#Б #безопасность Хорошая же идея TOTP в deltachat https://codeberg.org/rtn/totp
Клонируем репу. npm audit
11 vulnerabilities (3 low, 2 moderate, 4 high, 2 critical)
pbkdf2 <=3.1.2
Severity: critical
pbkdf2 silently disregards Uint8Array input, returning static keys - https://github.com/advisories/GHSA-v62p-rq8g-8h59
pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos - https://github.com/advisories/GHSA-h7cp-r72f-jxh6
fix available via `npm audit fix`
node_modules/pbkdf2
sha.js <=2.4.11
Severity: critical
sha.js is missing type checks leading to hash rewind and passing on crafted data - https://github.com/advisories/GHSA-95m3-7q98-8xr5
fix available via `npm audit fix`
node_modules/sha.js
solid-js <1.9.4
Severity: high
Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS) - https://github.com/advisories/GHSA-3qxh-p7jc-5xh6
надо брать. Желательно 2 .
А что там нет в коде, так это работы сихронизации. Как оно работает...





