view_component 2.43.1

2 security vulnerabilities found in version 2.43.1

XSS via translate method of ViewComponent::Translatable in view_component gem

high severity CVE-2022-24722
high severity CVE-2022-24722
Patched versions: >= 2.49.1, ~> 2.31.2
Unaffected versions: < 2.31.0

This is an XSS vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the translate method is not properly sanitized before display.

Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability.

Avoid passing user input to the translate function, or sanitize the inputs before passing them.

view_component Cross-site Scripting vulnerability

medium severity CVE-2024-21636
medium severity CVE-2024-21636
Patched versions: ~> 2.83.0, >= 3.9.0

Impact

What kind of vulnerability is it? Who is impacted?

This is an XSS vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a #call method (i.e. instead of using a sidecar template) are affected. The return value of the #call method is not sanitized and can include user-defined content.

In addition, the return value of the #output_postamble method is not sanitized, which can also lead to XSS issues.

Patches

Has the problem been patched? What versions should users upgrade to?

Versions 3.9.0 has been released and fully mitigates both the #call and the #output_postamble vulnerabilities.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Sanitize the return value of #call, eg:

class MyComponent < ApplicationComponent
  def call
    html_escape("<div>#{user_input}</div>")
  end
end

References

Are there any links users can visit to find out more?

https://github.com/ViewComponent/view_component/pull/1950

For more information

If you have any questions or comments about this advisory:

Open an issue in the github/view_component project.

No officially reported memory leakage issues detected.


This gem version does not have any officially reported memory leaked issues.

No license issues detected.


This gem version has a license in the gemspec.

This gem version is available.


This gem version has not been yanked and is still available for usage.