Cookies values with "j:" prefix should not be parsed as JSON by default

Question

efernandesng opened this issue 5 years ago · comments

Hi!

redacted

Douglas Wilson · Answer 1 · Thu Feb 20 2020 05:05:01 GMT+0800 (China Standard Time)

Hi @efernandesng if you are reporting a security issue, please follow our policy for Express at https://github.com/expressjs/express/blob/master/Security.md

Emanuel Fernandes · Answer 2 · Thu Feb 20 2020 05:07:50 GMT+0800 (China Standard Time)

@dougwilson, sorry :)
I do not found your e-mail address to send you a report, anyway, you're already notified :)

Douglas Wilson · Answer 3 · Thu Feb 20 2020 05:36:29 GMT+0800 (China Standard Time)

Hi @efernandesng it's ok, no problem :) Really just for the future, as of course I already got it from here 👍 . My email address should be readily visible, like in https://github.com/expressjs/express/blob/master/package.json#L9 , https://github.com/expressjs/express/blob/master/LICENSE#L5 , etc. I see your email, would you like me to email you with updates at all?

Emanuel Fernandes · Answer 4 · Thu Feb 20 2020 05:47:09 GMT+0800 (China Standard Time)

Yes, please.
Thank you!