🚨 [security] Update dompurify 2.4.1 → 2.5.7 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ dompurify (2.4.1 → 2.5.7) · Repo

Security Advisories 🚨

🚨 DOMpurify has a nesting-based mXSS

DOMpurify was vulnerable to nesting-based mXSS

fixed by 0ef5e537 (2.x) and
merge 943

Backporter should be aware of GHSA-mmhx-hmjr-r674 (CVE-2024-45801) when cherry-picking

POC is avaible under test

🚨 DOMPurify allows tampering by prototype pollution

It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check.

This renders dompurify unable to avoid XSS attack.

Fixed by 1e52026 (3.x branch) and 26e1d69 (2.x branch).

Release Notes

2.5.7

• Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @masatokinugawa
• Removed the foreignObject element from the list of HTML entry-points, thanks @masatokinugawa

2.5.6

• Fixed an issue with the execution logic of attribute hooks to prevent bypasses, thanks @kevin-mizu
• Fixed a minor problem with the bower file pointing to the wrong dist path
• Updated several development dependencies

2.5.4

• Fixed a bug with latest isNaN checks affecting MSIE, thanks @tulach
• Fixed the tests for MSIE and fixed related test-runner

2.5.0

• Added new setting SAFE_FOR_XML to enable better control over comment scrubbing
• Updated the LICENSE file to show the accurate year number
• Updated several build and test dependencies

2.4.9

• Fixed another conditional bypass caused by Processing Instructions, thanks @Ry0taK
• Fixed the regex for HTML Custom Element detection, thanks @AlekseySolovey3T

2.4.8

• Fixed two possible bypasses when sanitizing an XML document and later using it in HTML, thanks @Slonser

2.4.7

• Fixed a licensing issue spotted and reported by @george-thomas-hill

2.4.6

• Fixed a bypass in jsdom 22 in case the noframes element is permitted, thanks @leeN

2.4.4

• Added support for ALLOW_SELF_CLOSE_IN_ATTR flag, thanks @edg2s @AndreVirtimo
• Added better support for shadowrootmode, thanks @mfreed7

2.4.3

• Final release that is compatible with MSIE10 & MSIE 11

2.4.2

• Fixed a Trusted Types sink violation with empty input and NAMESPACE , thanks @tosmolka
• Fixed a Prototype Pollution issue discovered and reported by @kevin-mizu

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 63 commits:

• chore: Preparing 2.5.7 release
• chore: Preparing 2.5.6 release
• fix: Added changes to 2.x regarding attribute value checks
• See #961
• chore: Preparing 2.5.5 release
• chore: Also removed depth counter logic from 2.x branch for now
• docs: Updated README ever so slightly
• test: Fixed two more tests for MSIE11 and Edge 18
• test: Fixed more tests for MSIE and Edge 18
• test: Fixed several new tests for MSIE11 and Edge 18
• test: Changed github config to include MSIE tests for 2.x
• chore: Preparing 2.5.4 release
• fix: Added a better for for the MSIE iNaN issue
• test: Attempting to get MSIE 11 back into the browser test array
• fix: Fixed an issue with MSIE and no support for Number.isNaN
• Merge branch '2.x' of github.com:cure53/DOMPurify into 2.x
• fix: Merged prototype pollution check into 2.x
• docs: Updated README.md with right version number
• chore: chore: Preparing 2.5.3 release
• chore: Getting 2.x branch up to date with main
• fix: Added better configurability for new comment behavior
• chore: Getting 2.x branch up to date with main
• chore: Preparing 2.5.2 release
• chore: Migrated relevant changes from main over to 2.x
• chore: Preparing 2.5.1 release
• test: Fixed the tests for new MAX_NESTING_DEPTH limit
• fix: Started to set new MAX_NESTING_DEPTH limits as well
• test: Fixed a linter issue breaking the tests
• chore: Updated 2.x branch with relevant fixes for nesting-based mXSS
• chore: Updated some packages
• docs: Updated year in LICENSE file for 2.x as well
• chore: Preparing 2.5.0 release
• feature: Added SAFE_FOR_XML flag and code to 2.x branch
• chore: Preparing 2.4.9 release
• fix: Merged relevant changes from main for 2.4.9
• chore: Preparing 2.4.8 release
• chore: Preparing 2.4.8. release
• fix: cherry-picked fixes for XML & CE bypass
• chore: Preparing 2.4.7. release
• chore: Preparing 2.4.6 release
• Fix: addressed a bypass on jsdom 22 when noframes tag is allowed
• chore: preparing 2.4.5 release
• chore: preparing 2.4.4 release
• see #767
• test: Added 2.x tag to 2.x branch actions
• See #761
• Merge pull request #750 from cure53/dependabot/npm_and_yarn/json5-1.0.2
• chore: Prepare 2.4.3, final feature release compatible w. MSIE10/11
• build(deps): bump json5 from 1.0.1 to 1.0.2
• fix: merged from latest main
• Update README.md
• chore: Preparing 2.4.2 release
• fix: Fixed a prototype pollution bug reported by @kevin_mizu
• Merge pull request #748 from tosmolka/tosmolka/747
• Fix formatting
• Fix Trusted Types Sink violation with empty input and NAMESPACE
• Merge pull request #745 from cure53/dependabot/npm_and_yarn/qs-and-body-parser-6.11.0
• build(deps): bump qs and body-parser
• Merge pull request #737 from cure53/dependabot/npm_and_yarn/engine.io-and-socket.io-6.2.1
• build(deps): bump engine.io and socket.io
• Merge pull request #732 from Pomierski/patch-1
• fix
• chore: fix allowCustomizedBuiltInElements comment in readme

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (95e0fb7) to head (5761651).

Additional details and impacted files

@@            Coverage Diff            @@
##            master      #102   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            5         5           
  Lines          134       134           
  Branches        28        28           
=========================================
  Hits           134       134           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.