You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A clear and concise description of what the bug is.
"fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time.
As above, there is a vulnerability in @botonic/core that relies on fast-xml-parser. Upgrading to v4.2.4 can solve this problem.
To Reproduce
Steps to reproduce the behaviour:
Go to '...'
Click on '....'
Scroll down to '....'
See error
Intuition about the error / Proposed solution (optional)
What is the expected behaviour?
A clear and concise description of what you expected to happen.
Screenshots
If applicable, add screenshots to help explain your problem.
About the environment
Which versions of botonic packages, and which browser/OS or environment (development/production) are affected by this issue? Did this work in previous versions of botonic packages?
Additional context
Add any other context about the problem here.
The text was updated successfully, but these errors were encountered:
Describe the bug
Hi 🙋
A clear and concise description of what the bug is.
"fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time.
As above, there is a vulnerability in @botonic/core that relies on fast-xml-parser. Upgrading to v4.2.4 can solve this problem.
To Reproduce
Steps to reproduce the behaviour:
What is the expected behaviour?
A clear and concise description of what you expected to happen.
Screenshots
If applicable, add screenshots to help explain your problem.
About the environment
Which versions of botonic packages, and which browser/OS or environment (development/production) are affected by this issue? Did this work in previous versions of botonic packages?
Additional context
Add any other context about the problem here.
The text was updated successfully, but these errors were encountered: