Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

There is a vulnerability in @botonic/core #2676

Open
TDzouchen opened this issue Nov 28, 2023 · 0 comments
Open

There is a vulnerability in @botonic/core #2676

TDzouchen opened this issue Nov 28, 2023 · 0 comments
Labels
bug Something isn't working

Comments

@TDzouchen
Copy link
Contributor

TDzouchen commented Nov 28, 2023

Describe the bug
Hi 🙋

A clear and concise description of what the bug is.
"fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time.

As above, there is a vulnerability in @botonic/core that relies on fast-xml-parser. Upgrading to v4.2.4 can solve this problem.

To Reproduce
Steps to reproduce the behaviour:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error
  5. Intuition about the error / Proposed solution (optional)

What is the expected behaviour?
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

image

About the environment
Which versions of botonic packages, and which browser/OS or environment (development/production) are affected by this issue? Did this work in previous versions of botonic packages?

Additional context
Add any other context about the problem here.

@TDzouchen TDzouchen added the bug Something isn't working label Nov 28, 2023
@TDzouchen TDzouchen changed the title The core There is a vulnerability in @botonic/core Nov 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant