@prenta/core 0.120.0 → 0.120.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +31 -0
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,36 @@
|
|
|
1
1
|
# @actuate-media/cms-core
|
|
2
2
|
|
|
3
|
+
## 0.120.1
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 931e466: Patch sanitize-html and brace-expansion advisories
|
|
8
|
+
|
|
9
|
+
**sanitize-html → ^2.17.5** (GHSA-vccv-cmxp-4j9h). The library applied its
|
|
10
|
+
URI-scheme check to `href` and `src` but not to `action`, `formaction`, `data`,
|
|
11
|
+
`poster` or `background`, so a `javascript:` URI survived in any of those five.
|
|
12
|
+
|
|
13
|
+
This repo's own two call sites were never exposed: neither the default
|
|
14
|
+
allowlist nor the SVG allowlist in `routes/media.ts` permits any of the five
|
|
15
|
+
attributes, nor any of their tags (`form`, `button`, `object`, `video`,
|
|
16
|
+
`body`). But `sanitizeHtml` is exported from `@prenta/core` and takes
|
|
17
|
+
caller-supplied allowlists, so a consumer permitting `video[poster]` inherited
|
|
18
|
+
the hole — which is why the version floor is the fix rather than the config.
|
|
19
|
+
|
|
20
|
+
Pinned by a test written against explicitly-permitted attributes, because
|
|
21
|
+
asserting on the defaults would pass on a vulnerable version: the defaults
|
|
22
|
+
strip these attributes wholesale and never reach the scheme check. Confirmed to
|
|
23
|
+
reproduce on 2.17.4 (five of the five vulnerable, `href`/`src` already safe)
|
|
24
|
+
and to be closed on the installed 2.17.6.
|
|
25
|
+
|
|
26
|
+
**brace-expansion → ^1.1.18 / ^5.0.9** (GHSA-rgw5-rvv9-x895,
|
|
27
|
+
GHSA-mh99-v99m-4gvg). Development-scope only, reached through `minimatch`
|
|
28
|
+
alone. Overrides for these already existed but their range keys had been
|
|
29
|
+
outrun: `brace-expansion@>=1.0.0 <1.1.13` no longer matches the 1.1.16 that
|
|
30
|
+
`^1.1.13` resolves to, and the 5.x key had the same problem at 5.0.8. An
|
|
31
|
+
override whose key stops matching silently stops overriding, so both keys now
|
|
32
|
+
name the current vulnerable ranges.
|
|
33
|
+
|
|
3
34
|
## 0.120.0
|
|
4
35
|
|
|
5
36
|
### Minor Changes
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@prenta/core",
|
|
3
|
-
"version": "0.120.
|
|
3
|
+
"version": "0.120.1",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -186,7 +186,7 @@
|
|
|
186
186
|
"@prisma/client": "^7.8.0",
|
|
187
187
|
"arctic": "^3.5.0",
|
|
188
188
|
"jose": "^6.0.0",
|
|
189
|
-
"sanitize-html": "^2.17.
|
|
189
|
+
"sanitize-html": "^2.17.5",
|
|
190
190
|
"sharp": "^0.35.0",
|
|
191
191
|
"turndown": "^7.2.4",
|
|
192
192
|
"yjs": "^13.6.0",
|