New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency illuminate/view to v6.20.42 [SECURITY] #23

Open

renovate wants to merge 1 commit into master from renovate/packagist-illuminate/view-vulnerability

renovate bot commented Feb 5, 2024 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
illuminate/view (source)	`6.18.1` -> `6.20.42`

GitHub Vulnerability Alerts

CVE-2021-43808

A security researcher has disclosed a possible XSS vulnerability in the Blade templating engine.

Given the following two Blade templates:

resources/views/parent.blade.php:

@&#8203;section('content')
<input value="">
@&#8203;show

resources/views/child.blade.php:

@&#8203;extends('parent')

@&#8203;section('content')
<input value="">
@&#8203;endsection

And a route like the following:

Route::get('/example', function() {
    $value = '//localhost/###parent-placeholder-040f06fd774092478d450774f5ba30c5da78acc8## onclick=location.assign(this.value);//';

    return view('child', ['value' => $value]);
});

The broken HTML element may be clicked and the user is taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed.

This vulnerability has been patched by determining the parent placeholder at runtime and using a random hash that is unique to each request.

Release Notes

illuminate/view (illuminate/view)

`v6.20.42`

`v6.20.41`

`v6.20.40`

`v6.20.39`

`v6.20.38`

`v6.20.37`

`v6.20.36`

`v6.20.35`

`v6.20.34`

`v6.20.33`

`v6.20.32`

`v6.20.31`

`v6.20.30`

`v6.20.29`

`v6.20.28`

`v6.20.27`

`v6.20.26`

`v6.20.25`

`v6.20.24`

`v6.20.23`

`v6.20.22`

`v6.20.21`

`v6.20.20`

`v6.20.19`

`v6.20.18`

`v6.20.17`

`v6.20.16`

`v6.20.15`

`v6.20.14`

`v6.20.13`

`v6.20.12`

`v6.20.11`

`v6.20.10`

`v6.20.9`

`v6.20.8`

`v6.20.7`

`v6.20.6`

`v6.20.5`

`v6.20.4`

`v6.20.3`

`v6.20.2`

`v6.20.1`

`v6.20.0`

`v6.19.1`

`v6.19.0`

`v6.18.43`

`v6.18.42`

`v6.18.41`

`v6.18.40`

`v6.18.39`

`v6.18.38`

`v6.18.37`

`v6.18.36`

`v6.18.35`

`v6.18.34`

`v6.18.33`

`v6.18.32`

`v6.18.31`

`v6.18.30`

`v6.18.29`

`v6.18.28`

`v6.18.27`

`v6.18.26`

`v6.18.25`

`v6.18.24`

`v6.18.23`

`v6.18.22`

`v6.18.21`

`v6.18.20`

`v6.18.19`

`v6.18.18`

`v6.18.17`

`v6.18.16`

`v6.18.15`

`v6.18.14`

`v6.18.13`

`v6.18.12`

`v6.18.11`

`v6.18.10`

`v6.18.9`

`v6.18.8`

`v6.18.7`

`v6.18.6`

`v6.18.5`

`v6.18.4`

`v6.18.3`

`v6.18.2`

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          Update dependency illuminate/view to v6.20.42 [SECURITY]

1b299d7

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment