polyfill.io Library is no longer considered safe to use

Created on 27 June 2024, 5 months ago
Updated 8 July 2024, 4 months ago

The polyfill.io library has been sold to a chinese company named Funnull that is not considered trustworthy. We believe this poses a grave security threat and the library is now considered unsafe.

This Patch work for cloudflare

Problem/Motivation

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

🐛 Bug report
Status

Closed: works as designed

Version

1.59

Component

Code

Created by

🇮🇳India PunamShelke India

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @PunamShelke
  • Issue was unassigned.
  • Status changed to Closed: works as designed 5 months ago
  • 🇩🇰Denmark ressa Copenhagen

    I don't see polyfill mentioned in the module ... Please re-open, if I am mistaken.

  • 🇺🇸United States charlyp805

    I believe that the polyfill.io library is being used in this module because this is the only module that i'm using to display a map. My client got an email from Google saying "Notification Title: [Security Alert]: Polyfill.io Issue for Google Maps Platform users" how can we resolve the issue.

  • 🇩🇰Denmark ressa Copenhagen

    I would expect that it was mentioned ... perhaps you can check all modules for "polyfill.io" with this method? (adjust path)

    $ cd web/modules/contrib/
    $ grep -iR "polyfill.io" .
    
  • 🇮🇹Italy itamair

    @charlyp805 the Geofield module is only able to enable a Geofield field type, and is not providing any functionality for rendering any map ...
    Didn't you realise it yet?

    Probably you are using the Geofield Map or the Leaflet modules (dependent from Geofield module) that have been requiring the external Polyfill.js library.
    Latest versions of both those modules are solving the security issue with the external Polyfill.js library embedding themselves a local copy of that ...

  • 🇺🇸United States charlyp805

    @ressa i didn't find any results, but I don't understand why Google sent the email. Thanks!

  • 🇺🇸United States charlyp805

    @itamair i'm not using the Geofiled Map or Leaflet modules. I am using the Geolocation - Google Maps API module (geolocation submodule). Do you know if that module is actually using the Polyfill.js library? Thanks!

  • 🇩🇰Denmark ressa Copenhagen

    This is the Geofield module, not https://www.drupal.org/project/geolocation . I suggest you check in the Geolocation issue queue, or maybe open a new issue.

Production build 0.71.5 2024