Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enhance security: code fixes and dependency upgrades #134

Merged
merged 7 commits into from
Dec 6, 2023
Merged

Enhance security: code fixes and dependency upgrades #134

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6501a06
Upgrade dependencies
Dec 1, 2023
b1c493c
Add guard to protect against XSS attacks
Dec 1, 2023
5c47482
Resolve vulnerabilities updating dependencies
Dec 1, 2023
7d95e8c
CR changes
Dec 5, 2023
caf5602
Loosen NVMRC version range: 12.22.8 is outdated
kadamwhite Dec 5, 2023
0e1cdc3
npm audit fix
kadamwhite Dec 5, 2023
0aed948
Revert "CR changes"
kadamwhite Dec 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .nvmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
v12.22.8
v12
89 changes: 49 additions & 40 deletions composer.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 3 additions & 2 deletions js/post-select/components/post-list-item.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import classNames from 'classnames';
import DOMPurify from 'dompurify';
import moment from 'moment';
import PropTypes from 'prop-types';
import React from 'react';
Expand All @@ -14,7 +15,7 @@ const PostListItem = ( { post, author, thumbnail, postTypeObject, isSelected, on
<label htmlFor={ `select-post-${post.id}` }>
{ thumbnail
? <img
alt={ post.title.rendered }
alt={ DOMPurify.sanitize( post.title.rendered ) }
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nitpick, better to import { sanitize } from DOMPurify; and then call these as alt={ sanitize( post.title.rendered ) }

(Although, I'm confused why we need to do this -- React should already be escaping the alt attribute. The main security issue with React is when you set __dangerouslySetInnerHtml. Are we certain we need to double-sanitize alt strings?)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@kadamwhite thanks for the review.

I applied the solution you suggested on both, but could not yet test it, as I'm setting up a local environment to use the plugin.

I got this solution of sanitizing the variable and using DOMPurify from the security audit:
https://semgrep.dev/r?q=typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't have linting actions in place, and I noticed that eslint is complaining about sanitize:

sanitize not found in 'dompurify' eslint (import/named)

I'm looking into that. Thanks.

className="post-list-item--image"
src={ thumbnail.media_details.sizes.thumbnail.source_url }
/>
Expand All @@ -27,7 +28,7 @@ const PostListItem = ( { post, author, thumbnail, postTypeObject, isSelected, on
type="checkbox"
onChange={ () => onToggleSelected() }
/>
<h2 dangerouslySetInnerHTML={ { __html: post.title.rendered } } />
<h2 dangerouslySetInnerHTML={ { __html: DOMPurify.sanitize( post.title.rendered ) } } />
<div className="post-list-item--meta">
{ postTypeObject && ( <span><b>{ __( 'Type:', 'hm-gb-tools' ) }</b> { postTypeObject.labels.singular_name }</span> ) }
<span><b>{ __( 'Status:', 'hm-gb-tools' ) }</b> { post.status }</span>
Expand Down
5 changes: 3 additions & 2 deletions js/post-select/components/selection-item.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import classNames from 'classnames';
import DOMPurify from 'dompurify';
import moment from 'moment';
import PropTypes from 'prop-types';
import React, { Fragment } from 'react';
Expand All @@ -18,13 +19,13 @@ const SelectionListItem = ( { post, thumbnail, author, postTypeObject, isSelecte
<Fragment>
{ thumbnail
? <img
alt={ post.title.rendered }
alt={ DOMPurify.sanitize( post.title.rendered ) }
className="post-list-item--image"
src={ thumbnail.media_details.sizes.thumbnail.source_url }
/>
: '' }
<div className="post-list-item--inner">
<h2 dangerouslySetInnerHTML={ { __html: post.title.rendered } } />
<h2 dangerouslySetInnerHTML={ { __html: DOMPurify.sanitize( post.title.rendered ) } } />
<div className="post-list-item--meta">
{ postTypeObject && ( <span><b>{ __( 'Type:', 'hm-gb-tools' ) }</b> { postTypeObject.labels.singular_name }</span> ) }
<span><b>{ __( 'Status:', 'hm-gb-tools' ) }</b> { post.status }</span>
Expand Down
Loading