Skip to content

Conversation

@taveras
Copy link
Contributor

@taveras taveras commented Jan 15, 2019

This change updates react-dom to version 16.2.1, per CVE-2018-6341.

Description

While this dependency is only used within our test suite and we would not be concerned about a XSS attack, we are upgrading react-dom regardless.

The following is information about the vulnerability:

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Chore, documentation, cleanup

How Has This Been Tested?

Ran npm test, and verified the generated build with npm run build did not have issues.

Checklist:

  • My code follows the code style of this project.
  • I have updated the documentation (if required).
  • I have read the CONTRIBUTING document.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

@taveras taveras requested a review from pgoldrbx January 15, 2019 16:29
@coveralls
Copy link

Pull Request Test Coverage Report for Build 271

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 100.0%

Totals Coverage Status
Change from base Build 263: 0.0%
Covered Lines: 60
Relevant Lines: 60

💛 - Coveralls

@taveras taveras merged commit 3ddb2b1 into CondeNast:master Jan 16, 2019
@taveras taveras deleted the fix/security-react-dom-16.2.1 branch January 16, 2019 20:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants