apostrophe 3.40.1 → 3.40.2-alpha

package/CHANGELOG.md

@@ -1,8 +1,21 @@
 # Changelog
 
+## UNRELEASED
+
+### Fixes
+
+* Replace `deep-get-set` dependency with `lodash`'s `get` and `set` functions to fix the [Prototype Pollution in deep-get-set](https://github.com/advisories/GHSA-mjjj-6p43-vhhv) vulnerability. There was no actual vulnerability in Apostrophe due to the way the module was actually used, and this was done to address vulnerability scan reports.
+* The "soft redirects" for former URLs of documents now work better with localization. Thanks to [Waldemar Pankratz](https://github.com/waldemar-p).
+* Destroy `AreaEditor` Vue apps when the page content is refreshed in edit mode. This avoids a leak of Vue apps components being recreated while instances of old ones are still alive.
+
+### Security
+
+* Upgrades passport to the latest version in order to ensure session regeneration when logging in or out. This adds additional security to logins by mitigating any risks due to XSS attacks. Apostrophe is already robust against XSS attacks. For passport methods that are internally used by Apostrophe everything is still working. For projects that are accessing the passport instance directly through `self.apos.login.passport`, some verifications may be necessary to avoid any compatibility issue. The internally used methods are `authenticate`, `use`, `serializeUser`, `deserializeUser`, `initialize`, `session`.
+
 ## 3.40.1 (2023-02-18)
 
 * No code change. Patch level bump for package update.
+
 ## 3.40.0 (2023-02-17)
 
 ### Adds

package/modules/@apostrophecms/admin-bar/ui/apos/components/TheAposContextBar.vue

@@ -291,7 +291,7 @@ export default {
         }, 1100);
       }
     },
-    async onPublish(e) {
+    async onPublish() {
       if (!this.canPublish) {
         const submitted = await this.submitDraft(this.context);
         if (submitted) {
@@ -505,7 +505,20 @@ export default {
       }
     },
     async refresh(options = {}) {
-      let url = window.location.href;
+      const refreshable = document.querySelector('[data-apos-refreshable]');
+      if (options.scrollcheck) {
+        window.apos.adminBar.scrollPosition = {
+          x: window.scrollX,
+          y: window.scrollY
+        };
+      }
+
+      if (!refreshable) {
+        apos.bus.$emit('refreshed');
+        this.rememberLastBaseContext();
+        return;
+      }
+
       const qs = {
         ...apos.http.parseQuery(window.location.search),
         aposRefresh: '1',
@@ -514,7 +527,7 @@ export default {
           aposEdit: '1'
         } : {})
       };
-      url = apos.http.addQueryToUrl(url, qs);
+      const url = apos.http.addQueryToUrl(window.location.href, qs);
       const content = await apos.http.get(url, {
         qs,
         headers: {
@@ -523,39 +536,30 @@ export default {
         draft: true,
         busy: true
       });
-      const refreshable = document.querySelector('[data-apos-refreshable]');
 
-      if (options.scrollcheck) {
-        window.apos.adminBar.scrollPosition = {
-          x: window.scrollX,
-          y: window.scrollY
-        };
-      }
+      refreshable.innerHTML = content;
 
-      if (refreshable) {
-        refreshable.innerHTML = content;
-        if (this.editMode && (!this.original)) {
-          // the first time we enter edit mode on the page, we need to
-          // establish a baseline for undo/redo. Use our
-          // "@ notation" PATCH feature. Sort the areas by DOM depth
-          // to ensure parents patch before children
-          this.original = {};
-          const els = Array.from(document.querySelectorAll('[data-apos-area-newly-editable]')).filter(el => el.getAttribute('data-doc-id') === this.context._id);
-          els.sort((a, b) => {
-            const da = depth(a);
-            const db = depth(b);
-            if (da < db) {
-              return -1;
-            } else if (db > da) {
-              return 1;
-            } else {
-              return 0;
-            }
-          });
-          for (const el of els) {
-            const data = JSON.parse(el.getAttribute('data'));
-            this.original[`@${data._id}`] = data;
+      if (this.editMode && (!this.original)) {
+        // the first time we enter edit mode on the page, we need to
+        // establish a baseline for undo/redo. Use our
+        // "@ notation" PATCH feature. Sort the areas by DOM depth
+        // to ensure parents patch before children
+        this.original = {};
+        const els = Array.from(document.querySelectorAll('[data-apos-area-newly-editable]')).filter(el => el.getAttribute('data-doc-id') === this.context._id);
+        els.sort((a, b) => {
+          const da = depth(a);
+          const db = depth(b);
+          if (da < db) {
+            return -1;
+          } else if (db > da) {
+            return 1;
+          } else {
+            return 0;
           }
+        });
+        for (const el of els) {
+          const data = JSON.parse(el.getAttribute('data'));
+          this.original[`@${data._id}`] = data;
         }
       }
       apos.bus.$emit('refreshed');

