basic-ftp - npm Package Compare versions

Comparing version 5.3.0 to 5.3.1

dist/FtpContext.js

@@ -20,2 +20,4 @@ "use strict";
 }
+// Limit the accepted size of the control response.
+const maxControlResponseLength = 2 ** 16;
 /**
@@ -279,3 +281,7 @@ * FTPContext holds the control and data sockets of an FTP connection and provides a
         this.log(`< ${chunk}`);
-        // This chunk might complete an earlier partial response.
+        // This chunk might complete an earlier partial response. Protect against unbounded response attack.
+        if (this._partialResponse.length + chunk.length > maxControlResponseLength) {
+            this.closeWithError(new Error("FTP control response exceeded maximum allowed size"));
+            return;
+        }
         const completeResponse = this._partialResponse + chunk;
@@ -282,0 +288,0 @@ const parsed = (0, parseControlResponse_1.parseControlResponse)(completeResponse);

package.json

 {
   "name": "basic-ftp",
-  "version": "5.3.0",
+  "version": "5.3.1",
   "description": "FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.",
@@ -45,9 +45,9 @@ "main": "dist/index",
     "@types/node": "25.6.0",
-    "@typescript-eslint/eslint-plugin": "8.58.2",
-    "@typescript-eslint/parser": "8.58.2",
-    "eslint": "10.2.0",
+    "@typescript-eslint/eslint-plugin": "8.59.1",
+    "@typescript-eslint/parser": "8.59.1",
+    "eslint": "10.2.1",
     "globals": "17.5.0",
     "mocha": "11.7.5",
-    "typescript": "6.0.2"
+    "typescript": "6.0.3"
   }
 }

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

139468

0.25%

Lines of code

3098

0.19%

No dependency changes