Does node.js Tiddlywiki use the express.js library?

[leeand00]

Security Alert regarding express.js:

https://www.bleepingcomputer.com/news/security/nodejs-module-downloaded-7m-times-lets-hackers-inject-code/

I would think that tiddlywiki does use this library (and about a million other projects...), so I just thought I ought to make people aware of it.

[PMario]

Hi,

TiddlyWiki is self contained. see: https://github.com/Jermolene/TiddlyWiki5/blob/master/package.json#L26 which shows that it doesn't use any 3rd party libs by default.

TW also doesn't use express-file-upload or the EJS templating engine, because TW has its own templates.

So there isn't a problem as mentioned with the TW server commands! .....

BUT this doesn't mean that other TW server approaches (or plugins) don't use the mentioned elements.

-m

[Mark S.]

Since it relates to file uploads, it seems like standard issue TW is probably OK. I can't think of any TW projects that do uploads except possibly tiddlyserver and Bob. But since these shouldn't be used (in general) on the open internet, that shouldn't be a problem for most people. NoteSelf might do uploading, but my scan of the code couldn't find "express" so hopefully it's OK.

[TW Tones]

Mark,

But I would like the opportunity to configure uploads in some cases :)

Is that too much to ask?

Regards

Tony