package/modules/@apostrophecms/area/index.js

@@ -1,5 +1,4 @@
 const _ = require('lodash');
-const deep = require('deep-get-set');
 const { stripIndent } = require('common-tags');
 
 // An area is a series of zero or more widgets, in which users can add
@@ -243,15 +242,15 @@ module.exports = {
 
           const areaRendered = await self.apos.area.renderArea(req, preppedArea, context);
 
-          deep(context, `${path}._rendered`, areaRendered);
-          deep(context, `${path}._fieldId`, undefined);
-          deep(context, `${path}.items`, undefined);
+          _.set(context, [ path, '_rendered' ], areaRendered);
+          _.set(context, [ path, '_fieldId' ], undefined);
+          _.set(context, [ path, 'items' ], undefined);
         }
 
         function findParent(doc, dotPath) {
           const pathSplit = dotPath.split('.');
           const parentDotPath = pathSplit.slice(0, pathSplit.length - 1).join('.');
-          return deep(doc, parentDotPath) || doc;
+          return _.get(doc, parentDotPath, doc);
         }
       },
       // Sanitize an input array of items intended to become
@@ -365,12 +364,12 @@ module.exports = {
           // always okay - unless it already exists
           // and is not an area.
           if (components.length > 1) {
-            const existing = deep(doc, dotPath);
+            const existing = _.get(doc, dotPath);
             if (existing && existing.metaType !== 'area') {
               throw self.apos.error('forbidden');
             }
           }
-          const existingArea = deep(doc, dotPath);
+          const existingArea = _.get(doc, dotPath);
           const existingItems = existingArea && (existingArea.items || []);
           if (_.isEqual(self.apos.util.clonePermanent(items), self.apos.util.clonePermanent(existingItems))) {
             // No real change — don't waste a version and clutter the database.
@@ -378,7 +377,7 @@ module.exports = {
             // nothing has changed. -Tom
             return;
           }
-          deep(doc, dotPath, {
+          _.set(doc, dotPath, {
             metaType: 'area',
             items: items
           });

package/modules/@apostrophecms/area/ui/apos/apps/AposAreas.js

@@ -93,11 +93,12 @@ export default function() {
     const component = window.apos.area.components.editor;
 
     if (apos.area.activeEditor && (apos.area.activeEditor.id === data._id)) {
-      // Editing a piece causes a refresh of the main content area,
-      // but this may contain the area we originally intended to add
-      // a widget to when we created a piece for that purpose. Preserve
-      // the editing experience by restoring that widget's editor to the DOM
-      // rather than creating a new one.
+    // Editing a piece causes a refresh of the main content area,
+    // but this may contain the area we originally intended to add
+    // a widget to when we created a piece for that purpose. Preserve
+    // the editing experience by restoring that widget's editor to the DOM
+    // rather than creating a new one.
+
       el.parentNode.replaceChild(apos.area.activeEditor.$el, el);
     } else {
       return new Vue({
@@ -131,7 +132,7 @@ export default function() {
   }
 
   function createWidgetClipboardApp() {
-    // Headless app to provide simple reactivity for the clipboard state
+  // Headless app to provide simple reactivity for the clipboard state
     apos.area.widgetClipboard = new Vue({
       el: null,
       data: () => {
@@ -149,12 +150,12 @@ export default function() {
           localStorage.setItem('aposWidgetClipboard', JSON.stringify(this.widgetClipboard));
         },
         get() {
-          // If we don't clone, the second paste will be a duplicate key error
+        // If we don't clone, the second paste will be a duplicate key error
           return klona(this.widgetClipboard);
         },
         onStorage() {
-          // When local storage changes, dump the list to
-          // the console.
+        // When local storage changes, dump the list to
+        // the console.
           const contents = window.localStorage.getItem('aposWidgetClipboard');
           if (contents) {
             this.widgetClipboard = JSON.parse(contents);
@@ -164,4 +165,4 @@ export default function() {
     });
   }
 
