Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: replace ansi-html with ansi-html-community to fix vulnerability #413

Merged
merged 2 commits into from
Sep 13, 2021
Merged

fix: replace ansi-html with ansi-html-community to fix vulnerability #413

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
adeeade
fix: replace ansi-html with ansi-html-community to fix vulnerability
nttibbetts Sep 9, 2021
90551e5
use public npm registry, not private one
nttibbetts Sep 9, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
fix: replace ansi-html with ansi-html-community to fix vulnerability 
This is a fix for the vulnerability reported in [CVE-2021-23424][CVE] by
replacing the ansi-html dependency with a fork of the project that has
the [suggested fix][ansi-html-fix] and resolves [#412][412]

[CVE]: https://nvd.nist.gov/vuln/detail/CVE-2021-23424
[ansi-html-fix]: Tjatse/ansi-html#19
[412]: #412
  • Loading branch information
@nttibbetts
nttibbetts committed Sep 9, 2021
commit adeeade4d0074e8ea0b48e95ab8942ed0c70afc7
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ Configuration options can be passed to the client by adding querystring paramete
* **quiet** - Set to `true` to disable all console logging.
* **dynamicPublicPath** - Set to `true` to use webpack `publicPath` as prefix of `path`. (We can set `__webpack_public_path__` dynamically at runtime in the entry point, see note of [output.publicPath](https://webpack.js.org/configuration/output/#output-publicpath))
* **autoConnect** - Set to `false` to use to prevent a connection being automatically opened from the client to the webpack back-end - ideal if you need to modify the options using the `setOptionsAndConnect` function
* **ansiColors** - An object to customize the client overlay colors as mentioned in the [ansi-html](https://github.com/Tjatse/ansi-html/blob/99ec49e431c70af6275b3c4e00c7be34be51753c/README.md#set-colors) package.
* **ansiColors** - An object to customize the client overlay colors as mentioned in the [ansi-html-community](https://github.com/mahdyar/ansi-html-community#set-colors) package.
* **overlayStyles** - An object to let you override or add new inline styles to the client overlay div.
* **overlayWarnings** - Set to `true` to enable client overlay on warnings in addition to errors.

Expand Down
2 changes: 1 addition & 1 deletion client-overlay.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ var styles = {
textAlign: 'left',
};

var ansiHTML = require('ansi-html');
var ansiHTML = require('ansi-html-community');
var colors = {
reset: ['transparent', 'transparent'],
black: '181818',
Expand Down
8 changes: 4 additions & 4 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
"author": "Glen Mailer <glen@stainlessed.co.uk>",
"license": "MIT",
"dependencies": {
"ansi-html": "0.0.7",
"ansi-html-community": "0.0.8",
"html-entities": "^2.1.0",
"querystring": "^0.2.0",
"strip-ansi": "^6.0.0"
Expand Down