Skip to content

Commit 2dc7263

Browse files
KeesTuckerKeesTucker
authored
Merge pull request #12 from linc-technologies/bugfix/HERO-10791-cves-everywhere-all-at-once-pt-4
HERO-10791: cves everywhere all at once pt 4
2 parents cc35792 + bac80d9 commit 2dc7263

File tree

3 files changed

+67
-60
lines changed

3 files changed

+67
-60
lines changed

‎package.json

+4-2
Original file line numberDiff line numberDiff line change
@@ -88,9 +88,11 @@
8888
"webpack-dev-server": "^4.11.0"
8989
},
9090
"resolutions": {
91-
"cross-spawn": "7.0.5",
9291
"body-parser": "1.20.3",
9392
"braces": "3.0.3",
94-
"tar": "^6.2.0"
93+
"cross-spawn": "7.0.5",
94+
"path-to-regexp": "^0.1.12",
95+
"tar": "^6.2.0",
96+
"ws": "^8.17.1"
9597
}
9698
}

‎patches/dompurify+3.0.5.patch ‎patches/dompurify+3.2.4.patch

+55-45
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,50 @@
1-
diff --git a/node_modules/dompurify/dist/purify.es.js b/node_modules/dompurify/dist/purify.es.js
2-
index ee9246e..d297e22 100644
3-
--- a/node_modules/dompurify/dist/purify.es.js
4-
+++ b/node_modules/dompurify/dist/purify.es.js
5-
@@ -1190,6 +1190,7 @@ function createDOMPurify() {
6-
namespaceURI
1+
diff --git a/node_modules/dompurify/dist/purify.es.mjs b/node_modules/dompurify/dist/purify.es.mjs
2+
index 86186cf..710e443 100644
3+
--- a/node_modules/dompurify/dist/purify.es.mjs
4+
+++ b/node_modules/dompurify/dist/purify.es.mjs
5+
@@ -1054,6 +1054,7 @@ function createDOMPurify() {
76
} = attr;
8-
value = name === 'value' ? attr.value : stringTrim(attr.value);
7+
const lcName = transformCaseFunc(name);
8+
let value = name === 'value' ? attrValue : stringTrim(attrValue);
99
+ const initValue = value;
10-
lcName = transformCaseFunc(name);
1110
/* Execute a hook if present */
12-
13-
@@ -1209,11 +1210,11 @@ function createDOMPurify() {
11+
hookEvent.attrName = lcName;
12+
hookEvent.attrValue = value;
13+
@@ -1080,9 +1081,10 @@ function createDOMPurify() {
14+
continue;
15+
}
1416
/* Remove attribute */
15-
16-
1717
- _removeAttribute(name, currentNode);
18+
+ /* (Removal deferred until after hook check) */
1819
/* Did the hooks approve of the attribute? */
19-
20-
2120
if (!hookEvent.keepAttr) {
2221
+ _removeAttribute(name, currentNode);
2322
continue;
2423
}
2524
/* Work around a security issue in jQuery 3.0 */
26-
@@ -1238,6 +1239,7 @@ function createDOMPurify() {
25+
@@ -1099,6 +1101,7 @@ function createDOMPurify() {
26+
/* Is `value` valid for this attribute? */
2727
const lcTag = transformCaseFunc(currentNode.nodeName);
28-
2928
if (!_isValidAttribute(lcTag, lcName, value)) {
3029
+ _removeAttribute(name, currentNode);
3130
continue;
3231
}
33-
/* Full DOM Clobbering protection via namespace isolation,
34-
@@ -1274,17 +1276,18 @@ function createDOMPurify() {
32+
/* Handle attributes that require Trusted Types */
33+
@@ -1119,19 +1122,22 @@ function createDOMPurify() {
34+
}
3535
}
3636
/* Handle invalid data-* attribute set by try-catching it */
37-
38-
-
3937
- try {
4038
- if (namespaceURI) {
4139
- currentNode.setAttributeNS(namespaceURI, name, value);
4240
- } else {
4341
- /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
4442
- currentNode.setAttribute(name, value);
43+
- }
44+
- if (_isClobbered(currentNode)) {
45+
- _forceRemove(currentNode);
46+
- } else {
47+
- arrayPop(DOMPurify.removed);
4548
+ if (value !== initValue) {
4649
+ try {
4750
+ if (namespaceURI) {
@@ -50,60 +53,65 @@ index ee9246e..d297e22 100644
5053
+ /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
5154
+ currentNode.setAttribute(name, value);
5255
+ }
56+
+ if (_isClobbered(currentNode)) {
57+
+ _forceRemove(currentNode);
58+
+ } else {
59+
+ arrayPop(DOMPurify.removed);
60+
+ }
5361
+ } catch (_) {
54-
+ _removeAttribute(name, currentNode);
5562
}
56-
-
57-
- arrayPop(DOMPurify.removed);
5863
- } catch (_) {}
5964
+ }
6065
}
6166
/* Execute a hook if present */
62-
67+
_executeHooks(hooks.afterSanitizeAttributes, currentNode, null);
6368
diff --git a/node_modules/dompurify/dist/purify.js b/node_modules/dompurify/dist/purify.js
64-
index ba807e1..c6512fc 100644
69+
index a03f326..d5d7424 100644
6570
--- a/node_modules/dompurify/dist/purify.js
6671
+++ b/node_modules/dompurify/dist/purify.js
67-
@@ -1196,6 +1196,7 @@
68-
namespaceURI
72+
@@ -1060,6 +1060,7 @@
6973
} = attr;
70-
value = name === 'value' ? attr.value : stringTrim(attr.value);
74+
const lcName = transformCaseFunc(name);
75+
let value = name === 'value' ? attrValue : stringTrim(attrValue);
7176
+ const initValue = value;
72-
lcName = transformCaseFunc(name);
7377
/* Execute a hook if present */
74-
75-
@@ -1215,11 +1216,10 @@
78+
hookEvent.attrName = lcName;
79+
hookEvent.attrValue = value;
80+
@@ -1086,9 +1087,10 @@
81+
continue;
82+
}
7683
/* Remove attribute */
77-
78-
7984
- _removeAttribute(name, currentNode);
85+
+ /* (Initial removal deferred until after hook check) */
8086
/* Did the hooks approve of the attribute? */
81-
82-
-
8387
if (!hookEvent.keepAttr) {
8488
+ _removeAttribute(name, currentNode);
8589
continue;
8690
}
8791
/* Work around a security issue in jQuery 3.0 */
88-
@@ -1244,6 +1244,7 @@
92+
@@ -1105,6 +1107,7 @@
93+
/* Is `value` valid for this attribute? */
8994
const lcTag = transformCaseFunc(currentNode.nodeName);
90-
9195
if (!_isValidAttribute(lcTag, lcName, value)) {
9296
+ _removeAttribute(name, currentNode);
9397
continue;
9498
}
95-
/* Full DOM Clobbering protection via namespace isolation,
96-
@@ -1280,17 +1281,18 @@
99+
/* Handle attributes that require Trusted Types */
100+
@@ -1125,19 +1128,22 @@
101+
}
97102
}
98103
/* Handle invalid data-* attribute set by try-catching it */
99-
100-
-
101104
- try {
102105
- if (namespaceURI) {
103106
- currentNode.setAttributeNS(namespaceURI, name, value);
104107
- } else {
105108
- /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
106109
- currentNode.setAttribute(name, value);
110+
- }
111+
- if (_isClobbered(currentNode)) {
112+
- _forceRemove(currentNode);
113+
- } else {
114+
- arrayPop(DOMPurify.removed);
107115
+ if (value !== initValue) {
108116
+ try {
109117
+ if (namespaceURI) {
@@ -112,13 +120,15 @@ index ba807e1..c6512fc 100644
112120
+ /* Fallback to setAttribute() for browser-unrecognized namespaces e.g. "x-schema". */
113121
+ currentNode.setAttribute(name, value);
114122
+ }
123+
+ if (_isClobbered(currentNode)) {
124+
+ _forceRemove(currentNode);
125+
+ } else {
126+
+ arrayPop(DOMPurify.removed);
127+
+ }
115128
+ } catch (_) {
116-
+ _removeAttribute(name, currentNode);
117129
}
118-
-
119-
- arrayPop(DOMPurify.removed);
120130
- } catch (_) {}
121131
+ }
122132
}
123133
/* Execute a hook if present */
124-
134+
_executeHooks(hooks.afterSanitizeAttributes, currentNode, null);

