Fixes open vulnerabilities for #38 #49

samschurter · 2020-11-19T20:16:56Z

This should deal with the open CVEs referenced in #38, Dogfalo#6286, and Dogfalo#6331

Proposed changes

CVE-2019-11002 (`tooltip` component)

Add the options text and unsafeHTML
Change behavior of the data-tooltip attribute to set the text property instead of html (breaking change)
Inject text as .textContent
Append html/unsafeHTML as HTML
If unsafeHTML is used, html will be ignored
Updated docs to indicate that use of html is deprecated, and added warnings to unsafeHTML

CVE-2019-11004 (`toast` component)

Add the options text and unsafeHTML
Inject text as .textContent
Append html/unsafeHTML as HTML
If unsafeHTML is used, html will be ignored
Updated docs to indicate that use of html is deprecated, and added warnings to unsafeHTML

CVE-2019-11003 (`autocomplete` component)

Add allowUnsafeHTML option defaulting to false
If user sets allowUnsafeHTML: true then behavior is unchanged
If allowUnsafeHTML remains false, then the autocomplete data key is injected as textContent

Screenshots (if appropriate) or codepen:

Couldn't figure out how to do a codepen with the re-compiled javascript. If you clone the PR and compile it then the examples under test/html for autocomplete, toast, and tooltips will demonstrate the changes.

Types of changes

Bug fix (non-breaking change which fixes an issue).
New feature (non-breaking change which adds functionality).
Breaking change (fix or feature that would cause existing functionality to change).

Checklist:

I have read the CONTRIBUTING document.
My change requires a change to the documentation.
I have updated the documentation accordingly.
I have added tests to cover my changes.
All new and existing tests passed.

movinglinguini · 2021-01-18T14:53:25Z

Hey @samschurter I was wondering if you will resolve that conflict.

samschurter · 2021-01-18T20:01:17Z

@LAG1996 No, I don't think so. This is a dead PR. It was opened long before the pull request that caused that conflict, yet this PR has received no reviews. The people running this project now have no interest in fixing the vulnerabilities.

DanielRuf · 2021-01-18T20:26:42Z

The people running this project now have no interest in fixing the vulnerabilities.

Sorry but this is basically not true =)

DanielRuf · 2021-01-18T20:27:07Z

cc @materializecss/members

Smankusors · 2021-01-18T20:31:41Z

@LAG1996 No, I don't think so. This is a dead PR. It was opened long before the pull request that caused that conflict, yet this PR has received no reviews. The people running this project now have no interest in fixing the vulnerabilities.

I'm sorry, but I feel not confident about reviewing this one. Anyway, I see you created new tests. Should these... added to the Jasmine tests?

Prepaid2Coin-Cory · 2021-02-07T15:14:50Z

Would like to see this merged please. Even if it is BC 2 years is due time for a Major Semver.

Prepaid2Coin-Cory · 2021-02-09T01:10:33Z

cc: @DanielRuf

DanielRuf · 2021-02-13T19:49:23Z

Thanks for your contributions @samschurter.

CI is green and the relevant changes are documented. I also think we can move forward with this and finally break some setups.

Let's merge it.

DanielRuf · 2021-02-13T19:51:52Z

You should have received an invitation to join @materializecss as member and collaborator for https://materializecss/materialize.

ChildishGiant · 2021-05-02T20:29:51Z

Does anyone know how to flag the new version as having patched this advisory? That way NPM could run an automatic upgrade, although that probably shouldn't happen till 1.1.0 is stable.

DanielRuf · 2021-05-02T21:42:49Z

That way NPM could run an automatic upgrade, although that probably shouldn't happen till 1.1.0 is stable.

Not sure what you mean with "automatic upgrade". npm audit fix automatically installs the latest version afaik. The npmjs team creates advisories and defines the patched version there. Our fork is not officially affected because it is a different package.

See also https://github.com/materializecss/materialize/security/advisories

https://www.npmjs.com/advisories?page=7&perPage=100
https://www.npmjs.com/advisories/817
https://www.npmjs.com/advisories/818

ChildishGiant · 2021-05-02T22:10:36Z

This is from a project that's using our fork so it certainly is picked up by npm audit

DanielRuf · 2021-05-02T22:14:06Z

Does it use the v1.1.0-alpha?

What does npm ls materialize-css output?

ChildishGiant · 2021-05-02T22:34:10Z

ah, my mistake, I still had the old version installed. Removing that fixed this.

