Skip to content

[Security] Bump sanitize-html from 1.22.1 to 2.3.2 in /backend

Hannes Heine requested to merge dependabot/npm_and_yarn/backend/sanitize-html-2.3.2 into master

Created by: dependabot-preview[bot]

⚠️ Dependabot Preview has been deactivated ⚠️

This pull request was created by Dependabot Preview, and you've upgraded to Dependabot. This means it won't respond to dependabot commands nor will it be automatically closed if a new version is found.

If you close this pull request, Dependabot will re-create it the next time it checks for updates and everything will work as expected.

Bumps sanitize-html from 1.22.1 to 2.3.2. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Improper Input Validation in sanitize-html Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\example.com".

Affected versions: < 2.3.2

Sourced from The GitHub Security Advisory Database.

Improper Input Validation in sanitize-html Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.

Affected versions: < 2.3.1

Changelog

Sourced from sanitize-html's changelog.

2.3.2 (2021-01-26):

  • Additional fixes for iframe validation exploits. Prevent exploits based on browsers' tolerance of the use of "" rather than "/" and the presence of whitespace at this point in the URL. Thanks to Ron Masas of Checkmarx for pointing out the issue and writing unit tests.
  • Updates README yarn add syntax. Thanks to Tagir Khadshiev for the contribution.

2.3.1 (2021-01-22):

  • Uses the standard WHATWG URL parser to stop IDNA (Internationalized Domain Name) attacks on the iframe hostname validator. Thanks to Ron Masas of Checkmarx for pointing out the issue and suggesting the use of the WHATWG parser.

2.3.0 (2020-12-16):

  • Upgrades htmlparser2 to new major version ^6.0.0. Thanks to Bogdan Chadkin for the contribution.

2.2.0 (2020-12-02):

  • Adds a note to the README about Typescript support (or the lack-thereof).
  • Adds tel to the default allowedSchemes. Thanks to Arne Herbots for this contribution.

2.1.2 (2020-11-04):

  • Fixes typos and inconsistencies in the README. Thanks to Eric Lefevre-Ardant for this contribution.

2.1.1 (2020-10-21):

  • Fixes a bug when using allowedClasses with an '*' wildcard selector. Thanks to Clemens Damke for this contribution.
  • Updates mocha to 7.x to resolve security warnings.

2.1.0 (2020-10-07):

  • sup added to the default allowed tags list. Thanks to Julian Lam for the contribution.
  • Updates default allowedTags README documentation. Thanks to Marco Arduini for the contribution.

2.0.0 (2020-09-23):

  • nestingLimit option added.
  • Updates ESLint config package and fixes warnings.
  • Upgrade is-plain-object package with named export. Thanks to Bogdan Chadkin for the contribution.
  • Upgrade postcss package and drop Node 11 and Node 13 support (enforced by postcss).

Backwards compatibility breaks:

  • There is no build. You should no longer directly link to a sanitize-html file directly in the browser as it is using modern Javascript that is not fully supported by all major browsers (depending on your definition). You should now include sanitize-html in your project build for this purpose if you have one.
  • On the server side, Node.js 10 or higher is required.
  • The default allowedTags array was updated significantly. This mostly added HTML tags to be more comprehensive by default. You should review your projects and consider the allowedTags defaults if you are not already overriding them.

2.0.0-rc.2 (2020-09-09):

  • Always use existing has function rather than duplicating it.

2.0.0-rc.1 (2020-08-26):

  • Upgrade klona package. Thanks to Bogdan Chadkin for the contribution.

2.0.0-beta.2:

  • Add files to package.json to prevent publishing unnecessary files to npm #392. Thanks to styfle for the contribution.
  • Removes iframe and nl from default allowed tags. Adds most innocuous tags to the default allowedTags array.
  • Fixes a bug when using transformTags with out textFilter. Thanks to Andrzej Porebski for the help with a failing test.

2.0.0-beta:

  • Moves the index.js file to the project root and removes all build steps within the package. Going forward, it is up to the developer to include sanitize-html in their project builds as-needed. This removes major points of conflict with project code and frees this module to not worry about myriad build-related questions.

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

Merge request reports