Skip to content

Promise.delay and Promise.is do not work as expected in v3.0.0

High
evaera published GHSA-mq7h-vf5c-52f4 Aug 24, 2020

Package

roblox-lua-promise (roblox)

Affected versions

v3.0.0

Patched versions

v3.0.1

Description

Impact

Promise.delay's internal thread scheduler has a bug in v3.0.0 that can cause Promise.delay to error which can interrupt the Promise chain with errors escaping the Promise library.

Promise.is would return false for Promises created with roblox-lua-promise@v2 which would break some APIs when passing Promises to things like Promise.all.

Patches

Upgrade to version v3.0.1 which fixes these issues.

Workarounds

There are no good ways to work around these issues.

Severity

High

CVE ID

No known CVE

Weaknesses

No CWEs