EnvGap
[0.80]Component Governance critical alert Upgrade validator from 13.15.15 to 13.15.22 to fix the vulnerability.
envgap__microsoft__react-native-windows-15460
01 / FAILURE SIGNATURE
As reported upstream
No identifying execution failure has been captured.
Not a benchmark task.
- In a clean container the reported failure did not reproduce, or the known fix did not make the project run.
02 / ENVIRONMENT RECIPE
- Base commit
b67851f5d8a5ea0f400dc39f4e34c54bfbb5fb2c- Manifest
package.json- Reproduce
Awaiting issue-specific recipe- Run under trace
Awaiting a meaningful runtime command
03 / ORIGINAL ISSUE TEXT
microsoft/react-native-windows #15460 · read the original issue
Description Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service. Recommendation Upgrade validator from 13.15.15 to 13.15.22 to fix the vulnerability.
04 / LABELS
Labels from the report text only; not yet run
No supported category has been assigned.
Label rules and the text that matched
[]