Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency @builder.io/qwik to v1.7.3 [security] #22

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update dependency @builder.io/qwik to v1.7.3 [security] #22

wants to merge 1 commit into from

Conversation

renovate-bot
Copy link

@renovate-bot renovate-bot commented Aug 13, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@builder.io/qwik (source) 1.4.3 -> 1.7.3 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-41677

Summary

A potential mXSS vulnerability exists in Qwik for versions up to 1.6.0.

Details

Qwik improperly escapes HTML on server-side rendering. It converts strings according to the following rules:

https://github.com/QwikDev/qwik/blob/v1.5.5/packages/qwik/src/core/render/ssr/render-ssr.ts#L1182-L1208

  • If the string is an attribute value:
    • " -> "
    • & -> &
    • Other characters -> No conversion
  • Otherwise:
    • < -> &lt;
    • > -> &gt;
    • & -> &amp;
    • Other characters -> No conversion

It sometimes causes the situation that the final DOM tree rendered on browsers is different from what Qwik expects on server-side rendering. This may be leveraged to perform XSS attacks, and a type of the XSS is known as mXSS (mutation XSS).

PoC

A vulnerable component:

import { component$ } from "@&#8203;builder.io/qwik";
import { useLocation } from "@&#8203;builder.io/qwik-city";

export default component$(() => {
  
  // user input
  const { url } = useLocation();
  const href = url.searchParams.get("href") ?? "https://example.com";

  return (
    <div>
      <noscript>
        <a href={href}>test</a>
      </noscript>
    </div>
  );
});

If a user accesses the following URL,

http://localhost:4173/?href=</noscript><script>alert(123)</script>

then, alert(123) will be executed.

Impact

XSS

Release Notes

QwikDev/qwik (@​builder.io/qwik)

v1.7.3

v1.7.2

Patch Changes

  • Library builds now correctly generate _fnSignal calls again. Any Qwik library that exports components should be built again. (by @​wmertens in #​6732)

    • built files are now under dist/ or lib/. All tools that respect package export maps should just work. (by @​wmertens in #​6715)
      If you have trouble with Typescript, ensure that you use moduleResolution: "Bundler" in your tsconfig.json.
    • @builder.io/qwik no longer depends on undici

  • fix dev mode on windows (by @​Varixo in #​6713)

v1.7.1

Compare Source

What's Changed

There are very important bugfixes around build and development in this release and we recommend upgrading.

PRs

Full Changelog: QwikDev/qwik@v1.7.0...v1.7.1

v1.7.0

Compare Source

Notable changes
  • Form errors when using dot notation have a slightly different type
  • Changes to search parameters in the URL will cause routeloaders to re-run now
  • Fixed several issues in dev mode
PRs merged
New Contributors

Full Changelog: QwikDev/qwik@v1.6.0...v1.7.0

v1.6.0

Compare Source

What's Changed

Features
Bug Fixes
Docs

New Contributors

Full Changelog: QwikDev/qwik@v1.5.7...v1.6.0

v1.5.7

Compare Source

What's Changed
New Contributors

Full Changelog: QwikDev/qwik@v1.5.6...v1.5.7

v1.5.6

Compare Source

What's Changed

Many bugfixes and documentation updates.

We also added an API tech preview: createSignal, useConstant and createComputed$, which should be self-explanatory. Feedback welcome on Discord or in issues. We cannot guarantee the stability of these APIs yet, although they are simple enough that they probably won't need changing.

Commits
New Contributors

Full Changelog: QwikDev/qwik@v1.5.5...v1.5.6

v1.5.5

Compare Source

What's Changed

New Contributors

Full Changelog: QwikDev/qwik@v1.5.4...v1.5.5

v1.5.4

Compare Source

What's Changed

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

sourcery-ai[bot]
sourcery-ai bot reviewed Aug 13, 2024
View reviewed changes
Copy link

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have skipped reviewing this pull request. It seems to have been created by a bot (hey, renovate-bot!). We assume it knows what it's doing!

@renovate-bot renovate-bot force-pushed the renovate/npm-builder.io-qwik-vulnerability branch from 6081938 to 3e04cca Compare August 28, 2024 07:09
@renovate-bot renovate-bot force-pushed the renovate/npm-builder.io-qwik-vulnerability branch from 3e04cca to 263d363 Compare October 9, 2024 11:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sourcery-ai sourcery-ai[bot] sourcery-ai[bot] left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@renovate-bot