XSS vulnerable bootstrap version needs to be upgraded to 4.0.0

[harche]

Proposal

Use case. Why is this important?

Bootstrap version included is vulnerable for XSS attack, https://snyk.io/test/npm/bootstrap/3.3.1

It needs to be upgraded to 4.0.0

Bug Report

What did you do?
Everything works fine but the bootstrap js lib included has XSS vulnerability so needs to be upgraded

What did you expect to see?
N/A

What did you see instead? Under which circumstances?
N/A

Environment
N/A

• System information:
  N/A

• Prometheus version:
  The XSS vulnerable bootstrap js lib exists even in master branch, https://github.com/prometheus/prometheus/tree/master/web/ui/static/vendor/bootstrap-3.3.1

• Alertmanager version:
  N/A

• Prometheus configuration file:

N/A

• Alertmanager configuration file:

N/A

• Logs:

N/A

[x86party]

Possibly a duplicate of #3494.
Could argue that it should still be updated in case some future merge doesn't use Go templating correctly and introduces an XSS issue by virtue of the outdated dependency.

[ksherryBAE]

Does this issue still require fixing?

[harche]

@ksherryBAE yes, very much. It's the known vulnerability that's getting shipped with Prometheus.

[ksherryBAE]

Ok, I will have a look at it.

[harche]

@ksherryBAE thanks.

[ksherryBAE]

Current plan is to bring in bootstrap v4.0.0 and then go through all the templates and ensure that all the tags and functionality is up to date

[harche]

@ksherryBAE thanks, that sounds awesome. Also, would it be possible to backport the fix to release 2.3.1?

[simonpasquier]

@harche FYI we may only backport patches to the current stable release.

[harche]

@simonpasquier No problem. Thanks.

[ksherryBAE]

Just to quickly check, glyphicons are no longer supported in bootstrap 4.0.0 however there is a work around utilising https://github.com/Darkseal/bootstrap4-glyphicons
Would it be suitable to use this? Or would something else be more appropriate?

[achiuBAE]

Hi, i've also been contributing to this with ksherryBAE; i'll be making the pull request soon.

[dbambro]

The following are bootstrap 3.3.1 XSS vulnerabilities:
CVE-2018-14042: In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
CVE-2018-14041: In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
CVE-2108-14040: In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
The bootstrap version needs to be upgraded to 4.1.2 or newer.

[simonpasquier]

Closed by #5226