Skip to content

fix(deps): update dependency marked to v4 [security] - abandoned#45

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-marked-vulnerability
Open

fix(deps): update dependency marked to v4 [security] - abandoned#45
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-marked-vulnerability

Conversation

@renovate
Copy link
Copy Markdown

@renovate renovate Bot commented Mar 7, 2022 •
edited
Loading

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
marked (source) 0.3.19 -> 4.0.10 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-21680

Impact

What kind of vulnerability is it?

Denial of service.

The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.

import * as marked from "marked";

marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);

Who is impacted?

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

Patches

Has the problem been patched?

Yes

What versions should users upgrade to?

4.0.10

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

CVE-2022-21681

Impact

What kind of vulnerability is it?

Denial of service.

The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.

import * as marked from 'marked';

console.log(marked.parse(`[x]: x

\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));

Who is impacted?

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

Patches

Has the problem been patched?

Yes

What versions should users upgrade to?

4.0.10

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

GHSA-xf5p-87ch-gxw2

Versions of marked from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.

Recommendation

Upgrade to version 0.6.2 or later.

Release Notes

markedjs/marked

v4.0.10

Compare Source

Bug Fixes
  • security: fix redos vulnerabilities (8f80657)

v4.0.9

Compare Source

Bug Fixes

v4.0.8

Compare Source

Bug Fixes

v4.0.7

Compare Source

Bug Fixes

v4.0.6

Compare Source

Bug Fixes

v4.0.5

Compare Source

Bug Fixes

v4.0.4

Compare Source

Bug Fixes

v4.0.3

Compare Source

Bug Fixes

v4.0.2

Compare Source

Bug Fixes

v4.0.1

Compare Source

Bug Fixes

v4.0.0

Compare Source

Bug Fixes
BREAKING CHANGES
  • Default export removed. Use import { marked } from 'marked' or const { marked } = require('marked') instead.
  • /lib/marked.js removed. Use /marked.min.js in script tag instead.
  • When using marked in a script tag use marked.parse(...) instead of marked(...)

v3.0.8

Compare Source

Bug Fixes

v3.0.7

Compare Source

Bug Fixes
  • use named exports only for ESM build (#​2226)

v3.0.6

Compare Source

Bug Fixes

v3.0.5

Compare Source

Bug Fixes

v3.0.4

Compare Source

Bug Fixes

v3.0.3

Compare Source

Bug Fixes

v3.0.2

Compare Source

Bug Fixes

v3.0.1

Compare Source

Bug Fixes

v3.0.0

Compare Source

Bug Fixes
BREAKING CHANGES
  • Drop support for node 10.
  • Add module field to package.json
  • Tokenizers will create their own tokens with this.lexer.inline(text, tokens). The inline function will queue the token creation until after all block tokens are created.
  • Extensions tokenizer this object will include the lexer as a property. this.inlineTokens becomes this.lexer.inline.
  • Extensions renderer this object will include the parser as a property. this.parseInline becomes this.parser.parseInline.
  • tag and inlineText tokenizer function signatures have changed.
  • nptable tokenizer is removed and merged with table tokenizer.
  • table tokens header property changed to contain an array of objects for each header cell with text and tokens properties.
  • table tokens cells property changed to rows and is an array of rows where each row contains an array of objects for each cell with text and tokens properties.

v2 table token:

{
  "type": "table",
  "align": [null, null],
  "raw": "| a | b |\n|---|---|\n| 1 | 2 |\n",
  "header": ["a", "b"],
  "cells": [["1", "2"]],
  "tokens": {
    "header": [
      [{ "type": "text", "raw": "a", "text": "a" }],
      [{ "type": "text", "raw": "b", "text": "b" }]
    ],
    "cells": [[
      [{ "type": "text", "raw": "1", "text": "1" }],
      [{ "type": "text", "raw": "2", "text": "2" }]
    ]]
  }
}

v3 table token:

{
  "type": "table",
  "align": [null, null],
  "raw": "| a | b |\n|---|---|\n| 1 | 2 |\n",
  "header": [
    {
      "text": "a",
      "tokens": [{ "type": "text", "raw": "a", "text": "a" }]
    },
    {
      "text": "b",
      "tokens": [{ "type": "text", "raw": "b", "text": "b" }]
    }
  ],
  "rows": [
    {
      "text": "1",
      "tokens": [{ "type": "text", "raw": "1", "text": "1" }]
    },
    {
      "text": "2",
      "tokens": [{ "type": "text", "raw": "2", "text": "2" }]
    }
  ]
}