-};
+}

package/modules/@apostrophecms/area/ui/apos/components/AposAreaEditor.vue

@@ -210,22 +210,24 @@ export default {
     }
   },
   mounted() {
-    apos.bus.$on('area-updated', this.areaUpdatedHandler);
-    apos.bus.$on('widget-hover', this.updateWidgetHovered);
-    apos.bus.$on('widget-focus', this.updateWidgetFocused);
     this.bindEventListeners();
   },
   beforeDestroy() {
-    apos.bus.$off('area-updated', this.areaUpdatedHandler);
-    apos.bus.$off('widget-hover', this.updateWidgetHovered);
-    apos.bus.$off('widget-focus', this.updateWidgetFocused);
     this.unbindEventListeners();
   },
   methods: {
     bindEventListeners() {
+      apos.bus.$on('area-updated', this.areaUpdatedHandler);
+      apos.bus.$on('widget-hover', this.updateWidgetHovered);
+      apos.bus.$on('widget-focus', this.updateWidgetFocused);
+      apos.bus.$on('refreshed', this.destroyParentComponent);
       window.addEventListener('keydown', this.focusParentEvent);
     },
     unbindEventListeners() {
+      apos.bus.$off('area-updated', this.areaUpdatedHandler);
+      apos.bus.$off('widget-hover', this.updateWidgetHovered);
+      apos.bus.$off('widget-focus', this.updateWidgetFocused);
+      apos.bus.$off('refreshed', this.destroyParentComponent);
       window.removeEventListener('keydown', this.focusParentEvent);
     },
     areaUpdatedHandler(area) {
@@ -582,6 +584,11 @@ export default {
         }
       });
       return widget;
+    },
+    destroyParentComponent() {
+      if (!document.body.contains(this.$parent.$el)) {
+        this.$parent.$destroy();
+      }
     }
   }
 };

package/modules/@apostrophecms/soft-redirect/index.js

@@ -21,6 +21,8 @@
 // }
 // ```
 
+const parseurl = require('parseurl');
+
 module.exports = {
   async init(self) {
     self.options.statusCode = self.options.statusCode || 302;
@@ -37,7 +39,7 @@ module.exports = {
     return {
       '@apostrophecms/page:notFound': {
         async notFoundRedirect(req) {
-          const urlPathname = req.url.replace(/\?.*$/, '');
+          const urlPathname = parseurl.original(req).pathname;
 
           const doc = await self.apos.doc
             .find(req, {
@@ -50,9 +52,9 @@ module.exports = {
           if (!(doc && doc._url)) {
             return;
           }
-          if (self.local(doc._url) !== req.url) {
+          if (self.local(doc._url) !== urlPathname) {
             req.statusCode = self.options.statusCode;
-            req.redirect = self.local(doc._url);
+            req.redirect = doc._url;
           }
         }
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apostrophe",
-  "version": "3.40.1",
+  "version": "3.40.2-alpha",
   "description": "The Apostrophe Content Management System.",
   "main": "index.js",
   "scripts": {
@@ -64,7 +64,6 @@
     "cuid": "^2.1.8",
     "dayjs": "^1.9.8",
     "debounce-async": "0.0.2",
-    "deep-get-set": "^1.1.1",
     "dompurify": "^2.3.1",
     "express": "^4.16.4",
     "express-bearer-token": "^2.4.0",
@@ -91,7 +90,8 @@
     "nodemailer": "^6.6.1",
     "nunjucks": "^3.2.1",
     "oembetter": "^1.0.1",
-    "passport": "^0.3.2",
+    "parseurl": "^1.3.3",
+    "passport": "^0.6.0",
     "passport-local": "^1.0.0",
     "path-to-regexp": "^1.8.0",
     "performance-now": "^2.1.0",