Skip to content

Security version updates - #6427

Closed
flying-sheep wants to merge 2 commits into
plotly:masterfrom
flying-sheep:security-fixes
Closed

Security version updates#6427
flying-sheep wants to merge 2 commits into
plotly:masterfrom
flying-sheep:security-fixes

Conversation

@flying-sheep

@flying-sheep flying-sheep commented Jan 6, 2023 •
edited
Loading

Copy link
Copy Markdown

Supersedes #6344

The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.

Weaknesses

– @mik-patient

Also fixes this security issue in JSON5

@archmoj

archmoj commented Jan 6, 2023

Copy link
Copy Markdown
Contributor

Good start.
Could you please investigate why some jasmine tests are failing?
Perhaps adjusting this webpack config could help

plotly.js/test/jasmine/karma.conf.js

Lines 263 to 309 in b03f295

webpack: {
target: ['web', 'es5'],
module: {
rules: [{
test: /\.js$/,
use: [
'transform-loader?' + path.resolve(__dirname, '..', '..', 'tasks/util/shortcut_paths')
]
}, {
test: /\.js$/,
include: /node_modules/,
use: {
loader: 'babel-loader',
options: {
babelrc: false,
configFile: false,
plugins: [
'@babel/plugin-transform-modules-commonjs'
]
}
}
}, {
test: /\.(js|glsl)$/,
use: [
'ify-loader'
]
}]
},
resolve: {
fallback: {
'stream': require.resolve('stream-browserify')
}
},
plugins: [
new NodePolyfillPlugin({ includeAliases: ['process'] }),
new LoaderOptionsPlugin({
// test: /\.xxx$/, // may apply this only for some modules
options: {
library: {
name: 'Plotly',
type: 'umd',
umdNamedDefine: true
}
}
})
]
},

@archmoj archmoj added community community contribution type: maintenance labels Jan 6, 2023
@flying-sheep

flying-sheep commented Jan 6, 2023

Copy link
Copy Markdown
Author

Sorry, I have no webpack experience. Feel free to make changes to this PR!

@flying-sheep flying-sheep mentioned this pull request Jan 12, 2023
Closed
@archmoj archmoj mentioned this pull request Feb 1, 2023
Merged
@archmoj

archmoj commented Feb 1, 2023

Copy link
Copy Markdown
Contributor

Addressed in #6463.
Thank you!

@archmoj archmoj closed this Feb 1, 2023
@flying-sheep
flying-sheep deleted the security-fixes branch February 1, 2023 22:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@whittet whittet whittet approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

community community contribution

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@flying-sheep @archmoj @whittet