v2.1.3

Compare Source

Bug Fixes

v2.1.2

Compare Source

Bug Fixes

v2.1.1

Compare Source

Bug Fixes

v2.1.0

Compare Source

Features

v2.0.7

Compare Source

Bug Fixes

v2.0.6

Compare Source

Bug Fixes

v2.0.5

Compare Source

Bug Fixes

v2.0.4

Compare Source

Bug Fixes

v2.0.3

Compare Source

Bug Fixes

v2.0.2

Compare Source

Bug Fixes

v2.0.1

Compare Source

Bug Fixes

v2.0.0

Compare Source

Bug Fixes
BREAKING CHANGES
  • em and strong tokenizers have been merged into one emStrong tokenizer.
  • code and text tokenizers do not get passed all tokens as a second parameter.
  • No longer supporting IE 11. IE 11 may still work but we are not committed to making sure it works with every update. We still provide an es5 version in lib/marked.js but some pollyfills may be needed for IE 11 in the future.

v1.2.9

Compare Source

Bug Fixes

v1.2.8

Compare Source

Bug Fixes

v1.2.7

Compare Source

Bug Fixes

v1.2.6

Compare Source

Bug Fixes
  • fix atx heading and make regex safe (#​1853) (70ee29c)
    possible breaking change: When using the block.heading rule the text provided in capture group 2 will not be trimmed of whitespace.
  • fix link with angle brackets around href (#​1851) (656c3e4)

v1.2.5

Compare Source

Bug Fixes

v1.2.4

Compare Source

Bug Fixes

Possible Breaking Change: When using the inline.del rule the text is provided in capture group 2 instead of 1.

v1.2.3

Compare Source

Bug Fixes

v1.2.2

Compare Source

Bug Fixes

v1.2.1

Compare Source

re-release of v 1.1.2 since semantic release picked up the wrong version

v1.2.0: 1.2.0

Compare Source

Features

Fixes

Dependencies

Documentation

  • Add api dingus for babelmark #​1742
  • Update docs to use static build step and clean URLs via Vercel #​1749

v1.1.2

Compare Source

Bug Fixes

v1.1.1: 1.1.1

Compare Source

Fixes

Docs

Scripts

v1.1.0: 1.1.0

Compare Source

Features

Fixes

  • Fix renderer.code includes space at beginning of each line of code #​1645
  • Fix codespan newline #​1652
  • Fix comma after underscore emphasis #​1660
  • Fix loose task list with no tokens #​1674
  • Add browser field in package.json pointing to es5 output #​1661
  • Add newline to rendered code with language #​1670
  • Fix async highlighter walking all tokens #​1664

Docs

v1.0.0: 1.0.0

Compare Source

Breaking changes

  • Add inline tokens to marked.lexer output #​1627
  • Treat escape token same way as plain text tokens #​1642
  • Add Tokenizer to allow extending token creation #​1637

Features

  • Add marked.use() method to extend options #​1646

Fixes

  • Fix intra-word emphasis can match the wrong asterisks #​1636
  • Fix italics modifier (_) breaks links containing underscores #​1641
  • Fix closing delimited * incorrect for consecutive ocurrences #​1644

Docs

CI

v0.8.2: 0.8.2

Compare Source

Fixes
  • Add html to TextRenderer for html in headings #​1622
  • Remove html tags in heading ids #​1622
Docs
  • Update comment about GitHub breaks #​1620

v0.8.1: 0.8.1

Compare Source

Fixes

v0.8.0: 0.8.0

Compare Source

Breaking changes
Fixes
Docs
Dev Dependencies

v0.7.0: 0.7.0

Compare Source

Security

Breaking Changes

  • Deprecate sanitize and sanitizer options #​1504
  • Move fences to CommonMark #​1511
  • Move tables to GFM #​1511
  • Remove tables option #​1511
  • Single backtick in link text needs to be escaped #​1515

Fixes

Tests

  • Run tests with correct options #​1511

v0.6.3: 0.6.3

Compare Source

Fixes

Docs

DevOps

  • Use latest commit for demo master #​1457
  • Update tests to commonmark 0.29 #​1465
  • Update tests to GFM 0.29 #​1470
  • Fix commonmark spec 57 and 40 (headings) #​1475

v0.6.2: 0.6.2

Compare Source

Security

Fixes

Enhancements

  • Pass token boolean to the listitem function #​1440
  • Allow html without \n after #​1438

CLI

  • Update man page to include --test and fix argv parameters #​1442
  • Add a --version flag to print marked version #​1448

