Fix: Check all possible version ranges for vulns

webhintio · Mar 7, 2019 · 51f123f · 51f123f
1 parent ad64989
commit 51f123f
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/packages/hint-no-vulnerable-javascript-libraries/src/hint.ts b/packages/hint-no-vulnerable-javascript-libraries/src/hint.ts
@@ -166,9 +166,11 @@ export default class NoVulnerableJavascriptLibrariesHint implements IHint {
                     const version = removeTagsFromVersion(lib.version) /* istanbul ignore next */ || '';
 
                     try {
-                        if (semver.satisfies(version, vuln.semver.vulnerable[0])) {
-                            vulns.push(vuln);
-                        }
+                        vuln.semver.vulnerable.forEach((vulnVersion: string) => {
+                            if (semver.satisfies(version, vulnVersion)) {
+                                vulns.push(vuln);
+                            }
+                        });
                     } catch (e) {
                         logger.error(`Version ${version} of ${lib.name} isn't semver compliant`);
                     }