RxJS 5 中的任何已知漏洞答案

【问题标题】：Any known Vulnerabilities in RxJS 5RxJS 5 中的任何已知漏洞
【发布时间】：2018-05-15 00:26:21
【问题描述】：

试图了解 RxJs 是否可以在生产环境中安全使用。任何人都知道 RxJS 5 中的漏洞。以下是 RxJS5 已知的问题吗？请帮忙。

**Vulnerabilities - Public Data**
CVE-2017-1000048 High Risk Prototype Override Protection Bypass qs 2.4.2
CVE-2015-8855 High Risk Regular Expression Denial Of Service (ReDoS) semver 2.3.2
CVE-2017-1000048 High Risk Prototype Override Protection Bypass qs 5.2.1
CVE-2017-1000048 High Risk Prototype Override Protection Bypass qs 2.3.3
CVE-2017-15010 Medium Risk Regular Expression Denial Of Service (ReDoS) Via Parsing Cookies tough-cookie 2.3.2
CVE-2017-15010 Medium Risk Regular Expression Denial Of Service (ReDoS) Via Parsing Cookies tough-cookie 2.2.2

**Vulnerabilities - Premium Data**
RESERVED (CVE-2016-1000023) High Risk Regular Expression Denial Of Service (ReDoS) minimatch 0.3.0
RESERVED (CVE-2016-1000023) High Risk Regular Expression Denial Of Service (ReDoS) minimatch 2.0.10
NO-CVE High Risk Remote Code Execution (RCE) growl 1.9.2
RESERVED (CVE-2016-1000023) High Risk Regular Expression Denial Of Service (ReDoS) minimatch 2.0.4
NO-CVE Medium Risk Insecure Cipher request 2.55.0
NO-CVE Medium Risk Remote Memory Disclosure request 2.55.0
NO-CVE Medium Risk Insecure Cipher request 2.67.0
NO-CVE Medium Risk Remote Memory Disclosure request 2.67.0
RESERVED (CVE-2016-2515) Medium Risk Regular Expression Denial Of Service (ReDoS) hawk 2.3.1
NO-CVE Medium Risk Insecure Cipher request 2.79.0
NO-CVE Medium Risk Regular Expression Denial Of Service (ReDoS) debug 2.6.8
NO-CVE Medium Risk Insecure Cipher request 2.81.0
NO-CVE Medium Risk Denial Of Service (DoS) ws 1.1.5
NO-CVE Medium Risk Timing Attacks http-signature 0.10.1
NO-CVE Medium Risk Arbitrary Command Injection shelljs 0.7.6
RESERVED (CVE-2016-1000013) Medium Risk Cross-site Scripting (XSS) Due To Sanitization Bypass Using HTML Entities marked 0.3.5
NO-CVE Medium Risk Cross-site Scripting (XSS) marked 0.3.5
NO-CVE Medium Risk Cross-Site Scripting (XSS) marked 0.3.5
NO-CVE Medium Risk Regular Expression Denial Of Service (ReDoS) marked 0.3.5
NO-CVE Medium Risk Regular Expression Denial Of Service (ReDoS) debug 2.2.0
NO-CVE Medium Risk Regular Expression Denial Of Service (ReDoS) ms 0.7.3
NO-CVE Medium Risk Regular Expression Denial Of Service (ReDoS) ms 0.7.1
NO-CVE Medium Risk Regular Expression Denial Of Service (ReDoS) debug 2.6.6
NO-CVE Medium Risk Information Disclosure tunnel-agent 0.4.3
NO-CVE Medium Risk Regular Expression Denial Of Service (ReDoS) Via Long String Of Semicolons tough-cookie 2.2.2

【问题讨论】：

RxJS 只有一个非开发依赖：symbol-observable。开发依赖项中的任何“漏洞”都与 RxJS 的生产使用无关。
为了清楚起见，问题在于 RxJS 本身。例如，如果您使用 Angular cli 创建一个新项目，它会将 RxJS 作为“依赖项”添加到 package.json 中。

标签： rxjs rxjs5

【解决方案1】：

问题解决了。给我的报告被退回，说关于 SourceClear 是如何运行的一些问题。

在 RxJS 中没有发现漏洞。都很好。

新报告返回零 (0) 个漏洞。

【讨论】：