‎yarn.lock

+8-13
Original file line numberDiff line numberDiff line change
@@ -9916,10 +9916,10 @@ path-scurry@^1.10.1, path-scurry@^1.6.1:
99169916
lru-cache "^9.1.1 || ^10.0.0"
99179917
minipass "^5.0.0 || ^6.0.2 || ^7.0.0"
99189918

9919-
[email protected]:
9920-
version "0.1.7"
9921-
resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.7.tgz#df604178005f522f15eb4490e7247a1bfaa67f8c"
9922-
integrity sha512-5DFkuoqlv1uYQKxy8omFBeJPQcdoE07Kv2sferDCrAq1ohOU+MSDswDIbnx3YAM60qIOnYa53wBhXW0EbMonrQ==
9919+
[email protected], path-to-regexp@^0.1.12:
9920+
version "0.1.12"
9921+
resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.12.tgz#d5e1a12e478a976d432ef3c58d534b9923164bb7"
9922+
integrity sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==
99239923

99249924
path-type@^1.0.0:
99259925
version "1.1.0"
@@ -13126,15 +13126,10 @@ [email protected]:
1312613126
type-fest "^0.4.1"
1312713127
write-json-file "^3.2.0"
1312813128

13129-
[email protected]:
13130-
version "8.13.0"
13131-
resolved "https://registry.yarnpkg.com/ws/-/ws-8.13.0.tgz#9a9fb92f93cf41512a0735c8f4dd09b8a1211cd0"
13132-
integrity sha512-x9vcZYTrFPC7aSIbj7sRCYo7L/Xb8Iy+pW0ng0wt2vCJv7M9HOMy0UoN3rr+IFC7hb7vXoqS+P9ktyLLLhO+LA==
13133-
13134-
ws@^8.13.0, ws@^8.8.0:
13135-
version "8.16.0"
13136-
resolved "https://registry.yarnpkg.com/ws/-/ws-8.16.0.tgz#d1cd774f36fbc07165066a60e40323eab6446fd4"
13137-
integrity sha512-HS0c//TP7Ina87TfiPUz1rQzMhHrl/SG2guqRcTOIUYD2q8uhUdNHZYJUaQ8aTGPzCh+c6oawMKW35nFl1dxyQ==
13129+
[email protected], ws@^8.13.0, ws@^8.17.1, ws@^8.8.0:
13130+
version "8.18.1"
13131+
resolved "https://registry.yarnpkg.com/ws/-/ws-8.18.1.tgz#ea131d3784e1dfdff91adb0a4a116b127515e3cb"
13132+
integrity sha512-RKW2aJZMXeMxVpnZ6bck+RswznaxmzdULiBr6KY7XkTnW8uvt0iT9H5DkHUChXrc+uurzwa0rVI16n/Xzjdz1w==
1313813133

1313913134
xml-writer@^1.6.0, xml-writer@~1.7.0:
1314013135
version "1.7.0"

0 commit comments

Comments
 (0)