chore(deps): update dependency marked to v4 [security] #8037

renovate · 2022-01-14T23:30:52Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
marked (source)	`^2.0.0` -> `^4.0.0`

GitHub Vulnerability Alerts

CVE-2022-21680

Impact

What kind of vulnerability is it?

Denial of service.

The regular expression block.def may cause catastrophic backtracking against some strings.
PoC is the following.

import * as marked from "marked";

marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);

Who is impacted?

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

Patches

Has the problem been patched?

Yes

What versions should users upgrade to?

4.0.10

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

Open an issue in marked

CVE-2022-21681

Impact

What kind of vulnerability is it?

Denial of service.

The regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings.
PoC is the following.

import * as marked from 'marked';

console.log(marked.parse(`[x]: x

\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));

Who is impacted?

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

Patches

Has the problem been patched?

Yes

What versions should users upgrade to?

4.0.10

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Do not run untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

Open an issue in marked

Bug Fixes

Convert to ESM (#2227) (4afb228)

BREAKING CHANGES

Default export removed. Use import { marked } from 'marked' or const { marked } = require('marked') instead.
/lib/marked.js removed. Use /marked.min.js in script tag instead.
When using marked in a script tag use marked.parse(...) instead of marked(...)

`v3.0.8`

Compare Source

Bug Fixes

walkTokens uses marked as this (#2251) (2da5885)

`v3.0.7`

Compare Source

Bug Fixes

use named exports only for ESM build (#2226)

`v3.0.6`

Compare Source

Bug Fixes

Remove esm interop (#2225) (4bc9121)

`v3.0.5`

Compare Source

Bug Fixes

Expose named exports for ESM build (#2223) (3959651)

`v3.0.4`

Compare Source

Bug Fixes

fix detection of orphaned emStrong delimiters (#2203) (7792adc)

`v3.0.3`

Compare Source

Bug Fixes

fix space at end of table line (#2201) (910f0f0)

`v3.0.2`

Compare Source

Bug Fixes

stop table at lines with only whitespace (#2188) (21268ab)

`v3.0.1`

Compare Source

Bug Fixes

fix gfm urls after link (#2186) (e03b5c1)

`v3.0.0`

Compare Source

Bug Fixes

Tokenizers lex their own child tokens (#2124) (288f1cb)
Add module field to package.json (#2143) (edc2e6d)
Drop node 10 support (#2157) (433b16f)
Full Commonmark compliance for Lists (#2112) (eb33d3b)
Refactor table tokens (#2166) (bc400ac)

BREAKING CHANGES

Drop support for node 10.
Add module field to package.json

Tokenizers will create their own tokens with this.lexer.inline(text, tokens). The inline function will queue the token creation until after all block tokens are created.
Extensions tokenizer this object will include the lexer as a property. this.inlineTokens becomes this.lexer.inline.
Extensions renderer this object will include the parser as a property. this.parseInline becomes this.parser.parseInline.
tag and inlineText tokenizer function signatures have changed.

nptable tokenizer is removed and merged with table tokenizer.
table tokens header property changed to contain an array of objects for each header cell with text and tokens properties.
table tokens cells property changed to rows and is an array of rows where each row contains an array of objects for each cell with text and tokens properties.

v2 table token:

{
  "type": "table",
  "align": [null, null],
  "raw": "| a | b |\n|---|---|\n| 1 | 2 |\n",
  "header": ["a", "b"],
  "cells": [["1", "2"]],
  "tokens": {
    "header": [
      [{ "type": "text", "raw": "a", "text": "a" }],
      [{ "type": "text", "raw": "b", "text": "b" }]
    ],
    "cells": [[
      [{ "type": "text", "raw": "1", "text": "1" }],
      [{ "type": "text", "raw": "2", "text": "2" }]
    ]]
  }
}

v3 table token:

