Apostrophe 4.34.1: Security Fixes and Safer Content Operations

[BoDonkey]

Hello Apostrophe Community!

Apostrophe 4.34.1 is a maintenance release with an important round of security fixes, including one critical and one high severity issue, so we strongly recommend all users upgrade as soon as possible. It also protects your content in a few situations where it could be damaged or lost, and fixes scheduled tasks on the Assembly dashboard.

Security

This release fixes 17 security vulnerabilities in core, Import/Export, Form, AI Helper, the Astro integration and sanitize-html. Most were responsibly disclosed by outside researchers, and we thank them for their help. The fixes cover:

• A critical authentication bypass involving bearer tokens
• Access control gaps that could expose fields or documents to users who shouldn't see or edit them
• CSRF protection against requests from sibling subdomains
• Stored XSS in JSX templates
• sanitize-html bypasses in non-default configurations
• Denial of service risks in core, Form and AI Helper
• Import/Export hardening

Full details and reporter credits are in the changelog below and in the published GitHub security advisories.

A few of these fixes change behavior you may be relying on. If any of these apply to your project, see the changelog for details:

• viewRole now also governs editing a type's documents.
• Cross-origin requests from the same site are rejected. A separate frontend on a sibling subdomain needs the new allowedOrigins setting of the csrf option. Astro projects should update @apostrophecms/apostrophe-astro to 1.18.1 along with core.
• viewPermission fields are no longer indexed for search. Affected sites should run node app @apostrophecms/search:index after upgrading.
• String props passed from JSX to Nunjucks blocks are now escaped.

Protecting Your Content

• Duplicating a widget no longer removes content. If a widget had a relationship field pointing to the page it's on, duplicating it could make other widgets in the same area disappear or lose recent edits.
• Deleted modules no longer break the admin UI. Leftover documents from a page or piece type you've deleted no longer cause errors in the page tree, the upgrade or version history.
• Missing attachments no longer erase references. Saving now stops with a clear error instead of silently removing the reference. This helps in the rare case where a system administrator restores the database, but forgets to include the aposAttachments collection.
• Undo restores what you started with when editing a widget with live preview.

Assembly Fixes

For Assembly, our multitenant platform for delivering sites to your own customers, scheduled dashboard tasks now run as expected. Note that --frequency must now be hourly or daily. In the Section Template Library, inserting the same section more than once no longer gives the inserted widgets the same ids.

Additional Improvements

• Forms: Answers to conditional fields revealed by a checkboxes field are no longer dropped when the form is submitted, and required fields inside a hidden conditional group no longer block the submission. This relates to our optional forms extension for public forms.
• Media: SVG uploads keep their embedded images, and uploading an image to a full relationship now replaces the latest selection.
• Editing: edit: false now locks nested areas too, version history no longer lists "changes" between empty values, and the CSRF cookie lasts a year as intended instead of about nine hours.
• For developers: Nested arrays and objects with the same name as their parent no longer cause a server error. This changes how array items and objects are matched to their schema, so check the changelog if your code uses arrayName, objectName or apos.schema.getArrayManager. Several other fixes improve module options, middleware ordering, template imports and startup error messages.

Thanks to our community contributors for their reports and fixes this month. You'll find them credited in the changelog below.

---

How to Update

This release contains important security fixes, including a critical one — we encourage all users to upgrade promptly with npm update. Let us know what you think on our roadmap.

---

The “stable” option

Everything above reflects our standard “latest” releases. Customers also have the option of following our “stable” release channel. The difference is simple: stable releases receive new features one full quarter later, but receive bug fixes and security fixes at the same time as “latest.” For this to be an effective way to increase stability, customers still need to actively evaluate “latest” so that they have a meaningful head start on what is coming in “stable.” Customers interested in following this path should reach out for complete information on how to point their dependencies to “stable.”

Everything we ship as “latest” is 100% ready for production. The “stable” series is an option for those with a large investment in training, automated testing, etc. It allows delayed implementation of new features without falling behind on fixes.

🚀 Happy coding!

