SECURITY: FIX unintended Email protocol resolution#3759
Conversation
✅ Deploy Preview for react-native ready!
To edit notification comments on pull requests, go to your Netlify site settings. |
|
@cortinico We must backport this change as it's a security concern 🚨. |
|
It's not a high security risk, but since the changes are quite simple, it would be nice if you can backport them. 🙂 |
|
May not be a high-security issue but, a similar email protocol resolution and domain resolution for Since it's only email resolution, and these instances don't make up valid email addresses they are of "low" security concerns. 👍 P.S.: If it was a "high" security concern (vulnerability) I would've reported it privately :) -- Sure 🙂. |
cortinico
left a comment
cortinico
left a comment
There was a problem hiding this comment.
Thanks for reporting this @Pranav-yadav
and yes let's backport it
|
Welcome! |
Pranav-yadav
deleted the
Pranav-yadav/security-fix-email-protocol-resolution
branch
4 participants
Summary
Fixes #3758
Wherever we've specified the package versions explicitly and haven't enclosed them in the inline-code-block (`) or multiline-code-block (```) they are resolved as an email protocol (address), which is unintended and is a primary security concern.
This diff updates such occurrences to enclose them in inline code blocks and of course some code formatting touchups 😇
Changelog:
[SECURITY]: FIX unintended Email protocol resolution
Changes
P.S.: Came across this when working on #3732