March 2017 Summaries

The qs package is a widely used npm library for parsing querystring parameters into objects, enabling advanced functionality such as creating nested objects within query strings. However, this functionality also brings risk, including the potential to overwrite properties in an object's prototype. A high-severity vulnerability was discovered and fixed by the package owner, with multiple versions of the library released to address the issue. To mitigate the vulnerability, users must update to a newer version of the qs package, which includes a more robust fix that prevents attackers from overriding the object's prototype properties.

The text discusses memory leaks in Python programs, specifically using the `tracemalloc` tool to diagnose and fix issues. The author shares their experience with finding a memory leak in a Python component of the Fugue cloud security SaaS product, which was caused by the use of the `requests` package. They demonstrate how to use `tracemalloc` to track memory usage, identify problematic allocations, and filter out noise. The article concludes that while `tracemalloc` is a powerful tool, finding memory leaks in Python often requires a combination of technical expertise and analysis, rather than just relying on the tool itself.