---

Apostrophe 4.34.1

Fixes

• Keyboard shortcuts such as cut and copy now work on a widget selected from the breadcrumb of a widget inside it, for example a layout selected from one of its columns' widgets.
• A checkboxes field with hideLabel and more than one choice now hides only its own label, not the labels of its choices.
• Uploading an image in the media manager now selects it even when the relationship's max is already reached, replacing the most recent selection instead of being ignored. Thanks to Vlad Bisceanu for reporting the issue.
• Startup errors about configured bundles, such as a bundle that is installed but not listed as a dependency in package.json, are thrown as real errors, so the log shows their message and stack instead of startup-error with nothing more.
• Fix duplicating a widget that relates to its own page deleting or corrupting the other widgets of the area: @ references in a patch no longer resolve into loaded relationships.
• Leftover documents of a page or piece type whose module was removed from the project no longer break the admin UI or the upgrade. Page and piece REST responses that include them, such as the page tree, no longer fail with a 500 error. The document versions upgrade migrations skip them with a warning instead of stopping, and their version history still loads. Copying a document that holds a widget of a removed type no longer fails: the copy drops that widget with a warning, as saving the document already did. Thanks to Alt Studios for the report.
• Undoing a widget edit or widget styles edit in the context bar now restores the widget to its state before the editor opened when live preview is enabled, rather than keeping the last previewed state. Thanks to pnposch for reporting the issue.
• Each module now gets its own copy of the nested objects and arrays in the options it inherits, so a module that changes something like self.options.nested.value no longer changes the options of its base class and sibling subclasses. Functions and class instances in options are still shared by reference.
• Chained before options on middleware and routes now resolve transitively. If module A's middleware asks to run before module B, and B's middleware asks to run before module C, A's middleware now runs first; previously it ran last.
• A module name with a slash that isn't an npm-style @namespace/name, such as nested/stuff, now produces a clear startup warning recommending the nestedModuleSubdirs: true option. These modules still load as before. The misleading "unused module" warning about the parent folder (modules/nested) no longer appears.
• A {% render %} or {% component %} tag at the top level of a template brought in with {% import %} no longer crashes the page with "Cannot read properties of undefined (reading 'data')". Nunjucks discards that output anyway, so the tag is skipped and a one-time warning explains how to fix the template.
• SVG uploads keep bitmaps embedded with <image xlink:href="data:image/png;base64,...">, as exported by many design tools. Previously the SVG sanitizer removed these elements, so parts of the image disappeared. Embedded SVG documents and external references are still removed.
• Document versions no longer list a change between two empty values, such as a field missing from an older document and saved empty since; recorded change counts are updated on upgrade. A range field without a default saved with no value is now unset, as in the editor, instead of .
• edit: false on an area now also applies to the areas nested inside its widgets, at any depth. Previously a nested area became editable in context on its own.
• Saving a document whose attachment field points at an attachment record that is missing from the database (for example, after the documents were copied to a new database without aposAttachments) now fails with an invalid error naming the attachment, instead of silently erasing the reference. Also fixes a missing return after the no-_id branch in the attachment field type's convert(). Fixes #4713. Thanks to Gary Bailey for the contribution.
• The CSRF cookie now lasts one year, as intended. Its maxAge was given in seconds, but Express expects milliseconds, so the cookie expired after about nine hours.
• Fix a server error when a nested array has the same name as its parent array and the parent's items contain an area. Nested objects that share a name with their parent object are fixed as well. When docs are loaded or saved, array items and objects are now annotated with the _id of their own field as _arrayFieldId or _objectFieldId, so each is matched to its own schema. Like other properties beginning with _, these are not stored. scopedArrayName and scopedObjectName are no longer written or read, so the arrayName and objectName field options no longer have any effect, apos.schema.getArrayManager and getObjectManager now take a field _id and return the field itself, and the apos.schema.arrayManagers and objectManagers properties have been removed. apos.util.getManagerOf throws an error for an array item or object that was not annotated, such as content read directly from the database; call apos.schema.annotateFieldIds(doc) on such content first. Thanks to Michael Lip for bringing this issue to our attention.
• The rowstart and rowspan fields of layout columns are limited to 1, the only value layouts support, so generated or imported content can no longer set other values.
• Updated dependencies: sanitize-html@2.18.2, uploadfs@1.28.2

Security

• The bearer token middleware did not check that the token was a string. Because query string parameters are parsed with bracket syntax, an unauthenticated request could supply a database query operator in place of the access_token parameter, match an existing valid bearer token and act as its owner, including administrators. Bearer tokens that are not strings are now rejected with a 401 response. Exploitation required at least one unexpired bearer token to exist, i.e. a session: false login within the token lifetime (two weeks by default). All database adapters were affected (CWE-943, CWE-287, GHSA-jj89-69wm-jj39). Thanks to Srikanth . T for reporting the vulnerability.
• A type's viewRole was not applied to editing, so a logged-in user below that role who met the type's editRole (by default, a contributor) could read, modify and delete drafts of that type through the routes that authorize on editing, such as the universal doc API, document versions and the REST write routes. A user who cannot view a type can now no longer edit, create, delete or publish its documents. Only sites with types that set viewRole above their editRole are affected (CWE-285, CWE-862, CWE-200, GHSA-9wx5-rxfg-8rpw). Thanks to Santh for reporting the vulnerability.
• The text of fields protected by a viewPermission was included in a document's search index (highSearchText, lowSearchText, highSearchWords and searchSummary). A user who could view the document but not the field could read that text through those properties in REST API responses, and could find the document by searching for it. Fields with a viewPermission, including any fields, areas and widgets nested inside them, are no longer indexed for search, so their text is no longer matched by search or autocomplete for any user. This only affects sites that set viewPermission on fields containing text. Existing documents keep their old search text until they are saved again, so such sites should run node app @apostrophecms/search:index after upgrading (CWE-200, GHSA-69r4-gcp7-c67r).
• Exports included the fields the exporting user may not view (viewPermission), in the exported documents and in the related documents exported with them, whatever the format (including the xlsx format of @apostrophecms/import-export-xlsx), along with the files of such attachment fields. Export now removes them before writing the file, the same way REST API responses do. In addition, for a relationship field the user may not view, REST API responses and exports included its stored ids and relationship fields (<name>Ids and <name>Fields), revealing which documents it links to, and exports included the documents it links to. These are now removed too. Saving a document never loses these fields. Exporting requires permission to edit the exported documents and to view the related ones, and only affects sites that use viewPermission (CWE-200, CWE-862, GHSA-p3m7-jjv4-357v). Thanks to Santh for reporting the vulnerability.
• Changing the type of a page could reveal the stored values of fields the previous page type hid from the user with viewPermission, because responses are filtered with the schema of the new type. When a user changes a page's type through the REST API, fields that the old type hides from that user and the new type would not hide are now removed from the page. Only sites using viewPermission on page type fields are affected, and only users who can edit such pages could exploit it (CWE-200, CWE-863, GHSA-f74v-rxwx-7vv9). Thanks to leshipai for reporting the vulnerability.
• The dynamicChoices parameter of the piece type REST API ran the choices method of any requested manager filter without the checks that the choices and counts query builders apply, so the public API (for piece types with a publicApiProjection) and logged-in users lacking a field's viewPermission could receive those filter choices. dynamicChoices now applies the same checks: for public API requests, only filters on fields included in publicApiProjection are answered, and filters on fields the user may not view are skipped. Only piece types with manager filters whose choices is a method are affected (CWE-862, CWE-200, GHSA-x77x-88mc-36vg). Thanks to Srikanth . T for reporting the vulnerability.
• CSRF protection relied on SameSite=Lax cookies, which browsers also send on requests from other origins of the same site, such as a sibling subdomain. A page on another subdomain of the same registrable domain could therefore submit unsafe requests as a logged-in user. Unsafe requests that the browser marks as coming from another origin (via the Sec-Fetch-Site header) are now rejected. Exploitation required the attacker to control a page on a sibling subdomain, and normal permission checks still applied. Non-browser clients, API keys, bearer tokens and csrfExceptions are unaffected. If a separate frontend on another origin of the same site legitimately makes unsafe requests with the user's session cookie, list its origin in the new allowedOrigins subproperty of the csrf option of @apostrophecms/express (CWE-352, GHSA-3fm4-523m-gcr5). Thanks to goku for reporting the vulnerability.
• When a JSX template extended a Nunjucks template with <Extend>, a prop that was a plain string was inserted into the matching block without escaping. JSX projects pass the page title to core's Nunjucks outer layout this way, so anyone able to edit a page or piece title could inject markup and script into that page. String props are now escaped like any other text, quotes included. Markup is still passed as a JSX element or fragment, or as a string marked with apos.template.safe(). A plain object is now written as HTML attributes with escaped values, for blocks inside a tag such as extraHtml: extraHtml={{ 'data-theme': 'dark' }}. If your project deliberately passes an HTML string to a block, without using JSX element syntax, you must wrap it with apos.template.safe() or, if convenient, use the object form to pass attributes. Projects without JSX templates were not affected (CWE-79, GHSA-ffmj-5cgg-p842).
• The admin UI no longer parses notification messages as HTML when deciding whether to apply the "long notification" style. Notifications have been displayed as text since 2021, but this leftover check assigned the message to innerHTML of a detached element, so event-handler markup in a notification could execute. Markup could only arrive via a user's own notification REST requests or via server-side notifications interpolating untrusted text; there is no known practical exploit (CWE-79, GHSA-xhx7-w88j-2j88).
• The attachment crop route accepted crops with a zero width or height, which always failed during image processing, and a failed crop left behind a full-size temporary copy of the original image. Repeating the request could fill the server's disk. Zero-area crops are now rejected as invalid, and the temporary copy is always removed, whether or not cropping succeeds. Exploitation required a logged-in user with permission to upload attachments (contributor or above) (CWE-400, CWE-459, GHSA-cqpf-ff9v-mx8x). Thanks to Jace for reporting the vulnerability.
• Query parameter names were checked against the list of query builders with a lookup that treats dots as a property path, so names such as sort.launder passed the check and then caused an uncaught error. Any visitor could trigger a 500 response and a stack trace in the server log on every request to the public REST API of a piece type with publicApiProjection set, the search page and piece index pages. The same flaw affected the choices query parameter, the apiKeys check (which required a valid key name) and apos.util.orderById. These checks now use an own-property lookup, so such names are ignored or rejected. The process did not crash and no data was exposed (CWE-248, CWE-400, GHSA-w4qx-qgqh-6qm5). Thanks to hackeronerishithehacker-dev for reporting the vulnerability.

