[Snyk] Security upgrade dompurify from 2.4.5 to 2.5.4 #2575
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
|
No applications have been configured for previews targeting branch: master. To do so go to restack console and configure your applications for previews. |
|
No dependency changes detected. Learn more about Socket for GitHub. 👍 No dependency changes detected in pull request |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
⛔ Snyk checks have failed. 83 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
🔒 Entelligence AI Vulnerability Scanner ✅ No security vulnerabilities found! Your code passed our comprehensive security analysis. |
WalkthroughThis PR updates the DOMPurify dependency in the Google Calendar plugin from version 2.3.6 to version 2.5.4. DOMPurify is a critical security library used for sanitizing HTML content to prevent Cross-Site Scripting (XSS) attacks. This targeted update addresses potential security vulnerabilities while maintaining all other dependencies at their current versions, enhancing the overall security posture of the gcalendar plugin without introducing broader dependency changes. Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
title GCalendar Plugin DOMPurify Usage Flow
participant User
participant GCalendar as "GCalendar Plugin"
participant DOMPurify as "DOMPurify v2.5.4"
participant DOM as "DOM"
User->>GCalendar: Interact with calendar
Note over GCalendar: Plugin receives potentially<br/>unsafe HTML content
GCalendar->>DOMPurify: sanitize(htmlContent)
activate DOMPurify
DOMPurify-->>GCalendar: Return sanitized HTML
deactivate DOMPurify
GCalendar->>DOM: Render sanitized content
DOM-->>User: Display safe content
Note over GCalendar,DOMPurify: Version updated from 2.3.6 to 2.5.4<br/>for security improvements
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
LGTM 👍 |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the DOMPurify dependency in the Google Calendar plugin from version 2.3.6 to version 2.5.4. DOMPurify is a critical security library used for sanitizing HTML content to prevent Cross-Site Scripting (XSS) attacks. This targeted update addresses potential security vulnerabilities while maintaining all other dependencies at their current versions, enhancing the overall security posture of the gcalendar plugin without introducing broader dependency changes. Changes
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
LGTM 👍 |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
📝 WalkthroughThis PR addresses a critical security vulnerability in the Google Calendar plugin by updating the DOMPurify dependency from version 2.3.6 to 2.5.4. The update specifically fixes CVE-2024-45801, a high-severity XSS vulnerability (CVSS 7.3) that could allow attackers to bypass DOMPurify's sanitization through special nesting techniques and prototype pollution. The change is minimal and focused solely on updating the dependency version in the package.json file. The current implementation in 📊 Changes
🔒 Security Highlights
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
title DOMPurify Usage in Google Calendar Plugin
participant User
participant Calendar as "Calendar Component"
participant EventRenderer as "Event Renderer"
participant DOMPurify as "DOMPurify v2.5.4"
participant DOM as "Browser DOM"
User->>Calendar: View calendar events
activate Calendar
Calendar->>EventRenderer: Render event details
activate EventRenderer
Note over EventRenderer: Event may contain HTML from<br/>external Google Calendar data
EventRenderer->>DOMPurify: sanitize(eventHTML)
activate DOMPurify
Note over DOMPurify: Sanitizes HTML to prevent XSS<br/>Version updated from 2.3.6 to 2.5.4
DOMPurify-->>EventRenderer: Return sanitized HTML
deactivate DOMPurify
EventRenderer->>DOM: Insert sanitized content
EventRenderer-->>Calendar: Event rendered safely
deactivate EventRenderer
Calendar-->>User: Display sanitized calendar events
deactivate Calendar
🔒 Security Analysis
Caution 1 comment is outside the diff range and can't be posted inline due to platform limitations.
|
![entelligence-ai-pr-reviews[bot]](https://avatars.githubusercontent.com/in/932812?s=60&v=4){kind=small}
| "classnames": "^2.3.1", | ||
| "cross-fetch": "^3.1.5", | ||
| "dompurify": "^2.3.6", | ||
| "dompurify": "^2.5.4", |
There was a problem hiding this comment.
Security: Outdated DOMPurify dependency (v2.3.6) with known XSS vulnerability (CVE-2024-45801) that could allow attackers to bypass sanitization through special nesting techniques and prototype pollution
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant App as GCalendar Plugin
participant DOMPurify as DOMPurify Library (v2.5.4)
participant HTML as HTML Content
Note over App,DOMPurify: Dependency version updated from 2.3.6 to 2.5.4
App->>HTML: Receive HTML content from calendar data
App->>DOMPurify: sanitize(htmlContent)
activate DOMPurify
DOMPurify->>DOMPurify: Parse and clean HTML
DOMPurify-->>App: Return sanitized HTML
deactivate DOMPurify
App->>App: Render safe HTML content
Note over App,DOMPurify: No architectural changes<br/>Same interaction pattern with updated library version
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant App as GCalendar Plugin
participant DP as DOMPurify Library
Note over App,DP: Dependency Version Update: 2.3.6 → 2.5.4
Note over App,DP: No changes to component interactions
App->>DP: sanitize(htmlContent)
activate DP
DP-->>App: sanitizedHTML
deactivate DP
Note over App,DP: Usage pattern remains unchanged<br/>Only library version updated
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant App as GCalendar Plugin
participant DOMPurify as DOMPurify Library (v2.5.4)
participant HTML as HTML Content
Note over App,DOMPurify: Dependency version updated from 2.3.6 to 2.5.4
App->>HTML: Receive HTML content from calendar data
App->>DOMPurify: sanitize(htmlContent)
activate DOMPurify
DOMPurify->>DOMPurify: Parse and clean HTML
DOMPurify-->>App: Return sanitized HTML
deactivate DOMPurify
App->>App: Render safe HTML content
Note over App,DOMPurify: No architectural changes<br/>Same interaction pattern with updated library version
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
EntelligenceAI PR Summary
Updates the DOMPurify HTML sanitization library in the gcalendar plugin to address security and stability improvements.
dompurifyfrom ^2.3.6 to ^2.5.4 inplugins/gcalendar/package.json