mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
dependabot[bot]
b518713ab7
Bumps [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) from 2.17.5 to 2.17.6. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md">sanitize-html's changelog</a>.</em></p> <blockquote> <h2>2.17.6 (2026-07-10)</h2> <h3>Fixes</h3> <ul> <li>Allow transformTags to emit text when textFilter is set, even if the tag is initially empty. This is consistent with the documentation. Thanks to <a href="https://github.com/spokodev">spokodev</a> for the fix.</li> </ul> <h3>Security</h3> <ul> <li>Fixed an XSS/allowlist bypass in which the contents of a raw-text element (<code>textarea</code> or <code>xmp</code>) nested inside an <code>svg</code> or <code>math</code> root were re-emitted without HTML-escaping. <code>sanitize-html</code> treated that content as inert raw text because <code>htmlparser2</code> 10.x classified raw-text elements by tag name and ignored the namespace, but a real HTML5 parser treats <code>textarea</code>/<code>xmp</code> as ordinary foreign elements inside SVG/MathML and re-parses their contents as live markup. As a result, markup and event-handler attributes that the allowlist never permitted (for example <code><svg><textarea><img src=x onerror=alert(1)></code>) could survive sanitization and execute in the browser. This is now fixed on two fronts: <code>htmlparser2</code> was upgraded to 12.x, which is namespace-aware and parses <code>textarea</code>/<code>xmp</code> inside SVG/MathML as ordinary elements, so their non-allowlisted children (such as the injected <code>img</code>) are dropped by the allowlist instead of being preserved as raw text; and any raw-text content <code>sanitize-html</code> still emits for these tags (at HTML integration points such as <code>foreignObject</code>/<code>mtext</code>, or outside foreign content) is always HTML-escaped. The default configuration is not affected; the precondition is an <code>allowedTags</code> that includes <code>svg</code> or <code>math</code> together with <code>textarea</code> or <code>xmp</code>. Thanks to <a href="https://github.com/khoadb175">khoadb175</a> for responsibly disclosing the vulnerability.</li> <li>Fixed a mutation-XSS / <code>allowedTags</code> bypass affecting configurations that allow the <code>textarea</code> or <code>xmp</code> raw-text tags. <code>htmlparser2</code> 10.x did not recognize an end tag with a trailing solidus (e.g. <code></textarea/></code>) as closing the element, so it kept the following markup as raw text, but a spec-compliant browser treats <code></textarea/></code> as a valid close and parses that markup as a live element. Because raw-text content was re-emitted without escaping, a payload such as <code><textarea></textarea/><img src=x onerror=...></code> could smuggle non-allowlisted, executable markup through the sanitizer. The default configuration was not affected. This is now defended at two layers: <code>htmlparser2</code> was upgraded to 12.x, whose tokenizer closes these end tags correctly, and the raw text sanitize-html emits for these tags is always escaped so no <code><</code> can reopen a tag when the output is re-parsed (<code>textarea</code>, an RCDATA element whose entities <code>htmlparser2</code> decodes, is escaped like normal text, while <code>xmp</code>, a raw-text element, has only its angle brackets escaped to avoid double-encoding already-encoded entities). Because <code>htmlparser2</code> is ESM-only from version 11 onward, <code>sanitize-html</code> now requires Node.js <code>>=22.12.0</code> (the first 22.x release in which <code>require()</code> of an ES module is available unflagged). Thanks to <a href="https://github.com/bibu123456">bibu123456</a> for reporting the vulnerability and <a href="https://github.com/Kayiz-PT">Kayiz-PT</a> for coordinating the disclosure (GHSA-jxwj-j7wr-gfrw).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>