opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: bump sanitize-html from 2.17.5 to 2.17.6 in /offlinedocs (#27738)

Browse Source 
Bumps
[sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html)
from 2.17.5 to 2.17.6.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md">sanitize-html's
changelog</a>.</em></p>
<blockquote>
<h2>2.17.6 (2026-07-10)</h2>
<h3>Fixes</h3>
<ul>
<li>Allow transformTags to emit text when textFilter is set, even if the
tag is initially empty. This is consistent with the documentation.
Thanks to <a href="https://github.com/spokodev">spokodev</a> for the
fix.</li>
</ul>
<h3>Security</h3>
<ul>
<li>Fixed an XSS/allowlist bypass in which the contents of a raw-text
element (<code>textarea</code> or <code>xmp</code>) nested inside an
<code>svg</code> or <code>math</code> root were re-emitted without
HTML-escaping. <code>sanitize-html</code> treated that content as inert
raw text because <code>htmlparser2</code> 10.x classified raw-text
elements by tag name and ignored the namespace, but a real HTML5 parser
treats <code>textarea</code>/<code>xmp</code> as ordinary foreign
elements inside SVG/MathML and re-parses their contents as live markup.
As a result, markup and event-handler attributes that the allowlist
never permitted (for example <code>&lt;svg&gt;&lt;textarea&gt;&lt;img
src=x onerror=alert(1)&gt;</code>) could survive sanitization and
execute in the browser. This is now fixed on two fronts:
<code>htmlparser2</code> was upgraded to 12.x, which is namespace-aware
and parses <code>textarea</code>/<code>xmp</code> inside SVG/MathML as
ordinary elements, so their non-allowlisted children (such as the
injected <code>img</code>) are dropped by the allowlist instead of being
preserved as raw text; and any raw-text content
<code>sanitize-html</code> still emits for these tags (at HTML
integration points such as
<code>foreignObject</code>/<code>mtext</code>, or outside foreign
content) is always HTML-escaped. The default configuration is not
affected; the precondition is an <code>allowedTags</code> that includes
<code>svg</code> or <code>math</code> together with
<code>textarea</code> or <code>xmp</code>. Thanks to <a
href="https://github.com/khoadb175">khoadb175</a> for responsibly
disclosing the vulnerability.</li>
<li>Fixed a mutation-XSS / <code>allowedTags</code> bypass affecting
configurations that allow the <code>textarea</code> or <code>xmp</code>
raw-text tags. <code>htmlparser2</code> 10.x did not recognize an end
tag with a trailing solidus (e.g. <code>&lt;/textarea/&gt;</code>) as
closing the element, so it kept the following markup as raw text, but a
spec-compliant browser treats <code>&lt;/textarea/&gt;</code> as a valid
close and parses that markup as a live element. Because raw-text content
was re-emitted without escaping, a payload such as
<code>&lt;textarea&gt;&lt;/textarea/&gt;&lt;img src=x
onerror=...&gt;</code> could smuggle non-allowlisted, executable markup
through the sanitizer. The default configuration was not affected. This
is now defended at two layers: <code>htmlparser2</code> was upgraded to
12.x, whose tokenizer closes these end tags correctly, and the raw text
sanitize-html emits for these tags is always escaped so no
<code>&lt;</code> can reopen a tag when the output is re-parsed
(<code>textarea</code>, an RCDATA element whose entities
<code>htmlparser2</code> decodes, is escaped like normal text, while
<code>xmp</code>, a raw-text element, has only its angle brackets
escaped to avoid double-encoding already-encoded entities). Because
<code>htmlparser2</code> is ESM-only from version 11 onward,
<code>sanitize-html</code> now requires Node.js
<code>&gt;=22.12.0</code> (the first 22.x release in which
<code>require()</code> of an ES module is available unflagged). Thanks
to <a href="https://github.com/bibu123456">bibu123456</a> for reporting
the vulnerability and <a href="https://github.com/Kayiz-PT">Kayiz-PT</a>
for coordinating the disclosure (GHSA-jxwj-j7wr-gfrw).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sanitize-html&package-manager=npm_and_yarn&previous-version=2.17.5&new-version=2.17.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This commit is contained in:
dependabot[bot]
2026-08-01 11:11:32 +00:00
committed by GitHub
parent e0fc756a75
commit b518713ab7
2 changed files with 63 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
offlinedocs/package.json
+1 -1
View File
@@ -27,7 +27,7 @@
"react-markdown": "10.1.0",
"rehype-raw": "7.0.0",
"remark-gfm": "4.0.1",
"sanitize-html": "2.17.5"
"sanitize-html": "2.17.6"
},
"devDependencies": {
"@types/lodash": "4.17.24",
offlinedocs/pnpm-lock.yaml
