Update dependency dompurify to v2.0.17 #241

renovate · 2020-09-22T20:23:15Z

renovate commented

2020-09-22 20:23:15 +00:00

This PR contains the following updates:

Package	Type	Update	Change
dompurify	dependencies	patch	`2.0.15` -> `2.0.17`

Release Notes

cure53/DOMPurify

`v2.0.17`

Compare Source

Fixed another bypass causing mXSS by using MathML

`v2.0.16`

Compare Source

Fixed an mXSS-based bypass caused by nested forms inside MathML
Fixed a security error thrown on older Chrome on Android versions, see #470

Credits for the bypass go to Michał Bentkowski (@securityMB) of Securitum who spotted the bug in Chrome, turned it into another DOMPurify bypass, reported and helped verifying the fix 🙇‍♂️ 🙇‍♀️

Renovate configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [dompurify](https://github.com/cure53/DOMPurify) | dependencies | patch | [`2.0.15` -> `2.0.17`](https://renovatebot.com/diffs/npm/dompurify/2.0.15/2.0.17) | --- ### Release Notes <details> <summary>cure53/DOMPurify</summary> ### [`v2.0.17`](https://github.com/cure53/DOMPurify/releases/2.0.17) [Compare Source](https://github.com/cure53/DOMPurify/compare/2.0.16...2.0.17) - Fixed another bypass causing mXSS by using MathML ### [`v2.0.16`](https://github.com/cure53/DOMPurify/releases/2.0.16) [Compare Source](https://github.com/cure53/DOMPurify/compare/2.0.15...2.0.16) - Fixed an mXSS-based bypass caused by nested forms inside MathML - Fixed a security error thrown on older Chrome on Android versions, see [#470](https://github.com/cure53/DOMPurify/issues/470) Credits for the bypass go to Michał Bentkowski ([@securityMB](https://github.com/securityMB)) of Securitum who spotted the bug in Chrome, turned it into another DOMPurify bypass, reported and helped verifying the fix :bowing_man: :bowing_woman: </details> --- ### Renovate configuration 📅 **Schedule**: At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻️ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate added the

dependencies

label 2020-09-22 20:23:15 +00:00

renovate added 1 commit 2020-09-22 20:23:16 +00:00