浏览代码

[CVE] Change version of sanitize-html to 2.7.2 and handle null condition for deXSS function (#3005)

Co-authored-by: reshma <reshma.fegade@cloudera.com>
Co-authored-by: Harsh Gupta <42064744+Harshg999@users.noreply.github.com>
ReshmaFegade2022 3 年之前
父节点
当前提交
8611218d71
共有 3 个文件被更改,包括 22 次插入15 次删除
  1. 9 2
      desktop/core/src/desktop/js/utils/html/deXSS.ts
  2. 12 12
      package-lock.json
  3. 1 1
      package.json

+ 9 - 2
desktop/core/src/desktop/js/utils/html/deXSS.ts

@@ -16,7 +16,14 @@
 
 import sanitizeHtml from 'sanitize-html';
 
-const deXSS = (str?: boolean | string | number | null): string =>
-  (typeof str !== 'undefined' && sanitizeHtml(str as string)) || '';
+const deXSS = (str?: boolean | string | number | null): string => {
+  if (str === null) {
+    return 'null';
+  }
+  if (typeof str !== 'undefined') {
+    return sanitizeHtml(str as string) || '';
+  }
+  return '';
+};
 
 export default deXSS;

+ 12 - 12
package-lock.json

@@ -43,7 +43,7 @@
         "react-dom": "^18.1.0",
         "regenerator-runtime": "^0.13.3",
         "removeNPMAbsolutePaths": "^1.0.4",
-        "sanitize-html": "^2.1.2",
+        "sanitize-html": "^2.7.2",
         "select2": "3.5.1",
         "selectize": "0.12.6",
         "selectize-plugin-clear": "0.0.3",
@@ -12911,6 +12911,7 @@
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/klona/-/klona-2.0.4.tgz",
       "integrity": "sha512-ZRbnvdg/NxqzC7L9Uyqzf4psi1OM4Cuc+sJAkQPjO6XkQIJTNbfK2Rsmbw8fx1p2mkZdp2FZYo2+LwXYY/uwIA==",
+      "dev": true,
       "engines": {
         "node": ">= 8"
       }
@@ -15898,17 +15899,16 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
     },
     "node_modules/sanitize-html": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.4.0.tgz",
-      "integrity": "sha512-Y1OgkUiTPMqwZNRLPERSEi39iOebn2XJLbeiGOBhaJD/yLqtLGu6GE5w7evx177LeGgSE+4p4e107LMiydOf6A==",
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.7.2.tgz",
+      "integrity": "sha512-DggSTe7MviO+K4YTCwprG6W1vsG+IIX67yp/QY55yQqKCJYSWzCA1rZbaXzkjoKeL9+jqwm56wD6srYLtUNivg==",
       "dependencies": {
         "deepmerge": "^4.2.2",
         "escape-string-regexp": "^4.0.0",
         "htmlparser2": "^6.0.0",
         "is-plain-object": "^5.0.0",
-        "klona": "^2.0.3",
         "parse-srcset": "^1.0.2",
-        "postcss": "^8.0.2"
+        "postcss": "^8.3.11"
       }
     },
     "node_modules/sanitize-html/node_modules/domhandler": {
@@ -29030,7 +29030,8 @@
     "klona": {
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/klona/-/klona-2.0.4.tgz",
-      "integrity": "sha512-ZRbnvdg/NxqzC7L9Uyqzf4psi1OM4Cuc+sJAkQPjO6XkQIJTNbfK2Rsmbw8fx1p2mkZdp2FZYo2+LwXYY/uwIA=="
+      "integrity": "sha512-ZRbnvdg/NxqzC7L9Uyqzf4psi1OM4Cuc+sJAkQPjO6XkQIJTNbfK2Rsmbw8fx1p2mkZdp2FZYo2+LwXYY/uwIA==",
+      "dev": true
     },
     "knockout": {
       "version": "3.5.1",
@@ -31365,17 +31366,16 @@
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
     },
     "sanitize-html": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.4.0.tgz",
-      "integrity": "sha512-Y1OgkUiTPMqwZNRLPERSEi39iOebn2XJLbeiGOBhaJD/yLqtLGu6GE5w7evx177LeGgSE+4p4e107LMiydOf6A==",
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.7.2.tgz",
+      "integrity": "sha512-DggSTe7MviO+K4YTCwprG6W1vsG+IIX67yp/QY55yQqKCJYSWzCA1rZbaXzkjoKeL9+jqwm56wD6srYLtUNivg==",
       "requires": {
         "deepmerge": "^4.2.2",
         "escape-string-regexp": "^4.0.0",
         "htmlparser2": "^6.0.0",
         "is-plain-object": "^5.0.0",
-        "klona": "^2.0.3",
         "parse-srcset": "^1.0.2",
-        "postcss": "^8.0.2"
+        "postcss": "^8.3.11"
       },
       "dependencies": {
         "domhandler": {

+ 1 - 1
package.json

@@ -64,7 +64,7 @@
     "react-dom": "^18.1.0",
     "regenerator-runtime": "^0.13.3",
     "removeNPMAbsolutePaths": "^1.0.4",
-    "sanitize-html": "^2.1.2",
+    "sanitize-html": "^2.7.2",
     "select2": "3.5.1",
     "selectize": "0.12.6",
     "selectize-plugin-clear": "0.0.3",