fix(deps): update dependency highlight.js to v10.4.1 [security] - autoclosed #115
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Codecov Report
@@ Coverage Diff @@
## main #115 +/- ##
=======================================
Coverage 69.64% 69.64%
=======================================
Files 2 2
Lines 56 56
Branches 12 12
=======================================
Hits 39 39
Misses 17 17 Continue to review full report at Codecov.
|
renovate
bot
force-pushed
the
renovate/npm-highlight.js-vulnerability
branch
from
c6bd4fb
to
2d9ab84
Compare
renovate
bot
force-pushed
the
renovate/npm-highlight.js-vulnerability
branch
from
2d9ab84
to
a16ccdc
Compare
renovate
bot
changed the title
|
What needs to be done to get this PR merged and resolve the security issue? |
|
This is an in-range update, so it shouldn't block consumers from updating to the latest version, no? |
|
Sure, but it would be nice if we fix the vulnerability anyway. Are you open for a PR which fixes the test issues? |
|
Sure. |
renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
10.0.2->10.4.1GitHub Vulnerability Alerts
CVE-2020-26237
Impact
Affected versions of this package are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable.
The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector.
If your website or application does not render user provided data it should be unaffected.
Patches
Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.
Workarounds
Patch your library
Manually patch your library to create null objects for both
languagesandaliases:Filter out bad data from end users
Filter the language names that users are allowed to inject into your HTML to guarantee they are valid.
References
For more information
If you have any questions or comments about this advisory:
GHSA-7wwv-vh3v-89cq
Impact: Potential ReDOS vulnerabilities (exponential and polynomial RegEx backtracking)
oswasp:
If are you are using Highlight.js to highlight user-provided data you are possibly vulnerable. On the client-side (in a browser or Electron environment) risks could include lengthy freezes or crashes... On the server-side infinite freezes could occur... effectively preventing users from accessing your app or service (ie, Denial of Service).
This is an issue with grammars shipped with the parser (and potentially 3rd party grammars also), not the parser itself. If you are using Highlight.js with any of the following grammars you are vulnerable. If you are using
highlightAutoto detect the language (and have any of these grammars registered) you are vulnerable.All versions prior to 10.4.1 are vulnerable, including version 9.18.5.
Grammars with exponential backtracking issues:
And of course any aliases of those languages have the same issue. ie:
hppis no safer thancpp.Grammars with polynomial backtracking issues:
And again: any aliases of those languages have the same issue. ie:
rubyandrbshare the same ruby issues.Patches
Workarounds / Mitigations
References
For more information
If you have any questions or comments about this advisory:
Release Notes
highlightjs/highlight.js
v10.4.1Compare Source
Security
Very grateful to Michael Schmidt for all the help.
v10.4.0Compare Source
A largish release with many improvements and fixes from quite a few different contributors. Enjoy!
Deprecations:
requireLanguageis deprecated.getLanguage(with custom error handling) or built-time dependencies.Parser:
beginKeywordssupport (#2813) Josh GoebelclassNameAliasesfor more complex grammars Josh GoebelclassNameAliasesfor more complex grammars Josh GoebelNew Languages:
node-replfor Node.js REPL sessions (#2792) Marat NagayevLanguage Improvements:
~(#2859) Guillaume Grossetie\(#2861) Guillaume Grossetie\[Gamma]#Marcus Ortizsomekeyword Marcus Ortiz@mainattribute Marcus OrtizDev Improvements:
New themes:
v10.3.2Compare Source
Tiny tiny release, just to fix the website incorrectly not listing Javascript
in the list of languages you could choose for a custom build. NPM and CDN
build should not have been affected so 10.3.1 is effectively the same as
10.3.2 for those builds.
If you made a custom build from the website with 10.3 or 10.3.1 you may
want to check and make sure it includes Javascript, and if not, build it again.
v10.3.1Compare Source
Prior version let some look-behind regex sneak in, which does not work
yet on Safari. This release removes those incompatible regexes.
Fix:
v10.3.0Compare Source
Language Improvements:
enum (struct|class)andunion(#2752) Josh Goebel{}inside template literals SUBST expression (#2748) Josh Goebelconstructoris now highlighted as a function title (not keyword) (#2727) Josh Goebel#for private class fields (#2701) Chris Krycho(*)from being detected as a multi-line comment Josh Goebelobjective-c++andobj-c++aliases for Objective-C Josh Goebelrecord(#2685) Josh Goebeltitle(#2683) Josh Goebelfinal) in class declaration (#2696) Josh Goebelmatchkeyword and addphp8as an alias (#2733) Ayesh KarunaratneDeprecations:
useBRoption deprecated and will be removed in v11.0. (#2559) Josh Goebelv10.2.1Compare Source
Parser Engine:
fix(parser) complete fix for resuming matches from same index (#2678) Josh Goebel
Josh Goebel: https://github.com/yyyc514
v10.2.0Compare Source
Parser Engine:
New themes:
Deprecations:
fixMarkupis now deprecated and will be removed in v11.0. (#2534) Josh GoebelBig picture:
Language Improvements:
initandrecordkeywords for C# 9.0 (#2660) Youssef Victorargumentskeyword and fixenumerationkeyword (#2619) Andrew JankegetLanguage(#2636) nightenum, which will identify as aclassnow (#2643) ezksdv10.1.2Compare Source
Fixes:
getLanguage(#2636) nightv10.1.1Compare Source
Fixes:
index.d.ts is not a moduleerror (#2603) Josh Goebelv10.1.0Compare Source
New themes:
Parser Engine:
keywords.$patternkey to grammar definitions (#2519) Josh GoebelregisterAliasesmethod (#2540) Taufik Nurrohmanon:begincallback for modes (#2261) Josh Goebelon:endcallback for modes (#2261) Josh GoebelEND_SAME_AS_BEGINmode to replaceendSameAsBeginparser attribute (#2261) Josh GoebelfixMarkupwould rarely destroy markup whenuseBRwas enabled (#2532) Josh GoebelDeprecations:
htmlbarsgrammar is now deprecated. Usehandlebarsinstead. (#2344) Nils KnappmeierhighlightBlockresult.redeprecated. Useresult.relevanceinstead. (#2552) Josh Goebelresult.second_best.re=>result.second_best.relevance(#2552)lexemesis now deprecated in favor ofkeywords.$patternkey (#2519) Josh GoebelendSameAsBeginis now deprecated. (#2261) Josh GoebelLanguage Improvements:
readonlykeyword (#2562) Martin (Lhoerion)OPTIMIZE:andHACK:to the labels highlighted inside comments Josh Goebelpair,make_pair,priority_queueas built-ins (#2538) Hankun Linpriority_queuepairas cpp containers (#2541) Hankun Linsetkeyword conflicting with setTimeout, etc. (#2514) Vania Kucher=>function with nested()in params now works (#2502) Josh Goebel=>function with nested()in params now works (#2502) Josh Goebel@objcMemberswas being partially highlighted (#2543) Nick Randalllateandrequiredkeywords, theNeverbuilt-in type, and nullable built-in types (#2550) Sam Rawlinsv10.0.3Compare Source
Renovate configuration
📅 Schedule: "" (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻️ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by WhiteSource Renovate. View repository job log here.