Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed CVE security problem #5941

Merged
merged 1 commit into from Nov 11, 2021
Merged

Fixed CVE security problem #5941

merged 1 commit into from Nov 11, 2021

Conversation

wenzhixin
Copy link
Owner

@wenzhixin wenzhixin commented Nov 11, 2021

馃Type of Request

  • Bug fix
  • New feature
  • Improvement
  • Documentation
  • Other

馃摑Changelog
Fixed CVE security problem

  • Core
  • Extensions

馃挕Example(s)?
Before: https://live.bootstrap-table.com/code/wenzhixin/9594
After: https://live.bootstrap-table.com/code/wenzhixin/9595

CVE problem: https://nvd.nist.gov/vuln/detail/CVE-2021-23472

This affects all versions of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.

Ref:

鈽戯笍Self Check before Merge

鈿狅笍 Please check all items below before review. 鈿狅笍

  • Doc is updated/provided or not needed
  • Demo is updated/provided or not needed
  • Changelog is provided or not needed

src/utils/index.js Show resolved Hide resolved
@UtechtDustin UtechtDustin merged commit 0aadef2 into develop Nov 11, 2021
@UtechtDustin UtechtDustin deleted the fix/cve-security branch November 11, 2021 18:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants