Send package evolved from version 0.17.1 to 0.17.2 by focusing on enhanced security, updated dependencies and improved developer experience. The core functionality remains the same, providing efficient static file serving with range requests and conditional-GET support. For developers, the key changes lie within the updated dependency tree. Most notably, http-errors goes from "~1.7.2" to "1.8.1", potentially addressing vulnerabilities and incorporating the latest error-handling improvements.
On the dev-tools front, a significant shift occurred, as several tools has been updated. Version 0.17.2 introduces nyc for code coverage, along with newer versions of eslint, supertest and various eslint plugins. This enhanced development environment signals a commitment to higher code quality and robust testing. These upgrades likely result in stricter code linting, more comprehensive testing capabilities, and improved code coverage analysis. Specifically, the upgrade of ESLint suite and related plugins indicates a focus on code style, potential error prevention, and adherence to modern JavaScript standards.
The update implies developers are trading potentially breaking changes with http-errors for long-term security benefits and a more robust, modern development workflow facilitated by the updated toolchain. The core benefits of send - efficient static file serving - remain consistent across versions but developers should test to ensure compatibility with the new dependecies. Overall the newer version is more secure and with better tools to detect bugs.
All the vulnerabilities related to the version 0.17.2 of the package
send vulnerable to template injection that can lead to XSS
passing untrusted user input - even after sanitizing it - to SendStream.redirect()
may execute untrusted code
this issue is patched in send 0.19.0
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
successful exploitation of this vector requires the following: