bump xlsx package to the latest release

apostrophecms / apostrophe-tiptap-rich-text-widgets

Wrapper allowing the use of the tiptap vue-based rich-text editor for Apostrophe 2.x. In 3.x it will be standard equipment.

6 stars 1 forks source link

Summary

Fixes a denial-of-service vulnerability by bumping xlsx package to its latest version.

What are the specific steps to test this change?

checkout apostrophe-tiptap-rich-text-widgets
run npm i github:apostrophecms/apostrophe-tiptap-rich-text-widgets#pro-3136-xlsx
add 'apostrophe-tiptap-rich-text-widgets': {}, to app.js
edit 'apostrophe-rich-text'widgets from lib/modules/apostrophe-pages/views/pages/home.html as below:

'apostrophe-rich-text': {
            // add 'import':
            toolbar: [ 'Styles', 'Bold', 'Italic', 'Blockquote', 'Link', 'Anchor', 'Unlink', 'BulletedList', 'import' ],

run project npm run start
add a Rich Text widget on the homepage

upload products.xlsx

What kind of change does this PR introduce?

(Check at least one)

[ ] Bug fix
[ ] New feature
[ ] Refactor
[ ] Documentation
[ ] Build-related changes
[x] Other

Make sure the PR fulfills these requirements:

[x] It includes a) the existing issue ID being resolved, b) a convincing reason for adding this feature, or c) a clear description of the bug it resolves
[x] The changelog is updated
[ ] Related documentation has been updated
[ ] Related tests have been updated

If adding a new feature without an already open issue, it's best to open a feature request issue first and wait for approval before working on it.

Other information:

PRO-3136 [Michelin] Fix xlsx vulnerability reported via Qualsys or Gitlab scanning.

Michelin had reported some vulnerabilities in the container and Apostrophe modules that need to updated based on reports in the MS Azure Security Defender, which uses Qualys scanning or Gitlab scanning. Per Stéphane the **xlsx vulnerability** is regarded as quite important. Currently `apostrophe-tiptap-rich-text-widgets` and `apostrophe-pieces-import` do have a denial-of-service vulnerability. However this vulnerability can be exploited only by Apostrophe content editors (people with editing permissions in your environment). Practically speaking those somewhat trusted parties have other ways to create a denial of service, such as repetitively uploading large images, although there is a small chance someone could encourage them to upload a bad Excel file to the site. See: [https://gitlab-dcadcx.michelin.net/pa/apostrophe-enhancements/-/issues/1162](https://gitlab-dcadcx.michelin.net/pa/apostrophe-enhancements/-/issues/1162) **Acceptance Criteria** * upgrade the offending npm package (xlsx) to the latest major version in both modules * verify xlsx import still works — fix any problems caused by bc breaks in the xlsx module Update the Michelin Support Stream ticket with relevant info in a comment, or get Lindsay to do so.

apostrophecms / apostrophe-tiptap-rich-text-widgets