Update dependency prismjs to v1.27.0 [SECURITY] #38
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-prismjs-vulnerability
branch
from
98178b0 to
90cddf8
Compare
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-prismjs-vulnerability
branch
from
90cddf8 to
f65de11
Compare
renovate
bot
force-pushed
the
renovate/npm-prismjs-vulnerability
branch
from
f65de11 to
f8ba8d9
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-prismjs-vulnerability
branch
from
f8ba8d9 to
10ee4ec
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-prismjs-vulnerability
branch
from
10ee4ec to
5f2ff97
Compare
Author
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.20.0->1.27.0GitHub Vulnerability Alerts
CVE-2020-15138
Impact
The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer.
This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0).
Patches
This problem is patched in v1.21.0.
Workarounds
To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
References
The vulnerability was introduced by this commit on Sep 29, 2015 and fixed by Masato Kinugawa (#2506).
For more information
If you have any questions or comments about this advisory, please open an issue.
CVE-2021-23341
The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the
prism-asciidoc,prism-rest,prism-tapandprism-eiffelcomponents.CVE-2021-32723
Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).
Impact
When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. Do not use the following languages to highlight untrusted text.
Other languages are not affected and can be used to highlight untrusted text.
Patches
This problem has been fixed in Prism v1.24.
References
CVE-2021-3801
Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU.
CVE-2022-23647
Impact
Prism's Command line plugin can be used by attackers to achieve an XSS attack. The Command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code.
Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted.
Patches
This bug has been fixed in v1.27.0.
Workarounds
Do not use the Command line plugin on untrusted inputs, or sanitized all code blocks (remove all HTML code text) from all code blocks that use the Command line plugin.
References
Release Notes
PrismJS/prism (prismjs)
v1.27.0Compare Source
New components
3f8cc5a0Updated components
bcb2e2c8sectionfromkeywordtoselector(#3305)e46501b9headerforsection(#3304)deb3a97f8458c41f$(#3320)d6c53726441a1422operatorforpunctuation(#3306)2eb89e15Updated plugins
e002e78c1784b17582d0ca15Other
2cc4660bv1.26.0Compare Source
New components
b5a70e4c8476a9abd908e457ec25ba65ef53f021Updated components
\dfor[0-9](#3097)9fe2f93e929c33e0class-namestandard token (#3182)9f5e511dfa540ab7inoalias (#2990)5b7ce5e4c7809285nodeto known commands (#3291)4b19b502vcpkgcommand (#3282)b351bc69dockerandpodmancommands (#3237)8c5ed251d7017bebvariableand minor improvements (#3186)4cebf34cdirectivegreedy (#3112)5c412cbbchartoken (#3207)d85a64aechartoken (#3270)220bc40f9ed4cf6echartoken (#3188)1c88c7da7b34e65da943f2bb2f9672aa51e3ecc0symboltoken name (#3195)6af8a644dafdbdece1370357532212b2propertyforkey; alias withattr-name(#3272)bee6ad56builtinname (#3198)6add768b736c581d336edeeachartoken (#3271)b58cd722ee7ab563operatortoken and added tests (#3114)d359eeaechartoken and improvedstringandnumbertokens (#3208)f11b86e28494519esymbolalias for filter names (#3210)3d410670005ba469f41bcf2381920b623362fc7922d0c6ba0f1b58103d708b9715cb3b78c2afa59b5af16014chartoken (#3217)0a9f909cfa55492bcfb2e782numberpattern (#3149)5a24cbff3b2238fadfbb2020233415b823d9aec1chartoken (#3223)3a876df0baa95cabchartoken and improved string interpolation (#3225)563cd73e6b168a3b05e7ab04defun(#3130)e8f84a6c21a3c2d700f77a2ce9b856c8c6574e6bc1025aa6642d93ec7b72e0adchartoken and made some tokens greedy (#3231)2334b4b675331bea5bf6e35fdc1e808fcommentgreedy (#3234)969f152aadcc878455583fb2stringtoken (#3235)8e0e95f37bcc5da0314d6994a3905c04f053af13booleantoken (#3248)a5b6c5ebf22ea9f9ee62a080scopeandthis(#3243)59ef51dbe7ba877b5688f487data-typealternative (#3122)eeb13996d30a2da65ee8c557bacf9ae30390e644asmtoken (#3123)f3b25786commentgreedy (#3249)8ecef306matchandcase(soft) keywords (#3142)3f24dc7218bd101c2c63efa6stringgreedy (#3250)1e6dcb5118c92048parametertoken (#3090)0a313f4f809af0d94dde2e20ede55b2cchartoken (#3252)2069ab0c86028adbtype-definitionand use standard tokens correctly (#3253)4049e5c6chartoken (#3254)7d740c454eb81fa1chartoken (#3255)a7bb3001booleantoken (#3100)51382524acc0bc094e00cdddchartoken (#3256)58a65bfdafd77ed1d04d166disolatedkeyword (#3174)18c828a63ef71533regextoken (#3257)c56e4bf5e03a7c2491060fd6599e30eechartoken (#3260)e437325643124129aa73d448a28a86adffd8343fdeed35e3chartoken (#3264)c3f9fb7009a0e2baUpdated plugins
d38592c5drop-tokensoption class (#3166)b679cfe6highlightLinesfunction asPrism.plugins.highlightLines(#3086)9f4c0e74z-indexof.toolbarto 10 (#3163)1cac3559Updated themes
z-indexto make shadows visible in colored table cells (#3161)79f250f3a6a4ce7eOther
setLanguageutil function (#3167)b631949aa80a68badisableWorkerMessageHandler(#3088)213cf7be.html.testfiles for replace.jslanguage tests (#3148)2e834c8c5333e281TestCaseFileclass and generalizedrunTestCase(#3147)ae8888a0344d0b27a394a14d2f7f7364package.json: Addedengines.nodefield (#3108)798ee4f6package(-lock).json(#3098)8daebb4a[email protected](#3091)e6e1d5aed63d6c0e6f1d904a6c21b2f79d5424b6cefccdd10ecdbdce4433d7fe746da79bebd59e323755120031b4c1b8ea361e5ac5629706faedfe853d96eedcv1.25.0Compare Source
New components
746a4b1a87e5a376c1dce99823cd9b654f97b82bea776756e008ea05a1b67ce34fbdd2f8148c1eca4433ccfc8df825e06a356d25Updated components
748bb9acwithkeyword & improved record support (#2993)fdd291c0record,init, andnullablekeyword (#2991)9b561565fromkeyword (#2970)158f25d45de8947f8d0b74b59c8911bd693b7433emptykeyword (#2997)fe3bc526b0365e7052e8cee90ff371bb∀a keyword (alias forforall) (#3005)b38fc89a679539ec6f5d68f714fdfe3235b88fcf4492b62b8541db2e@propertyWrapper,@MainActor, and@globalActor(#3009)ce5e0f01bb93fac0212e0ef2Updated plugins
5126d1e1e289ec6063edf14cc7b6a7f6Updated themes
ffb20439Other
44456b21e997dd35d216e602247fd9a3v1.24.1Compare Source
Updated components
151121cdUpdated plugins
748ecddcv1.24.0Compare Source
New components
b0a6ec853f7d74537e5f78ff41e25d3cf9b695281f91868e99a21dc5bf4e7ba9e93144157e51b99c3419fb772bc6475bf84c49c51a2347a318c67b491b63cd01e38986f9fd1081d2bbc77d1972962701c4f6b2ccUpdated components
regexp/no-dupe-disjunctions(#2952)f471d2d779d22182d85e30daea82478dfc2a3334e4ad22ade5cfdb4a::punctuation (#2814)3df62fd088fa72cfd0bcd07493dd83c2114e4626e6c0d298defdelagatekeyword and highlighting for function/module names (#2709)59f725d7a5d7178cdefinition-queryanddefinition-mutationtokens (#2964)bfd7fded34f24ac9hbsalias (#2874)439763511dfc82716183fd9b4e7b2a8242d24fa24ec7535cab7c9953415651a09c610ae6022f90a0abab9104cf28d1b2ac1d12f945ec4a88e9477d83wraphook (#2719)2b355c988dbbbb355943f4cb87d79390](httConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.