Comments (6)
Hi! We have merged #971 addressing this issue. Thanks!
from twilio-node.
Given that this is an API client and that there is a warning indicating not to use this in front end apps which means there are no cookies involved, and that CSRF is a front end vuln related to cookie handling, I'm pretty sure this vulnerability does not affect this library in any meaningful way.
From the readme https://github.com/twilio/twilio-node/blob/main/README.md?plain=1#L28-L29Do not use this Node.js library in a front-end application. Doing so can expose your Twilio credentials to end-users as part of the bundled HTML/JavaScript sent to their browser.
while i agree this MIGHT not impact the client in any meaningful way, as of now. but
- there is no way to tell if the vulnerability will impact the future releases. anything could happen
- letting a vulnerability stay in the code intentionally causes all sorts of issues for consumers of the library. i.e. broken pipelines, setting up rules to ignore particular scan result etc.
- what downside is there to patch the library? there is already PR created.
Oh, I agree on all points. I was merely trying to contextualize the vuln as often people will see a vuln and make quick judgements. I was trying to help anyone who doesn't fully understand the issue to understand that there isn't a security risk. However, to your point, there are other reasons to upgrade. Thankfully the fix was merged!
from twilio-node.
Upgrading to the latest version of axios
or moving to use fetch
API built into Node 18+ has its own benefits.
Node 14 & 16 are both end of life releases. Removing axios
and using fetch
instead means one less package to depend on, have potential security issues from, etc.
from twilio-node.
Given that this is an API client and that there is a warning indicating not to use this in front end apps which means there are no cookies involved, and that CSRF is a front end vuln related to cookie handling, I'm pretty sure this vulnerability does not affect this library in any meaningful way.
From the readme https://github.com/twilio/twilio-node/blob/main/README.md?plain=1#L28-L29
Do not use this Node.js library in a front-end application. Doing so can expose your Twilio credentials to end-users as part of the bundled HTML/JavaScript sent to their browser.
while i agree this MIGHT not impact the client in any meaningful way, as of now. but
- there is no way to tell if the vulnerability will impact the future releases. anything could happen
- letting a vulnerability stay in the code intentionally causes all sorts of issues for consumers of the library. i.e. broken pipelines, setting up rules to ignore particular scan result etc.
- what downside is there to patch the library? there is already PR created.
from twilio-node.
Upgrading to the latest version of
axios
or moving to usefetch
API built into Node 18+ has its own benefits.Node 14 & 16 are both end of life releases. Removing
axios
and usingfetch
instead means one less package to depend on, have potential security issues from, etc.
This is a great point. Hopefully the team will consider replacing Axios and using the built in fetch API.
from twilio-node.
Given that this is an API client and that there is a warning indicating not to use this in front end apps which means there are no cookies involved, and that CSRF is a front end vuln related to cookie handling, I'm pretty sure this vulnerability does not affect this library in any meaningful way.
From the readme https://github.com/twilio/twilio-node/blob/main/README.md?plain=1#L28-L29
Do not use this Node.js library in a front-end application. Doing so can expose your Twilio credentials to end-users as part of the bundled HTML/JavaScript sent to their browser.
from twilio-node.
Related Issues (20)
- [Feature Request]: twilio message create timeout HOT 5
- Twilio Studio HOT 1
- Allow creation of MessagingResponse from Twiml string
- Getting error "Phone number is invalid." when trying to create a Sole Proprietor A2P brand HOT 1
- semver vulnerable to Regular Expression Denial of Service HOT 2
- Updating from major version 3.x.x to 4.x.x Breaks Data Contracts HOT 2
- 🐍🐪 Snake vs. camel casing, nested objects
- Error : Secondary Customer Profile for direct_customer can only be created through Twilio console. HOT 3
- Unable to filter calls using startTime and endTime in the list method (please see closing comments) HOT 4
- Missing messaging.v1.tollfreeVerifications.remove endpoint, unable to remove toll free verification using this library HOT 1
- Node.js v20 support HOT 5
- Publish 4.19.1? HOT 10
- Twilio crashed nodejs on errors 'Uncaught Exception' HOT 6
- [Feature Request]: fix audit HOT 2
- Question about task_queue_bulk_real_time_statistics HOT 2
- Twillio doesn't work with remix js
- Problem with Twilio streams using Websockets
- update you readme ffs. HOT 4
- [Vulnerability] patch axios vulnerability CVE-2023-26159 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from twilio-node.