Program: CWE-918
Project: CVE-2022-0086
Buggy source:
{
  "name": "@uppy/companion",
  "version": "3.1.4",
  "description": "OAuth helper and remote fetcher for Uppy's (https://uppy.io) extensible file upload widget with support for drag&drop, resumable uploads, previews, restrictions, file processing/encoding, remote providers like Dropbox and Google Drive, S3 and more :dog:",
  "main": "lib/companion.js",
  "types": "lib/companion.d.ts",
  "author": "Transloadit.com",
  "license": "ISC",
  "homepage": "https://github.com/transloadit/uppy#readme",
  "repository": {
    "type": "git",
    "url": "git+https://github.com/transloadit/uppy.git"
  },
  "keywords": [
    "file uploader",
    "progress",
    "preview",
    "resumable uploads",
    "tus",
    "s3",
    "google drive",
    "dropbox",
    "box",
    "backend",
    "websocket",
    "express",
    "realtime"
  ],
  "bin": "./bin/companion",
  "dependencies": {
    "@purest/providers": "1.0.1",
    "atob": "2.1.2",
    "aws-sdk": "^2.1038.0",
    "body-parser": "1.19.0",
    "chalk": "2.4.2",
    "common-tags": "1.8.0",
    "connect-redis": "4.0.3",
    "cookie-parser": "1.4.6",
    "cors": "^2.8.5",
    "escape-string-regexp": "2.0.0",
    "express": "4.17.1",
    "express-interceptor": "1.2.0",
    "express-prom-bundle": "6.3.0",
    "express-request-id": "1.4.1",
    "express-session": "1.17.1",
    "grant": "4.7.0",
    "helmet": "^4.6.0",
    "ip-address": "6.2.0",
    "isobject": "3.0.1",
    "jsonwebtoken": "8.5.1",
    "lodash.merge": "^4.6.2",
    "mime-types": "2.1.25",
    "moment": "^2.29.1",
    "moment-timezone": "^0.5.31",
    "morgan": "1.10.0",
    "ms": "2.1.2",
    "node-redis-pubsub": "4.0.0",
    "node-schedule": "1.3.2",
    "prom-client": "12.0.0",
    "purest": "3.1.0",
    "redis": "3.1.1",
    "request": "2.88.2",
    "semver": "6.3.0",
    "serialize-error": "^2.1.0",
    "serialize-javascript": "^6.0.0",
    "tus-js-client": "2.1.1",
    "uuid": "8.1.0",
    "validator": "^12.1.0",
    "ws": "6.2.2"
  },
  "devDependencies": {
    "@types/compression": "1.7.0",
    "@types/connect-redis": "0.0.17",
    "@types/cookie-parser": "1.4.2",
    "@types/cors": "2.8.6",
    "@types/eslint": "^8.2.0",
    "@types/express-session": "1.17.3",
    "@types/jsonwebtoken": "8.3.7",
    "@types/lodash.merge": "4.6.6",
    "@types/morgan": "1.7.37",
    "@types/ms": "0.7.31",
    "@types/node": "12.12.27",
    "@types/react": "^17.0.13",
    "@types/request": "2.48.4",
    "@types/uuid": "3.4.7",
    "@types/webpack": "^5.28.0",
    "@types/ws": "6.0.4",
    "into-stream": "^6.0.0",
    "nock": "^13.1.3",
    "supertest": "3.4.2",
    "typescript": "~4.4"
  },
  "files": [
    "bin/",
    "lib/"
  ],
  "jest": {
    "testEnvironment": "node",
    "testTimeout": 10000,
    "automock": false,
    "collectCoverage": true,
    "collectCoverageFrom": [
      "src/**",
      "!src/**/*.d.ts"
    ]
  },
  "scripts": {
    "build": "tsc -p .",
    "deploy": "kubectl apply -f infra/kube/companion-kube.yml",
    "prepublishOnly": "yarn run build",
    "start": "node ./lib/standalone/start-server.js",
    "test": "bash -c 'source env.test.sh && ../../../node_modules/jest/bin/jest.js'",
    "test:watch": "yarn test -- --watch"
  },
  "engines": {
    "node": ">=10.20.1"
  },
  "installConfig": {
    "hoistingLimits": "workspaces"