AJLeonardi · 2021-07-14T11:52:53Z

Hey Folks, I'm just moving over from the "old" materialize to this one and doing my regression testing. I'm seeing an issue with both the HTML and unsafeHTML flag for tooltips. Regardless of the option I choose, html is rendered as a string, rather than HTML.

I assume since the description for the unsafeHTML option is the same as the old HTML option support for HTML content wasn't deprecated entirely.

Any ideas on what my issue might be?

for initialization I've tried both:

var tt_options = {'html':true,};
var elem = document.querySelectorAll('.tooltipped');
var instance = M.Tooltip.init(elem, tt_options);

and

var tt_options = {'unsafeHTML':true,};
var elem = document.querySelectorAll('.tooltipped');
var instance = M.Tooltip.init(elem, tt_options);

ChildishGiant · 2021-07-17T16:35:11Z

Docs on how to use it can be found here: https://materializecss.github.io/materialize/toasts.html unsafeHTML is a string, not a bool.

AJLeonardi · 2021-07-23T23:37:30Z

thanks, @ChildishGiant

In my case tool tips are generated dynamically based on RSVP details in a DB. There could be dozens of them on the page.

With the old materialize in my jinja template I would just create the dynamic HTML within the data-tooltip attribute of each tooltipped <a> and globally initialize all the tooltips in one go using the approach above (which seems to be undocumented. setting data-html="true" on the tooltipped <a> also works).

This worked and it was simple and great. All the looping happened in the context of the object in my template and they were initialized with a single js call.

Now it seems I have to create unique IDs for each tooltip, generate the html in the <script> section with some-way to correlate it to the specific tooltip ID, and then write javascript to initialize each one individually (rather than a single line of js I did before).

Am I understanding that correctly, or am I missing something super obvious? Is there a way to include the html in another data- attribute and have the init grab that dynamically?

Imagine a world where the tooltip example here https://materializecss.com/tooltips.html showed different HTML contents (instead of just "I am a tooltip!") for each bottom, top, left, right buttons. Would you have to initialize each one separately?

Thanks!

ilatypov · 2022-01-13T18:27:37Z

Now it seems I have to create unique IDs for each tooltip, generate the html in the <script> section with some-way to correlate it to the specific tooltip ID, and then write javascript to initialize each one individually (rather than a single line of js I did before).

I checked the updated documentation
https://materializecss.github.io/materialize/tooltips.html

and the source code and I agree with the criticism. I guess the unsafeHTML fix needs an improvement by refactoring the programming interface. As of now, toasts require an onclick handler which is both clumsy and disagreeable with the Content Security Policy option allowing servers to disable inline scripts. The tooltips, on the other hand, look perfect in terms of initialization and handling, but the unsafeHTML option, instead of allowing all tooltips to be unsafe, allows only addition of a single unsafe HTML to all tooltips. So I guess toasts could use the same approach as tooltips in terms of initialization/handling, and then the unsafeHTML option needs changing from a string to a boolean. Perhaps, with the new paradigm, one does not have to worry about backward compatibility and one could use the unsafeHTML option name or even rename it.

DanielRuf · 2022-01-13T21:04:00Z

Hi @ilatypov,

thanks for your feedback. That sounds good and I agree with you. Any contribution is very welcome. If you have the time and want to help, you can provide a PR which improves this. As we still did not do a new stable release (https://github.com/materializecss/materialize/releases), breaking changes are fine.

Skopea · 2024-02-27T14:36:24Z

I notice that the changes have been merged, but I haven't seen a new release yet. Is v1.0.0 for materialize-css still the latest version? Am I overlooking something? What steps should I take to update the packages and address my vulnerabilities?

FINDarkside · 2024-02-28T13:01:31Z

@Skopea 2.0.3 is the latest version. https://www.npmjs.com/package/@materializecss/materialize

mxdpeep · 2025-01-12T08:22:55Z

I notice that the changes have been merged, but I haven't seen a new release yet. Is v1.0.0 for materialize-css still the latest version? Am I overlooking something? What steps should I take to update the packages and address my vulnerabilities?

looking at bad URL :)

https://github.com/materializecss/materialize/releases

fixes vulnerabilities in materializecss#38

3aae4cc

samschurter force-pushed the vuln-fix branch from ac5ddfb to 3aae4cc Compare November 19, 2020 20:21

