Головна сторінка Огляд Довідка
Увійти
yunoadmin
/
bambuddy
дзеркало https://github.com/maziggy/bambuddy
1
0
Відгалуження 0
Файли Проблеми 0 Wiki
Переглянути джерело

security(frontend): bump linkify-it and dompurify to patched releases

npm audit flagged both against the production dependency tree, and the
Frontend Security job fails on any fixable high-severity finding there
(FIXABLE HIGH: linkify-it).

linkify-it 5.0.1 -> 5.0.2 (GHSA-v245-v573-v5vm, high, CVSS 7.5) fixes a
quadratic-complexity DoS in the mailto: validator scan loop. It reaches us
only through prosemirror-markdown inside @tiptap/pm; the editor's own
autolinking uses linkifyjs, which is a different package and unaffected.
Nothing under frontend/src/ imports prosemirror-markdown or markdown-it and
neither appears in the production bundle, so the vulnerable code is tree-
shaken out and no running install was exposed.

dompurify 3.4.11 -> 3.4.12 (GHSA-c2j3-45gr-mqc4, low) fixes a
CUSTOM_ELEMENT_HANDLING bypass of afterSanitizeElements for allowed custom
elements. DOMPurify is shipped, but we never set CUSTOM_ELEMENT_HANDLING and
register no afterSanitizeElements hook, so the bypass has no precondition;
ProjectPageModal additionally passes a strict ALLOWED_TAGS/ALLOWED_ATTR
allowlist.

Both patched versions already satisfy the ranges their parents declare, so
this is a lockfile-only change - no overrides entry needed, package.json
untouched. npm audit reports zero vulnerabilities, npm run build is clean,
and all 2423 frontend tests pass.
maziggy 1 місяць тому
батько
657958a67d
коміт
4f5bbde7de
3 змінених файлів з 7 додано та 7 видалено
Об'єднаний вигляд Показати статистику Diff
  1. 6 6
      frontend/package-lock.json
  2. 0 0
      static/assets/index-DMXg01ou.js
  3. 1 1
      static/index.html

+ 6 - 6
frontend/package-lock.json
Переглянути файл 

@@ -4220,9 +4220,9 @@
 
       "peer": true
 
       "peer": true
 
     },
 
     },
 
     "node_modules/dompurify": {
 
     "node_modules/dompurify": {
 
-      "version": "3.4.11",
 
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.11.tgz",
 
-      "integrity": "sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==",
 
+      "version": "3.4.12",
 
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz",
 
+      "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==",
 
       "optionalDependencies": {
 
       "optionalDependencies": {
 
         "@types/trusted-types": "^2.0.7"
 
         "@types/trusted-types": "^2.0.7"
 
       }
 
       }
 
@@ -5818,9 +5818,9 @@
 
       "license": "MIT"
 
       "license": "MIT"
 
     },
 
     },
 
     "node_modules/linkify-it": {
 
     "node_modules/linkify-it": {
 
-      "version": "5.0.1",
 
-      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.1.tgz",
 
-      "integrity": "sha512-wVoTjP4Q6R0NW5hiZkVJaFZPWgtXfoGF+6LucL3/FtiNjmcHhYjEr5f1Kqjirc1nBW07J/ZuRFumqr2oqccEWg==",
 
+      "version": "5.0.2",
 
+      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.2.tgz",
 
+      "integrity": "sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==",
 
       "funding": [
 
       "funding": [
 
         {
 
         {
 
           "type": "github",
 
           "type": "github",

Різницю між файлами не показано, бо вона завелика
+ 0 - 0
static/assets/index-DMXg01ou.js


+ 1 - 1
static/index.html
Переглянути файл 

@@ -26,7 +26,7 @@
 
 
 
     <!-- Splash screens for iOS -->
 
     <!-- Splash screens for iOS -->
 
     <link rel="apple-touch-startup-image" href="/img/android-chrome-512x512.png" />
 
     <link rel="apple-touch-startup-image" href="/img/android-chrome-512x512.png" />
 
-    <script type="module" crossorigin src="/assets/index-tuTcZo3j.js"></script>
 
+    <script type="module" crossorigin src="/assets/index-DMXg01ou.js"></script>
 
     <link rel="stylesheet" crossorigin href="/assets/index-kl51qImb.css">
 
     <link rel="stylesheet" crossorigin href="/assets/index-kl51qImb.css">
 
   </head>
 
   </head>
 
   <body>
 
   <body>

Деякі файли не було показано, через те що забагато файлів було змінено