3 ms·
Do they? Their website https://cdnjs.com/libraries https://cdnjs.com/libraries says "Couldn't find the library you're looking for? You can make a request to ha
by jtsiskin 5y ago
Do they? Their website https://cdnjs.com/libraries https://cdnjs.com/libraries says
"Couldn't find the library you're looking for?
You can make a request to have it added on our GitHub repository."
Amusingly you can see the "hey-sven" library they added to test the fix: https://github.com/cdnjs/packages/pull/695 https://github.com/cdnjs/packages/pull/695
If you download the tarball directly, https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz https://registry.npmjs.org/hey-sven/-/hey-sven-1.0.2.tgz, then tar -ztvf hey-sven-1.0.2.tgz, you can see
-rw-r--r-- 0 ryotak staff 204 Jun 2 16:21 package/package.json
-rw-r--r-- 0 ryotak wheel 10 Jun 2 16:21 ../../../../../../../../../../tmp/ryotak
-rw-r--r-- 0 ryotak wheel 10 Jun 2 16:22 ../../../../../../../../../../tmp/ryotak.sh
both which just have the contents "Retesting"
- aylux2121 5y agoI'm just trying to find the root cause. I see that is PR is merged by a contributor "xtuc". Root question is that why was this PR merged? Apart from reading/writing to other files in the build pipeline instance (which is a really good catch), primary problem I see here is that anyone is able to deploy any arbitrary code/javascript to serve it from cdnjs. Just send a PR, then some contributor will merge it without checking the release package content. Don't you think that is open to a lot of issues?