News for hackers. Stuff that matters.

A comment on Netmask NPM package, used by 270k+ projects, vulnerable to octal input data.

Re:Netmask NPM package, used by 270k+ projects, vulnerable t... by richrichardsson on Monday March 29, 2021 @10:09AM (#26621801)
> if byte.length > 2 and (byte[1] == 'x' or byte[1] == 'x')

Am I going crazy or is the `or` clause completely pointless?

[ Parent | on HN ]
Re:Netmask NPM package, used by 270k+ projects, vulnerable t... by minitech on Monday March 29, 2021 @10:25AM (#26622091)
One of them is uppercase in the actual code.
[ Parent | on HN ]
Re:Netmask NPM package, used by 270k+ projects, vulnerable t... by 0xdba on Monday March 29, 2021 @10:39AM (#26622332)
https://github.com/rs/node-netmask/commit/ec1b5b56a822babf90...

I don't see it.

[ Parent | on HN ]
Re:Netmask NPM package, used by 270k+ projects, vulnerable t... by minitech on Monday March 29, 2021 @11:02AM (#26622752)
Ah, sorry, it was fixed in https://github.com/rs/node-netmask/commit/3f19a056c4eb808ea4.... And good catch, of course :)
[ Parent | on HN ]