chore(deps): update dependency pymdown-extensions to v10 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pymdown-extensions	9.5 -> 10.0

GitHub Vulnerability Alerts

CVE-2023-32309

Summary

Arbitrary file read when using include file syntax.

Details

By using the syntax --8<--"/etc/passwd" or --8<--"/proc/self/environ" the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to render the content of a file outside the specified base paths: --8<-- "../../../../etc/passwd".

Within the Snippets extension, there exists a base_path option but the implementation is vulnerable to Directory Traversal.
The vulnerable section exists in get_snippet_path(self, path) lines 155 to 174 in snippets.py.

base = "docs"
path = "/etc/passwd"
filename = os.path.join(base,path) # Filename is now /etc/passwd

PoC

import markdown

payload = "--8<-- \"/etc/passwd\""
html = markdown.markdown(payload, extensions=['pymdownx.snippets'])

print(html)

Impact

Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users.

It is never recommended to use Snippets to process user-facing, dynamic content. It is designed to process known content on the backend under the control of the host, but if someone were to accidentally enable it for user-facing content, undesired information could be exposed.

Suggestion

Specified snippets should be restricted to the configured, specified base paths as a safe default. Allowing relative or absolute paths that escape the specified base paths would need to be behind a feature switch that must be opt-in and would be at the developer's own risk.

---

Release Notes

facelessuser/pymdown-extensions (pymdown-extensions)

v10.0

Compare Source

10.0

• Break: Snippets: snippets will restrict snippets to ensure they are under the base_path preventing snippets
  relative to the base_path but not explicitly under it. restrict_base_path can be set to False for legacy
  behavior.

v9.11

Compare Source

9.11

• NEW: Emoji: Update to new CDN and use Twemoji 14.1.2.
• NEW: Snippets: Ignore nested snippet section syntax when including a section.

v9.10

Compare Source

9.10

• NEW: Blocks: Add new experimental general purpose blocks that provide a framework for creating fenced block
  containers for specialized parsing. A number of extensions utilizing general purpose blocks are included and are meant
  to be an alternative to (and maybe one day replace): Admonitions, Details, Definition Lists, and Tabbed. Also adds a
  new HTML plugin for quick wrapping of content with arbitrary HTML elements.
• NEW: Highlight: When enabling line spans and/or line anchors, if a code block has an ID associated with it, line
  ids will be generated using that code ID instead of the code block count.
• NEW: Snippets: Expand section syntax to allow section names with - and _.
• NEW: Snippets: When check_paths is enabled, and a specified section is not found, raise an error.
• NEW: Snippets: Add new experimental feature dedent_sections that will de-indent (remove any common leading
  whitespace from every line in text) from that block of text.
• NEW: MagicLink: Update GitLab links to match recent changes and to be more correct.
• NEW: MagicLink: Relax required hash length when performing link shortening.

v9.9.2

Compare Source

9.9.2

• FIX: Snippets syntax can break in XML comments as XML comments do not allow --. Relax Snippets syntax such that
  -8<- (single -) are allowed.

v9.9.1

Compare Source

9.9.1

• FIX: Use a different CDN for Twemoji icons as MaxCDN is no longer available.

v9.9

Compare Source

9.9

• ENHANCE: BetterEm: Further improvements to strong/emphasis handling:
  • Ensure that one or more consecutive * or _ surrounded by whitespace are not considered as a token.
• ENHANCE: Caret: Apply recent BetterEm improvements to Caret:
  • Fix case where ^^ nested between ^ would be handled in an unexpected way.
  • Ensure that one or more consecutive ^ surrounded by whitespace are not considered as a token.
• ENHANCE: Tilde: Apply recent BetterEm improvements to Tilde:
  • Fix case where ~~ nested between ~ would be handled in an unexpected way.
  • Ensure that one or more consecutive ~ surrounded by whitespace are not considered a token.
• ENHANCE: Mark: Apply recent BetterEm improvements to Mark:
  • Ensure that one or more consecutive = surrounded by whitespace are not considered a token.

v9.8

Compare Source

9.8

• NEW: Formally declare support for Python 3.11.
• FIX: BetterEm: Fix case where ** nested between * would be handled in an unexpected way.

v9.7

Compare Source

9.7

• NEW: Tabbed: Add new syntax to allow forcing a specific tab to be selected by default.
• NEW: Snippets: Add a new option to pass arbitrary HTTP headers.
• NEW: Snippets: Allow specifying sections in a snippet and including just the specified section.

v9.6

Compare Source

9.6

• NEW: Highlight: Allow greater granularity of specifying where language guessing takes place via guess_lang
  option (e.g. block vs inline).
• NEW: Tabbed: Add options for generating tab IDs from tab titles.
• NEW: Snippets: Add support for specifying specific lines for Snippets.
• NEW: Snippets: Commenting out files in block format no longer requires a space directly after ;.
• NEW: Snippets: A new sane way to escape snippets is now available.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.