  }
}


Fixed version (ground truth):
{
  "name": "@uppy/companion",
  "version": "3.1.4",
  "description": "OAuth helper and remote fetcher for Uppy's (https://uppy.io) extensible file upload widget with support for drag&drop, resumable uploads, previews, restrictions, file processing/encoding, remote providers like Dropbox and Google Drive, S3 and more :dog:",
  "main": "lib/companion.js",
  "types": "lib/companion.d.ts",
  "author": "Transloadit.com",
  "license": "ISC",
  "homepage": "https://github.com/transloadit/uppy#readme",
  "repository": {
    "type": "git",
    "url": "git+https://github.com/transloadit/uppy.git"
  },
  "keywords": [
    "file uploader",
    "progress",
    "preview",
    "resumable uploads",
    "tus",
    "s3",
    "google drive",
    "dropbox",
    "box",
    "backend",
    "websocket",
    "express",
    "realtime"
  ],
  "bin": "./bin/companion",
  "dependencies": {
    "@purest/providers": "1.0.1",
    "atob": "2.1.2",
    "aws-sdk": "^2.1038.0",
    "body-parser": "1.19.0",
    "chalk": "2.4.2",
    "common-tags": "1.8.0",
    "connect-redis": "4.0.3",
    "cookie-parser": "1.4.6",
    "cors": "^2.8.5",
    "escape-string-regexp": "2.0.0",
    "express": "4.17.1",
    "express-interceptor": "1.2.0",
    "express-prom-bundle": "6.3.0",
    "express-request-id": "1.4.1",
    "express-session": "1.17.1",
    "grant": "4.7.0",
    "helmet": "^4.6.0",
    "ipaddr.js": "^2.0.1",
    "isobject": "3.0.1",
    "jsonwebtoken": "8.5.1",
    "lodash.merge": "^4.6.2",
    "mime-types": "2.1.25",
    "moment": "^2.29.1",
    "moment-timezone": "^0.5.31",
    "morgan": "1.10.0",
    "ms": "2.1.2",
    "node-redis-pubsub": "4.0.0",
    "node-schedule": "1.3.2",
    "prom-client": "12.0.0",
    "purest": "3.1.0",
    "redis": "3.1.1",
    "request": "2.88.2",
    "semver": "6.3.0",
    "serialize-error": "^2.1.0",
    "serialize-javascript": "^6.0.0",
    "tus-js-client": "2.1.1",
    "uuid": "8.1.0",
    "validator": "^12.1.0",
    "ws": "6.2.2"
  },
  "devDependencies": {
    "@types/compression": "1.7.0",
    "@types/connect-redis": "0.0.17",
    "@types/cookie-parser": "1.4.2",
    "@types/cors": "2.8.6",
    "@types/eslint": "^8.2.0",
    "@types/express-session": "1.17.3",
    "@types/jsonwebtoken": "8.3.7",
    "@types/lodash.merge": "4.6.6",
    "@types/morgan": "1.7.37",
    "@types/ms": "0.7.31",
    "@types/node": "12.12.27",
    "@types/react": "^17.0.13",
    "@types/request": "2.48.4",
    "@types/uuid": "3.4.7",
    "@types/webpack": "^5.28.0",
    "@types/ws": "6.0.4",
    "into-stream": "^6.0.0",
    "nock": "^13.1.3",
    "supertest": "3.4.2",
    "typescript": "~4.4"
  },
  "files": [
    "bin/",
    "lib/"
  ],
  "jest": {
    "testEnvironment": "node",
    "testTimeout": 10000,
    "automock": false,
    "collectCoverage": true,
    "collectCoverageFrom": [
      "src/**",
      "!src/**/*.d.ts"
    ]
  },
  "scripts": {
    "build": "tsc -p .",
    "deploy": "kubectl apply -f infra/kube/companion-kube.yml",
    "prepublishOnly": "yarn run build",
    "start": "node ./lib/standalone/start-server.js",
    "test": "bash -c 'source env.test.sh && ../../../node_modules/jest/bin/jest.js'",
    "test:watch": "yarn test -- --watch"
  },
  "engines": {
    "node": ">=10.20.1"
  },
  "installConfig": {
    "hoistingLimits": "workspaces"
  }
}