Commit activity
Last 12 weeks · 1 commit
Community health
4 of 6 standards met
Recent fixes
Another vul similar to https://github.com/component/type/issues/25 is found in component-type. A crafted payload can forge an internal property (nodeType) to manipulate the type detection result.
We found that a maliciously crafted user-input object can type detection result of component-type module. The vulnerability is from the following code: component-type leverages the _isBuffer property from unsafe user-input to detect buffer type information. However, a crafted payload can overwrite this property to manipulate the type detection result. https://github.com/component/type/blob/a581cc14d0b46b8a4c96e2fc99fa76cd7faef5d9/index.js#L39-L46 Reproduce Script
Repository: sindresorhus/component-type. Description: Type assertions aka less-broken `typeof` Stars: 96, Forks: 21. Primary language: JavaScript. Languages: JavaScript (100%). License: MIT. Latest release: v2.0.0 (2y ago). Open PRs: 0, open issues: 0. Last activity: 1mo ago. Community health: 85%. Top contributors: tj, sindresorhus, juliangruber, Swatinem, ianstormtaylor, chemzqm, chrissrogers, cristiandouce, dominicbarnes, ForbesLindesay and others.