node-red-dashboard
node-red-dashboard copied to clipboard
Update grid stack to latest to resolve jQuery vulnerability.
What are the steps to reproduce?
Use retireJS to scan for vulnerability in node-red project. It will have this output.
jquery 3.4.1 has known vulnerabilities: severity: medium; CVE: CVE-2020-11022, summary: Regex in its jQuery.htmlPrefilter sometimes may introduce XSS; https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ severity: medium; CVE: CVE-2020-11023, summary: Regex in its jQuery.htmlPrefilter sometimes may introduce XSS; https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
/Users/xxxxxx/src/node_modules/gridstack/dist/jquery.min.js
↳ jquery 3.4.1
What happens?
What do you expect to happen?
We should update gridstack to the latest version which is already using JQuery 3.5.0
Please tell us about your environment:
- [x] Node-RED-Dashboard version: 2.30.0
- [x] Node-RED version: 2.0.6
- [x] node.js version: 14.x
- [x] npm version:6.7.x
- [x] Platform/OS: OSX
- [ ] Browser:
This is non-trivial as this is a major version jump to gridstack and they have broken several API that we use - so the code will need to be re-implemented. However it is not obvious how this vulnerability can be exploited from code as we use it.