{"action":"created","issue":{"url":"https://api.github.com/repos/ember-cli/ember-cli/issues/3455","labels_url":"https://api.github.com/repos/ember-cli/ember-cli/issues/3455/labels{/name}","comments_url":"https://api.github.com/repos/ember-cli/ember-cli/issues/3455/comments","events_url":"https://api.github.com/repos/ember-cli/ember-cli/issues/3455/events","html_url":"https://github.com/ember-cli/ember-cli/issues/3455","id":60217521,"number":3455,"title":"Handle Marked ReDoS Vulnerability","user":{"login":"chadhietala","id":183799,"avatar_url":"https://avatars.githubusercontent.com/u/183799?v=3","gravatar_id":"","url":"https://api.github.com/users/chadhietala","html_url":"https://github.com/chadhietala","followers_url":"https://api.github.com/users/chadhietala/followers","following_url":"https://api.github.com/users/chadhietala/following{/other_user}","gists_url":"https://api.github.com/users/chadhietala/gists{/gist_id}","starred_url":"https://api.github.com/users/chadhietala/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chadhietala/subscriptions","organizations_url":"https://api.github.com/users/chadhietala/orgs","repos_url":"https://api.github.com/users/chadhietala/repos","events_url":"https://api.github.com/users/chadhietala/events{/privacy}","received_events_url":"https://api.github.com/users/chadhietala/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ember-cli/ember-cli/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-03-07T18:13:26Z","updated_at":"2015-03-08T19:45:18Z","closed_at":null,"body":"We recently introduced [marked](https://github.com/chjj/marked) for better help documentation. A ReDoS vulnerability has been reported on this project and we should either fix marked or remove the dependency on it before releasing 0.2.0. \r\n\r\n/cc @trabus \r\n\r\nhttps://nodesecurity.io/advisories/marked_redos"},"comment":{"url":"https://api.github.com/repos/ember-cli/ember-cli/issues/comments/77770085","html_url":"https://github.com/ember-cli/ember-cli/issues/3455#issuecomment-77770085","issue_url":"https://api.github.com/repos/ember-cli/ember-cli/issues/3455","id":77770085,"user":{"login":"stefanpenner","id":1377,"avatar_url":"https://avatars.githubusercontent.com/u/1377?v=3","gravatar_id":"","url":"https://api.github.com/users/stefanpenner","html_url":"https://github.com/stefanpenner","followers_url":"https://api.github.com/users/stefanpenner/followers","following_url":"https://api.github.com/users/stefanpenner/following{/other_user}","gists_url":"https://api.github.com/users/stefanpenner/gists{/gist_id}","starred_url":"https://api.github.com/users/stefanpenner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stefanpenner/subscriptions","organizations_url":"https://api.github.com/users/stefanpenner/orgs","repos_url":"https://api.github.com/users/stefanpenner/repos","events_url":"https://api.github.com/users/stefanpenner/events{/privacy}","received_events_url":"https://api.github.com/users/stefanpenner/received_events","type":"User","site_admin":false},"created_at":"2015-03-08T19:45:18Z","updated_at":"2015-03-08T19:45:18Z","body":"Ya. We should also apply pressure upstream so others who are using this lib and actually are vulnerable to the attack vector are not left vulnerable.\n\nI think it's important to consider usage and vector risk, or we will just get desensitized."}}