GHSA-7fh5-64p2-3v2j contains no security impact

[DCKcode]

The GHSA-7fh5-64p2-3v2j advisory seems to be in a poor state at the moment. Neither the advisory text nor any of the references contain any description of any security impact, and no CWE category is given either. Readers can't distinguish between this being a security bug or a normal bugfix that has been mistakenly granted security vulnerability status.

My suggestion would be to add this context (maybe @ai as the author of the change can provide this). If context as to why there is security impact cannot be provided, my suggestion would be revert this advisory to "unreviewed" status.

[ai]

Here are more details:

This vulnerability affects linters using PostCSS to parse external CSS. Attacker can prepare CSS, which will contains parts parsed by PostCSS as a CSS comment, but which will be visible for browser as other CSS nodes (rules, properties).

[ai]

But I think we need to change CVE database. I asked one person.

[DCKcode]

I see, thanks for clarifying! I can request a change.

Does this sound fair?

This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

This seems to be CWE-93 and/or CWE-140, right?

[ai]

This seems to be CWE-93 and/or CWE-140, right?

It is not fit 100%. The source of the problem is that PostCSS parser and browsers parse the same CSS a little different. For one it will be a comment, for another a comment with a rule.

[DCKcode]

I've opened up an MR at #2828 - let's continue the discussion there 🙂

[darakian]

I merged in the PR from #2828 before reading about the conversation moving, sorry about that 😞
Let me now if I shouldn't have or if there are any minor edits you'd like and I can get them in though 👍

[darakian]

Gonna close this out since no one has followed up. Feel free to ping if anything 😄