Smankusors added component: tooltip component: autocomplete component: toast documentation Improvements or additions to documentation enhancement New feature or request javascript labels Nov 20, 2020

Smankusors requested a review from a team November 20, 2020 02:16

Smankusors linked an issue Jan 12, 2021 that may be closed by this pull request

Plan to fix all current CVEs #38

Closed

Merge branch 'v1-dev' into vuln-fix

9d52291

ChildishGiant approved these changes Jan 18, 2021

View reviewed changes

Prepaid2Coin-Cory approved these changes Feb 7, 2021

View reviewed changes

DanielRuf merged commit 99024e0 into materializecss:v1-dev Feb 13, 2021

DanielRuf mentioned this pull request Feb 26, 2021

Improve and make consistent chips' data object #67

Closed

damianhxy mentioned this pull request May 18, 2022

[BUGFIX+IMPROVEMENT] Fixed and added autocomplete for inputing students autolab/Autolab#1443

Closed

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes open vulnerabilities for #38 #49

Fixes open vulnerabilities for #38 #49

samschurter commented Nov 19, 2020 •

edited

Loading

movinglinguini commented Jan 18, 2021

samschurter commented Jan 18, 2021

DanielRuf commented Jan 18, 2021

DanielRuf commented Jan 18, 2021

Smankusors commented Jan 18, 2021 •

edited

Loading

Prepaid2Coin-Cory commented Feb 7, 2021 •

edited

Loading

Prepaid2Coin-Cory commented Feb 9, 2021

DanielRuf commented Feb 13, 2021

DanielRuf commented Feb 13, 2021

ChildishGiant commented May 2, 2021

DanielRuf commented May 2, 2021

ChildishGiant commented May 2, 2021

DanielRuf commented May 2, 2021

ChildishGiant commented May 2, 2021

AJLeonardi commented Jul 14, 2021

ChildishGiant commented Jul 17, 2021

AJLeonardi commented Jul 23, 2021 •

edited

Loading

ilatypov commented Jan 13, 2022 •

edited

Loading

DanielRuf commented Jan 13, 2022

Skopea commented Feb 27, 2024 •

edited

Loading

FINDarkside commented Feb 28, 2024

mxdpeep commented Jan 12, 2025 •

edited

Loading

Fixes open vulnerabilities for #38 #49

Fixes open vulnerabilities for #38 #49

Conversation

samschurter commented Nov 19, 2020 • edited Loading

Proposed changes

CVE-2019-11002 (tooltip component)

CVE-2019-11004 (toast component)

CVE-2019-11003 (autocomplete component)

Screenshots (if appropriate) or codepen:

Types of changes

Checklist:

movinglinguini commented Jan 18, 2021

samschurter commented Jan 18, 2021

DanielRuf commented Jan 18, 2021

DanielRuf commented Jan 18, 2021

Smankusors commented Jan 18, 2021 • edited Loading

Prepaid2Coin-Cory commented Feb 7, 2021 • edited Loading

Prepaid2Coin-Cory commented Feb 9, 2021

DanielRuf commented Feb 13, 2021

DanielRuf commented Feb 13, 2021

ChildishGiant commented May 2, 2021

DanielRuf commented May 2, 2021

ChildishGiant commented May 2, 2021

DanielRuf commented May 2, 2021

ChildishGiant commented May 2, 2021

AJLeonardi commented Jul 14, 2021

ChildishGiant commented Jul 17, 2021

AJLeonardi commented Jul 23, 2021 • edited Loading

ilatypov commented Jan 13, 2022 • edited Loading

DanielRuf commented Jan 13, 2022

Skopea commented Feb 27, 2024 • edited Loading

FINDarkside commented Feb 28, 2024

mxdpeep commented Jan 12, 2025 • edited Loading

samschurter commented Nov 19, 2020 •

edited

Loading

CVE-2019-11002 (`tooltip` component)

CVE-2019-11004 (`toast` component)

CVE-2019-11003 (`autocomplete` component)

Smankusors commented Jan 18, 2021 •

edited

Loading

Prepaid2Coin-Cory commented Feb 7, 2021 •

edited

Loading

AJLeonardi commented Jul 23, 2021 •

edited

Loading

ilatypov commented Jan 13, 2022 •

edited

Loading

Skopea commented Feb 27, 2024 •

edited

Loading

mxdpeep commented Jan 12, 2025 •

edited

Loading