Testing

v0.6.1: 0.6.1

Compare Source

Fixes

Docs

  • Update demo site to use a worker #​1418
  • Update devDependencies to last stable #​1409
  • Update documentation about extending Renderer #​1417
  • Remove --save option as it isn't required anymore #​1422
  • Add snyk badge #​1420

v0.6.0: 0.6.0

Compare Source

Breaking Changes

  • Drop support for Node v0.10 and old browsers such as Internet Explorer
    • You should not have any problems if using Node 4+ or a modern browser
  • Add parameter slugger to Renderer.prototype.heading method #​1401
    • You should not have any problems if you do not override this method

New Features

  • Add new export marked.Slugger #​1401

Fixes

  • Fix emphasis followed by a punctuation #​1383
  • Fix bold around autolink email address #​1385
  • Make autolinks case insensitive #​1384
  • Make code fences compliant with Commonmark spec #​1387
  • Make blockquote paragraph continuation compliant with Commonmark spec #​1394
  • Make ordered list marker length compliant with Commonmark spec #​1391
  • Make empty list items compliant with Commonmark spec #​1395
  • Make tag escaping compliant with Commonmark spec #​1397
  • Make strong/bold compliant with Commonmark spec #​1400
  • Fix handling of adjacent lists #​684
  • Add better error handling when token type cannot be found #​1005
  • Fix duplicate heading id and non-latin characters #​1401

CLI

Docs

Tests

  • Remove old test covered by gfm/cm #​1389

v0.5.2: 0.5.2

Compare Source

Bug Fixes

  • Fix emphasis closing by single _ (part of left-flanking run) #​1351
  • Make URL handling consistent between links and images #​1359

Other

  • Add missing semicolons, add lint rule #​1340
  • Make Steven (@​styfle) a npm publisher #​1346
  • Fix typo in docs: responsibility #​1364
  • Add the ability to specify options on the demo page as JSON #​1357
    • Show red border when JSON options are invalid #​1360
  • Move license file back to root dir #​1356
  • Fix builds: remove node v0.10 from travis matrix #​1366
    • This does not a break compatibility in this release but it will a future release
  • Add files key to package.json to prevent publishing unused files #​1367

v0.5.1: 0.5.1

Compare Source

Security

  • Fix inline code regex and prevent REDOS #​1337
  • Use @markedjs/html-differ to prevent REDOS #​1331

Bug Fixes

  • Fix typographic substitution in (pre|code|kbd|script) blocks when smartypants=true #​1335
  • Fix auto-linking email address #​1338

Other

  • Refactor the escape() function to improve performance 10-20% #​975
  • Update copyright in source code #​1326
  • Update benchmark tests #​1019
  • Add dependency badges to readme #​1333

v0.5.0: 0.5.0

Compare Source

Security

Breaking Changes

  • Fix GFM empty table cells #​1262
  • Fix GFM extended auto-linking requiring multiple backpedals #​1293
  • Fix GFM strikethrough compatibility #​1258
  • Fix issues link references and prototypes #​1299
  • Fix hard line break when backslash at EOL #​1303
  • Fix hyperlinks with parenthesis #​1305
  • Fix loose lists #​1304
  • Fix strong and em #​1315

Docs

  • Fix typo in USING_ADVANCED.md #​1276
  • Add pictures to AUTHORS.md #​1272
  • Change badge to latest version of marked #​1300
  • Change badges from shields.io to badgen.net #​1317
  • Use iframe to sandbox generated html #​1295
  • Add additional links into readme #​1310
  • Add missing parameters for renderer methods #​1311
  • Add undocumented option descriptions #​1312
  • Add navigation sidebar to the docs #​1316

CI

  • Change travis clone depth to 3 #​1270

v0.4.0

Compare Source

Security Fixes

New Features

Breaking Changes

  • Fix escaping pipes in tables (#​1239)
  • Fix html output for tables to match GFM spec (#​1245)
  • Fix many bugs to reach parity with CommonMark spec (#​1135)
  • Fix new Renderer() so it uses default options (#​1203)
  • Fix text and paragraph return types (#​1248) (#​1249)
  • Fix <em> less than 3 chars (#​1181)
  • Fix <pre> code blocks so there is no more trailing \n (#​1266)
  • Fix default langPrefix to follow CommonMark standard language- (#​1265)

CLI Changes

  • Add string argument to CLI (#​1182)
  • Change CLI stdio to remove warning (#​994)

Other changes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate
Copy link
Copy Markdown
Author

renovate Bot commented Mar 24, 2023 •
edited
Loading

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@renovate renovate Bot changed the title fix(deps): update dependency marked to v4 [security] fix(deps): update dependency marked to v4 [security] - abandoned Feb 24, 2024
@renovate
Copy link
Copy Markdown
Author

renovate Bot commented Feb 24, 2024

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@renovate-bot