[Security] Bump markdown-to-jsx from 6.10.3 to 6.11.4 in /webapp

Review changes
Download
Patches
Plain diff

Merged [Security] Bump markdown-to-jsx from 6.10.3 to 6.11.4 in /webapp

dependabot/npm_and_yarn/webapp/markdown-to-jsx-6.11.4 into master

Overview 2
Commits 1
Pipelines 0
Changes 1

Merged Hannes Heine requested to merge dependabot/npm_and_yarn/webapp/markdown-to-jsx-6.11.4 into master 4 years ago

Overview 2
Commits 1
Pipelines 0
Changes 1

Created by: dependabot-preview[bot]

Bumps markdown-to-jsx from 6.10.3 to 6.11.4. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Cross-Site Scripting in markdown-to-jsx Versions of markdown-to-jsx prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing data or VBScript URIs and a base64-encoded payload.

Recommendation

Upgrade to version 6.11.4 or later.

Affected versions: < 6.11.4

Release notes

Sourced from markdown-to-jsx's releases.

6.11.4: Mitigates security vulnerability where maliciously crafted markdown links could use data: or vbscript: urls to trigger an xss injection ( #306 / https://www.npmjs.com/advisories/1219 ), even when using options.disableParsingRawHTML

Note that currently, the default options.disableParsingRawHTML = false should still only be used for trusted input, as arbitrary html, including script tags.

6.11.3 has no changes (I held the publish script upside down; the only change from 6.11.2 is the version number )

6.11.2

[FIX] - Footnote references (#304) thanks @csantos1113

6.11.1

Fix: Support empty style attribute (#296) thanks @cribbles

6.11.0

Optionally disable HTML parsing (#278)

Fix HTML multiline comments bug (#246) (#262)

Commits

0d2ddc0 v6.11.4
105d6a6 XSS: Fix sanitizeUrl vbscript/data xss
8dfbc86 Create CONTRIBUTING.md
47f0bb1 v6.11.2
66e2567 [FIX] - Footnote references (#304)
b653c7a v6.11.1
9e81850 Bump codecov from 3.6.4 to 3.6.5 (#287)
bf3ad94 Bump acorn from 5.7.3 to 5.7.4 (#294)
8939f6f Fix: Support empty style attribute (#296)
be04c33 Update README.md
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ariabuckles, a new releaser for markdown-to-jsx since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)
Pull request limits (per update run and/or open at any time)
Out-of-range updates (receive only lockfile updates, if desired)
Security updates (receive only security updates, if desired)

Merge request reports

Activity

Filter activity

Approvals
Assignees & reviewers
Comments (from bots)
Comments (from users)
Commits & branches
Edits
Labels
Lock status
Mentions
Merge request status
Tracking

Please register or sign in to reply

0 Assignees

None

Select assignees

0 Reviewers

None

Request review from

Labels

dependencies javascript security

Select labels

Manage project labels

Milestone

None

Time tracking

No estimate or time spent

1 Participant

There are currently no pipelines.

To run a merge request pipeline, the jobs in the CI/CD configuration file must be configured to run in merge request pipelines and you must have sufficient permissions in the source project.