Skip to content
This repository was archived by the owner on Jul 19, 2022. It is now read-only.

🚨 [security] Update rails-html-sanitizer: 1.0.4 → 1.4.3 (minor)#91

Open
depfu[bot] wants to merge 1 commit intomasterfrom
depfu/update/rails-html-sanitizer-1.4.3
Open

🚨 [security] Update rails-html-sanitizer: 1.0.4 → 1.4.3 (minor)#91
depfu[bot] wants to merge 1 commit intomasterfrom
depfu/update/rails-html-sanitizer-1.4.3

Conversation

@depfu
Copy link

@depfu depfu bot commented Jun 30, 2022

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ rails-html-sanitizer (indirect, 1.0.4 → 1.4.3) · Repo · Changelog

Security Advisories 🚨

🚨 Possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer

There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.
This vulnerability has been assigned the CVE identifier CVE-2022-32209.

Versions Affected: ALL
Not affected: NONE
Fixed Versions: v1.4.3

Impact

A possible XSS vulnerability with certain configurations of
Rails::Html::Sanitizer may allow an attacker to inject content if the
application developer has overridden the sanitizer's allowed tags to allow
both select and style elements.

Code is only impacted if allowed tags are being overridden. This may be done via application configuration:

# In config/application.rb
config.action_view.sanitized_allowed_tags = ["select", "style"]

see https://guides.rubyonrails.org/configuring.html#configuring-action-view

Or it may be done with a :tags option to the Action View helper sanitize:

<%= sanitize @comment.body, tags: ["select", "style"] %>

see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize

Or it may be done with Rails::Html::SafeListSanitizer directly:

# class-level option
Rails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]

or

# instance-level option
Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])

All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.

Releases

The FIXED releases are available at the normal locations.

Workarounds

Remove either select or style from the overridden allowed tags.

Credits

This vulnerability was responsibly reported by windshock.

Release Notes

1.4.3

1.4.3 / 2022-06-09

  • Address a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

    Prevent the combination of select and style as allowed tags in SafeListSanitizer.

    Fixes CVE-2022-32209

    Mike Dalessio

1.4.2

1.4.2 / 2021-08-23

  • Slightly improve performance.

    Assuming elements are more common than comments, make one less method call per node.

1.4.1

1.4.1 / 2021-08-18

  • Fix regression in v1.4.0 that did not pass comment nodes to the scrubber.

    Some scrubbers will want to override the default behavior and allow comments, but v1.4.0 only
    passed through elements to the scrubber's keep_node? method.

    This change once again allows the scrubber to make the decision on comment nodes, but still skips
    other non-elements like processing instructions (see #115).

    Mike Dalessio

1.4.0

1.4.0 / 2021-08-18

  • Processing Instructions are no longer allowed by Rails::Html::PermitScrubber

    Previously, a PI with a name (or "target") matching an allowed tag name was not scrubbed. There
    are no known security issues associated with these PIs, but similar to comments it's preferred to
    omit these nodes when possible from sanitized output.

    Fixes #115.

    Mike Dalessio

1.3.0

  • Address deprecations in Loofah 2.3.0.

    Josh Goodall

1.2.0

  • Remove needless white_list_sanitizer deprecation.

    By deprecating this, we were forcing Rails 5.2 to be updated or spew
    deprecations that users could do nothing about.

    That's pointless and I'm sorry for adding that!

    Now there's no deprecation warning and Rails 5.2 works out of the box, while
    Rails 6 can use the updated naming.

    Kasper Timm Hansen

1.1.0

  • Add safe_list_sanitizer and deprecate white_list_sanitizer to be removed
    in 1.2.0. #87

    Juanito Fatas

  • Remove href from LinkScrubber's tags as it's not an element.
    #92

    Juanito Fatas

  • Explain that we don't need to bump Loofah here if there's CVEs.
    d4d823c

    Kasper Timm Hansen

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 62 commits:

↗️ crass (indirect, 1.0.3 → 1.0.6) · Repo · Changelog

Release Notes

1.0.6

  • Number values are now limited to a maximum of Float::MAX and a minimum of negative Float::MAX. (#11)

  • Added project metadata to the gemspec. (#9 - @orien)

1.0.5

1.0.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 13 commits:

↗️ loofah (indirect, 2.2.2 → 2.18.0) · Repo · Changelog

Security Advisories 🚨

🚨 Loofah XSS Vulnerability

In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in
sanitized output when a crafted SVG element is republished.

🚨 Loofah XSS Vulnerability

In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

Loofah maintainers have evaluated this as Medium (CVSS3 6.4).

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

👉 No CI detected

You don't seem to have any Continuous Integration service set up!

Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.

This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:

  • Circle CI, Semaphore and Travis-CI are all excellent options.
  • If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github.
  • If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with depfu/.

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Jun 30, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants