search

KriesiMedia / Enfold-Feature-Requests

2 stars 0 forks source link

Pollyfill security issue #108

Open mgmason opened 2 weeks ago

mgmason commented 2 weeks ago

A user points out that Google Maps is alerting users about a Pollyfill security issue, and requests that the theme stops loading it. It seems that the issue is from 3rd-party CDN services that override the WordPress Pollyfill file with one that has malicious code. While Enfold links to the WordPress file, the user requests that the theme stops doing so there is not a chance of the malicious one to be loaded, it is unclear if WordPress will also be doing anything similar.

Report of error ▸ https://www.spiceworks.com/it-security/cyber-risk-management/news/polyfill-supply-chain-attack-infects-websites/ WordPress issue ▸ https://wordpress.org/support/topic/pollyfill-io-security-issue/ Thread ▸ https://kriesi.at/support/topic/security-alert-polyfill-io-issue-for-google-maps-platform-users/#post-1460051

InoPlugs commented 1 week ago

@mgmason

As far as I see WP uses this for block editor and react.js

It is not possible to remove that without risk of breaking sites. We have to wait for WP to apply a patch.

Enfold does not link to the files.

As WP ships the files - there is a possible hack for WP core - but this is not update safe :

peterolle commented 1 week ago

What will happen if WordPress remove it completely and Enfold is still calling it? Maybe it is safer to not use it?

Just a thought.

InoPlugs commented 6 days ago

@peterolle

I do not see where Enfold enqueues this. Can you please point out where you see it and how to reproduce ?

peterolle commented 6 days ago

I do not see where Enfold enqueues this. Can you please point out where you see it and how to reproduce ?

I don't know either. I was just pointing out that if WordPress decides to remove the thing and Enfold keeps using it, then everything will break.

InoPlugs commented 6 days ago

@peterolle

Thanks for your feedback. I keep it in my mind.