Generated
+62 -10
View File
@@ -62,8 +62,8 @@ importers:
specifier: 4.0.1
version: 4.0.1
sanitize-html:
specifier: 2.17.5
version: 2.17.5
specifier: 2.17.6
version: 2.17.6
devDependencies:
'@types/lodash':
specifier: 4.17.24
@@ -1031,8 +1031,8 @@ packages:
resolution: {integrity: sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==}
engines: {node: '>= 0.4'}
dayjs@1.11.20:
resolution: {integrity: sha512-YbwwqR/uYpeoP4pu043q+LTDLFBLApUP6VxRihdfNTqu4ubqMlGDLd6ErXhEgsyvY0K6nCs7nggYumAN+9uEuQ==}
dayjs@1.11.21:
resolution: {integrity: sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==}
debug@3.2.7:
resolution: {integrity: sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==}
@@ -1103,16 +1103,32 @@ packages:
dom-serializer@2.0.0:
resolution: {integrity: sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg==}
dom-serializer@3.1.1:
resolution: {integrity: sha512-4MEa38/QexBob6gFNwu+EGdWvhJ1OKuNwdYY3Y3NyeWDQfnGeDYQUDfIRzWu5B5gsv03so2Uxd28YC6zrsx3Lw==}
engines: {node: '>=20.19.0'}
domelementtype@2.3.0:
resolution: {integrity: sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==}
domelementtype@3.0.0:
resolution: {integrity: sha512-umCQid3jKbDmVjx8jGaW7uUykm4DEUeyV21hPxNMo2nV955DhUThwqyOIDtreepP31hl84X7G5U9ZfsWvIB3Pg==}
engines: {node: '>=20.19.0'}
domhandler@5.0.3:
resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==}
engines: {node: '>= 4'}
domhandler@6.0.1:
resolution: {integrity: sha512-gYzvtM72ZtxQO0T048kd6HWSbbGCNOUwcnfQ01cqIJ4X2IYKFFHZ5mKvrQETcFXxsRObZulDaKmy//R7TPtsBg==}
engines: {node: '>=20.19.0'}
domutils@3.2.2:
resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==}
domutils@4.0.2:
resolution: {integrity: sha512-qI4JLRKnSzqFqr7hAlS5xQDusBCjKSEG4t4+7aNrIQMHBcsC2TGEhuyABJdYkgSewL57PNLYEiibY2iPKhKpaA==}
engines: {node: '>=20.19.0'}
dunder-proto@1.0.1:
resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
engines: {node: '>= 0.4'}
@@ -1134,6 +1150,10 @@ packages:
resolution: {integrity: sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==}
engines: {node: '>=0.12'}
entities@8.0.0:
resolution: {integrity: sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA==}
engines: {node: '>=20.19.0'}
error-ex@1.3.4:
resolution: {integrity: sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==}
@@ -1503,6 +1523,10 @@ packages:
htmlparser2@10.1.0:
resolution: {integrity: sha512-VTZkM9GWRAtEpveh7MSF6SjjrpNVNNVJfFup7xTY3UpFtm67foy9HDVXneLtFVt4pMz5kZtgNcvCniNFb1hlEQ==}
htmlparser2@12.0.0:
resolution: {integrity: sha512-Tz7u1i95/g2x2jz81+x0FBVhBhY5aRTvD3tXXdFaljuNdzDLJ8UGNRrTcj2cgQvAg3iW/h77Fz15nLW0L0CrZw==}
engines: {node: '>=20.19.0'}
ieee754@1.2.1:
resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
@@ -2262,8 +2286,9 @@ packages:
resolution: {integrity: sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==}
engines: {node: '>= 0.4'}
sanitize-html@2.17.5:
resolution: {integrity: sha512-ZmU1joGRrvoyctKIiuwUxqR6moLoU2Wk+2bMccN6f7UwhAmwYDvWziqPxRDDN2Qip62NqnIrVrT9akbL6Wretg==}
sanitize-html@2.17.6:
resolution: {integrity: sha512-M4bo9tfv1yfhQZZKkc6dL07ALrGJtfvNOuhX3hU9AVPR/uPQ+nKOJBqTYc7LfMQblTW04mtSWDJWEyLvygJsLA==}
engines: {node: '>=22.12.0'}
scheduler@0.23.2:
resolution: {integrity: sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==}
@@ -3575,7 +3600,7 @@ snapshots:
es-errors: 1.3.0
is-data-view: 1.0.2
dayjs@1.11.20: {}
dayjs@1.11.21: {}
debug@3.2.7:
dependencies:
@@ -3634,18 +3659,36 @@ snapshots:
domhandler: 5.0.3
entities: 4.5.0
dom-serializer@3.1.1:
dependencies:
domelementtype: 3.0.0
domhandler: 6.0.1
entities: 8.0.0
domelementtype@2.3.0: {}
domelementtype@3.0.0: {}
domhandler@5.0.3:
dependencies:
domelementtype: 2.3.0
domhandler@6.0.1:
dependencies:
domelementtype: 3.0.0
domutils@3.2.2:
dependencies:
dom-serializer: 2.0.0
domelementtype: 2.3.0
domhandler: 5.0.3
domutils@4.0.2:
dependencies:
dom-serializer: 3.1.1
domelementtype: 3.0.0
domhandler: 6.0.1
dunder-proto@1.0.1:
dependencies:
call-bind-apply-helpers: 1.0.2
@@ -3662,6 +3705,8 @@ snapshots:
entities@7.0.1: {}
entities@8.0.0: {}
error-ex@1.3.4:
dependencies:
is-arrayish: 0.2.1
@@ -4235,6 +4280,13 @@ snapshots:
domutils: 3.2.2
entities: 7.0.1
htmlparser2@12.0.0:
dependencies:
domelementtype: 3.0.0
domhandler: 6.0.1
domutils: 4.0.2
entities: 8.0.0
ieee754@1.2.1: {}
ignore@5.3.2: {}
@@ -4462,7 +4514,7 @@ snapshots:
launder@1.7.1:
dependencies:
dayjs: 1.11.20
dayjs: 1.11.21
lazystream@1.0.1:
dependencies:
@@ -5257,11 +5309,11 @@ snapshots:
es-errors: 1.3.0
is-regex: 1.2.1
sanitize-html@2.17.5:
sanitize-html@2.17.6:
dependencies:
deepmerge: 4.3.1
escape-string-regexp: 4.0.0
htmlparser2: 10.1.0
htmlparser2: 12.0.0
is-plain-object: 5.0.0
launder: 1.7.1
parse-srcset: 1.0.2