take security seriously, it can be ignored

[borisLipmanovich]

@xiaweiss, This vulnerability has CVSS 8.6. Maybe you can reopen the PR as it was closed without merging?
#1292

[xiaweiss]

@borisLipmanovich please @ repo owner，not me.

[xiaweiss]

I'm just giving feedback, I don't have any access

[YunZZY]

Version 6.21.0 has been released

[ricky11]

The bundle size is just getting bigger an bigger, please remember this is also a browser package, and 700kb plus even not gzipped is huge... this package should be shaken, to only import what you need.