node-red-dashboard icon indicating copy to clipboard operation
node-red-dashboard copied to clipboard

Update grid stack to latest to resolve jQuery vulnerability.

Open aksswami opened this issue 4 years ago • 1 comments

What are the steps to reproduce?

Use retireJS to scan for vulnerability in node-red project. It will have this output.

jquery 3.4.1 has known vulnerabilities: severity: medium; CVE: CVE-2020-11022, summary: Regex in its jQuery.htmlPrefilter sometimes may introduce XSS; https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ severity: medium; CVE: CVE-2020-11023, summary: Regex in its jQuery.htmlPrefilter sometimes may introduce XSS; https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
/Users/xxxxxx/src/node_modules/gridstack/dist/jquery.min.js
 ↳ jquery 3.4.1

What happens?

What do you expect to happen?

We should update gridstack to the latest version which is already using JQuery 3.5.0

Please tell us about your environment:

  • [x] Node-RED-Dashboard version: 2.30.0
  • [x] Node-RED version: 2.0.6
  • [x] node.js version: 14.x
  • [x] npm version:6.7.x
  • [x] Platform/OS: OSX
  • [ ] Browser:

aksswami avatar Sep 08 '21 14:09 aksswami

This is non-trivial as this is a major version jump to gridstack and they have broken several API that we use - so the code will need to be re-implemented. However it is not obvious how this vulnerability can be exploited from code as we use it.

dceejay avatar Sep 09 '21 09:09 dceejay