This repository was archived by the owner on Oct 11, 2024. It is now read-only.
fix(deps): update dependency highlight.js to v10.4.1 [security] #623
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
10.1.2->10.4.1GitHub Vulnerability Alerts
GHSA-7wwv-vh3v-89cq
Impact: Potential ReDOS vulnerabilities (exponential and polynomial RegEx backtracking)
oswasp:
If are you are using Highlight.js to highlight user-provided data you are possibly vulnerable. On the client-side (in a browser or Electron environment) risks could include lengthy freezes or crashes... On the server-side infinite freezes could occur... effectively preventing users from accessing your app or service (ie, Denial of Service).
This is an issue with grammars shipped with the parser (and potentially 3rd party grammars also), not the parser itself. If you are using Highlight.js with any of the following grammars you are vulnerable. If you are using
highlightAutoto detect the language (and have any of these grammars registered) you are vulnerable. Exponential grammars (C, Perl, JavaScript) are auto-registered when using the common grammar subset/libraryrequire('highlight.js/lib/common')as of 10.4.0 - see https://cdn.jsdelivr.net/gh/highlightjs/[email protected]/build/highlight.jsAll versions prior to 10.4.1 are vulnerable, including version 9.18.5.
Grammars with exponential backtracking issues:
And of course any aliases of those languages have the same issue. ie:
hppis no safer thancpp.Grammars with polynomial backtracking issues:
And again: any aliases of those languages have the same issue. ie:
rubyandrbshare the same ruby issues.Patches
Workarounds / Mitigations
References
For more information
If you have any questions or comments about this advisory:
Release Notes
highlightjs/highlight.js (highlight.js)
v10.4.1Compare Source
Security
Very grateful to Michael Schmidt for all the help.
v10.4.0Compare Source
A largish release with many improvements and fixes from quite a few different contributors. Enjoy!
Deprecations:
requireLanguageis deprecated.getLanguage(with custom error handling) or built-time dependencies.Parser:
beginKeywordssupport (#2813) Josh GoebelclassNameAliasesfor more complex grammars Josh GoebelclassNameAliasesfor more complex grammars Josh GoebelNew Languages:
node-replfor Node.js REPL sessions (#2792) Marat NagayevLanguage Improvements:
~(#2859) Guillaume Grossetie\(#2861) Guillaume Grossetie\[Gamma]#Marcus Ortizsomekeyword Marcus Ortiz@mainattribute Marcus OrtizDev Improvements:
New themes:
v10.3.2: - Oops, "Javascript".Compare Source
Tiny tiny release, just to fix the website incorrectly not listing Javascript
in the list of languages you could choose for a custom build. NPM and CDN
build should not have been affected so 10.3.1 is effectively the same as
10.3.2 for those builds.
If you made a custom build from the website with 10.3 or 10.3.1 you may
want to check and make sure it includes Javascript, and if not, build it again.
v10.3.1Compare Source
Prior version let some look-behind regex sneak in, which does not work
yet on Safari. This release removes those incompatible regexes.
Fix:
v10.3.0Compare Source
Language Improvements:
enum (struct|class)andunion(#2752) [Josh Goebel][]{}inside template literals SUBST expression (#2748) [Josh Goebel][]constructoris now highlighted as a function title (not keyword) (#2727) [Josh Goebel][]#for private class fields (#2701) Chris Krycho(*)from being detected as a multi-line comment [Josh Goebel][]objective-c++andobj-c++aliases for Objective-C [Josh Goebel][]record(#2685) [Josh Goebel][]title(#2683) [Josh Goebel][]final) in class declaration (#2696) [Josh Goebel][]matchkeyword and addphp8as an alias (#2733) Ayesh KarunaratneDeprecations:
useBRoption deprecated and will be removed in v11.0. (#2559) [Josh Goebel][]v10.2.1Compare Source
Parser Engine:
v10.2.0Compare Source
Parser Engine:
New themes:
Deprecations:
fixMarkupis now deprecated and will be removed in v11.0. (#2534) Josh GoebelBig picture:
Language Improvements:
initandrecordkeywords for C# 9.0 (#2660) Youssef Victorargumentskeyword and fixenumerationkeyword (#2619) Andrew JankegetLanguage(#2636) nightenum, which will identify as aclassnow (#2643) ezksdConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.