Fix https://npmjs.com/advisories/1039

[danfuzz]

Steps for Reproduction:

1. npm install quill
2. npm audit

Expected behavior:

No security advisory.

Actual behavior:

Security advisory: https://npmjs.com/advisories/1039

Overview
All versions of quill are vulnerable to Reverse Tabnapping. The package uses
target='_blank' in anchor tags, allowing attackers to access window.opener for
the original page when opening links. This is commonly used for phishing
attacks.

Remediation
No fix is currently available. Consider using an alternative package until a fix is
made available.

Platforms:

N/A

Version:

"All versions" per the advisory.

Additional Notes:

If at all possible, please release / publish fixes for both 1.2.* and 1.3.*. Thanks for your consideration.

[jvhoven]

Related pull request #2674.

[jhchen]

Fixed in https://github.com/quilljs/quill/releases/tag/v1.3.7

[NagarajuGaddam1]

Steps for Reproduction:

1. npm install quill
2. npm audit

Expected behavior:

No security advisory.

Actual behavior:

Security advisory: https://npmjs.com/advisories/1039

Overview
All versions of quill are vulnerable to Reverse Tabnapping. The package uses
target='_blank' in anchor tags, allowing attackers to access window.opener for
the original page when opening links. This is commonly used for phishing
attacks.

Remediation
No fix is currently available. Consider using an alternative package until a fix is
made available.

Platforms:

N/A

Version:

"All versions" per the advisory.

Additional Notes:

If at all possible, please release / publish fixes for both 1.2.* and 1.3.*. Thanks for your consideration.

is it fixed in 1.3.6 or 1.3.7? i tried both but still shows the same issue can you please help me here.

[d4l-w4r]

@NagarajuGaddam1 the issue has been fixed with release version 1.3.7.
Make sure you add "quill": "^1.3.7" to your dependencies in package.json and run an npm install.
Or just npm audit fix

[NagarajuGaddam1]

@danielw93 : Thanks for your reply, Actually i am using "ngx-quill-editor": "2.2.2" and it is dependent on 1.3.6 is there any chance we can fix this in 1.3.6?

[udanpe]

@NagarajuGaddam1 ngx-quill-editor have "quill": "^1.3.1" just run npm remove ngx-quill-editor --save && npm install ngx-quill-editor --save or remove node_modules and package_lock.json and run npm install. Old versions cant be changed

[NagarajuGaddam1]

Still with 1.3.7 also it is showing the same reverse tabbing issue. Can you please suggest what I missed here. Nagaraju

…

On Tue, Sep 17, 2019, 2:47 PM Daniel Waller ***@***.***> wrote: @NagarajuGaddam1 <https://github.com/NagarajuGaddam1> the issue has been fixed with release version 1.3.7. Make sure you add "quill": "^1.3.7" to your dependencies in package.json and run an npm install. Or just npm audit fix — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2746>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AE44UNAJQG7PMY4C4ZLKI3TQKCOBJANCNFSM4IPYBB3Q> .

[bobitza]

GHSA-4943-9vgg-gr5r still on 1.3.7