Pro Modules

@apostrophecms-pro/multisite 4.7.1

This module lets you have many ApostropheCMS websites running on a single codebase in a single Node.js process. Each has its own database, users, media uploads, etc. Sites can be created and managed via a dashboard site. Explore our documentation to discover how this extension can enhance your project. For further details or inquiries, feel free to contact us or visit our pricing page.

Fixes

• Scheduled tasks configured under tasks.dashboard now run. Before, they crashed on the lock call. Once that was fixed, they would have run only once, because the dashboard got the whole guard table instead of the guard for the task's frequency. -frequency must now be hourly or daily.

@apostrophecms-pro/section-template-library 1.1.1

Accelerate content creation and maintain design consistency by turning your best widgets into reusable section templates. Content teams can instantly insert components without recreating layouts from scratch. Explore our documentation to discover how this extension can enhance your project. For further details or inquiries, feel free to contact us or visit our pricing page.

Fixes

• Inserting the same section more than once no longer gives the inserted widgets the same ids.

Free Modules

@apostrophecms/ai-helper 1.0.0-beta.15

This module enhances Apostrophe with AI-driven helpers. Currently this module offers:

• A button to generate an image from a text prompt via OpenAI.
• An insert menu option to generate rich text from a prompt via OpenAI.

See the extension page for more info.

Security

• The rich text AI helper route used the requested heading levels without checking their range, so a very large value made the server build and return an enormous response, tying up the process. Only valid HTML heading levels (1 through 6) are now accepted, and anything else is ignored. Exploitation required a logged-in user with edit permission for at least one content type (CWE-400, CWE-1284, GHSA-f49h-mhf2-fxmg). Thanks to N Manoj Kumar for reporting the vulnerability.

@apostrophecms/apostrophe-astro 1.18.1

This module integrates ApostropheCMS into your Astro application.

Fixes

• The development warning for an <AposField /> with no editing information names an array item or object by its field id, as Apostrophe no longer sends scopedArrayName or scopedObjectName.
• The README no longer says that APOS_HOST and APOS_PREFIX override the aposHost and aposPrefix options "at runtime". Both variables are read once, when astro build runs, and the resolved values are written into the build output, so they must be set in the build environment and a change requires a rebuild. The README and the JSDoc for the integration options now say so. No code changes.

Security

• Server-side Astro.locals.aposFetch calls no longer forward the Sec-Fetch-* headers of the page request, as part of the fix for CSRF from sibling subdomains in Apostrophe 4.34.1 (CWE-352, GHSA-3fm4-523m-gcr5). Thanks to goku for reporting the vulnerability.

@apostrophecms/form 1.5.7

Allow ApostropheCMS editors to build their own forms. They can then place any form in one or more content areas across the website.

Fixes

• Conditional fields now behave on the server as they do in the browser. A conditional triggered by a checkboxes field is kept when any checked value matches, where before it was always skipped because the answer is an array. Fields nested in a group inside a hidden conditional are skipped too, so their required checks no longer block the submission. Thanks to Vlad Bisceanu for the contribution.

Security

• When processing a form submission, condition names and values from the form's conditional widgets were used as keys of plain objects, so a conditional widget naming __proto__ could modify or remove properties of Object.prototype for the whole server process each time the form was submitted. These keys are now stored in objects with no prototype. Uploaded file field names are counted the same way, which also fixes uploads for file fields whose names match built-in object properties such as constructor. Planting the conditional required a user with permission to edit forms; the submission itself could be anonymous (CWE-1321, GHSA-3fg6-2672-62jf). Thanks to Jace for reporting the vulnerability.

@apostrophecms/import-export 3.7.2

This module enables import and export of pages and pieces, with or without related documents such as files, images and other related types.

Security

• Exports included the fields the exporting user may not view (viewPermission), in the exported documents and in the related documents exported with them, whatever the format (including the xlsx format of @apostrophecms/import-export-xlsx), along with the files of such attachment fields. Export now removes them before writing the file, the same way REST API responses do. Exports also no longer include the documents linked by a relationship field the user may not view. Exporting requires permission to edit the exported documents and to view the related ones, and only affects sites that use viewPermission (CWE-200, CWE-862, GHSA-p3m7-jjv4-357v). Thanks to Santh for reporting the vulnerability.
• For types that are not localized (localized: false), import did not check that an archive document's _id matched its aposDocId. The duplicate shown to the user for confirmation is found by aposDocId while the document actually overwritten is found by _id, so confirming the replacement of one document could overwrite a different document of the same type. Such documents are now refused, as they already were for localized types. The overwrite was still subject to the importing user's permission to edit the document actually overwritten, so the main risk was importing an untrusted archive (CWE-20, CWE-639, GHSA-44gw-rrq5-fm92). Thanks to nokddubal for reporting the vulnerability.

Utilities

sanitize-html 2.18.2

This module provides a simple HTML sanitizer with a clear API.

Fixes

• With parser.decodeEntities: false, named entities longer than 20 characters, such as &CounterClockwiseContourIntegral;, are no longer double-encoded. Thanks to Kenny for the contribution.

Security

• Outside SVG and MathML, browsers parse <![CDATA[ as a bogus comment that ends at the first >, but the underlying parser read it all the way to ]]>. Markup between those two points was hidden from sanitize-html, so a start tag for one of the nonTextTags (such as noscript, style, script, textarea or xmp) placed there was not seen, and content the browser would keep inert inside that element was emitted as live markup. Only tags, attributes and URL schemes permitted by the allowlist could be emitted this way. A <!CDATA[ section now always ends at the first >, as it does in HTML content in a browser. As a result, the text of a real CDATA section inside SVG or MathML is now dropped or sanitized as markup instead of being kept as text, and the literal sequence <![CDATA[ inside an allowed script or style element is written as <!&#91;CDATA[ (CWE-79, CWE-436, GHSA-2rjc-9xvg-45j7). Thanks to [Oscar Rodríguez for reporting the vulnerability.
• When style was allowed, the content of a <style> element inside svg or math could be emitted as live markup, even when svg and math themselves were not allowed. The underlying parser and browsers do not always agree on whether such a <style> is an HTML element, whose content is raw CSS text, or an SVG/MathML element, whose content is markup: for example a <style> inside MathML annotation-xml without an HTML encoding is a MathML element to a browser but raw text to the parser, and inside svg or math the parser decodes < in its content. Because sanitize-html emitted style content as is, markup that the allowlist never permitted, including event handler attributes, could reach the browser. Inside svg or math, a < in style content is now written as the equivalent CSS escape 3c , which means the same in a stylesheet and cannot open a tag. Other stylesheets are unchanged. Exposure is limited: style is not allowed by default, it is one of the vulnerableTags that sanitize-html warns about unless allowVulnerableTags is set, and allowing it already permits CSS-based attacks (CWE-79, GHSA-6wrv-5cp6-h3c5). Thanks to Ali Mustafa for reporting the vulnerability.
• The check that drops SVG animation elements (animate, animateColor, animateMotion, animateTransform, set) when they retarget a URL attribute such as href took only the part of attributeName after its last colon as the target. Browsers split a name with more than one colon differently, and current Chrome resolves a spelling such as xlink:href:x to xlink:href, so the animation was kept and could retarget a link to a javascript: URL after sanitization. Every colon-separated part of attributeName, and of the element name, is now matched. The default configuration is not affected: it only applies when animation elements are allowed together with attributeName and an animation value attribute such as values or to (CWE-79, CWE-184, GHSA-8g6g-w2rq-xcmc). Thanks to Zachariah Mithani for reporting the vulnerability.

uploadfs 1.28.2

• uploadfs copies files to a web-accessible location and provides a consistent way to get the URLs that correspond to those files. uploadfs can also resize, crop and autorotate uploaded images. uploadfs includes S3-based, Azure-based, GCS-based and local filesystem-based backends and you may supply others.

Fixes

• The orientOriginals and copyOriginal options now take effect when passed to init, as documented, instead of only when passed to each copyImageIn call. In Apostrophe this means orientOriginals: false in the ploadfs option of @apostrophecms/uploadfs stores uploaded originals unchanged. A value passed to copyImageIn still takes precedence.