2017/10/GHSA-9h36-4jf2-hx53 extlib does not properly restrict casts of string values