{
  "type": "table",
  "align": [null, null],
  "raw": "| a | b |\n|---|---|\n| 1 | 2 |\n",
  "header": [
    {
      "text": "a",
      "tokens": [{ "type": "text", "raw": "a", "text": "a" }]
    },
    {
      "text": "b",
      "tokens": [{ "type": "text", "raw": "b", "text": "b" }]
    }
  ],
  "rows": [
    {
      "text": "1",
      "tokens": [{ "type": "text", "raw": "1", "text": "1" }]
    },
    {
      "text": "2",
      "tokens": [{ "type": "text", "raw": "2", "text": "2" }]
    }
  ]
}

`v2.1.3`

Compare Source

Bug Fixes

update commonmark spec to v0.30 (#2113) (62d6a0e)

`v2.1.2`

Compare Source

Bug Fixes

add Node.js 10 to CI and loosen engines field (#2119) (8659353)

`v2.1.1`

Compare Source

Bug Fixes

fix node v12 (#2109) (af14068)

`v2.1.0`

Compare Source

Features

Custom Tokenizer/Renderer extensions (#2043) (5be9d6d)

`v2.0.7`

Compare Source

Bug Fixes

em strong (#2075) (825a9f8)

`v2.0.6`

Compare Source

Bug Fixes

fix autolink email after single space (#2073) (6c9a899)

`v2.0.5`

Compare Source

Bug Fixes

call walkTokens when calling marked with a callback(#2060) (1d97308)

`v2.0.4`

Compare Source

Bug Fixes

Fix indented markdown in html (#2052) (6435ac9)

`v2.0.3`

Compare Source

Bug Fixes

actually add a type property to the def token (#2002) (47e65cf)

`v2.0.2`

Compare Source

Bug Fixes

add type property on def token (#2001) (009427f)

`v2.0.1`

Compare Source

Bug Fixes

fix items between lists (#1936) (46cdfc1)

Configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Renovate will not automatically rebase this PR, because other commits have been found.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by WhiteSource Renovate. View repository job log here.

ibmdotcom-bot · 2022-01-14T23:45:56Z

Deploy preview created for package React:
https://ibmdotcom-react.s3.us-south.cloud-object-storage.appdomain.cloud/deploy-previews/8037/index.html

Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511

ibmdotcom-bot · 2022-01-14T23:52:07Z

Deploy preview created for package NextJS Test Application:
https://ibmdotcom-nextjs-test-upstream.s3.us-east.cloud-object-storage.appdomain.cloud/deploy-previews/8037/index.html

Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511

ibmdotcom-bot · 2022-01-14T23:54:21Z

Deploy preview created for package Web Components HTML Test Application:
https://ibmdotcom-web-components-html-test-upstream.s3.us-east.cloud-object-storage.appdomain.cloud/deploy-previews/8037/index.html

Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511

ibmdotcom-bot · 2022-01-14T23:54:42Z

Deploy preview created for package Web Components (React wrapper):
https://ibmdotcom-web-components-react.s3-web.us-east.cloud-object-storage.appdomain.cloud/deploy-previews/8037/index.html

Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511

ibmdotcom-bot · 2022-01-14T23:59:06Z

Deploy preview created for package Web Components:
https://ibmdotcom-webcomponents.s3.us-east.cloud-object-storage.appdomain.cloud/deploy-previews/8037/index.html

Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511

ibmdotcom-bot · 2022-01-15T00:06:57Z

Deploy preview created for package "Web Components (Codesandbox Examples)":
https://webcomponents-codesandbox.s3-web.us-east.cloud-object-storage.appdomain.cloud/deploy-previews/8037/index.html

Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511

ibmdotcom-bot · 2022-01-15T00:30:48Z

Deploy preview created for package "React (Codesandbox Examples)":
https://react-codesandbox.s3-web.us-east.cloud-object-storage.appdomain.cloud/deploy-previews/8037/index.html

Built with commit: fa8868aa0deb436df06a59e2cadea82f63d8e511

emyarod · 2022-01-18T19:08:37Z

it looks like the react unit tests are failing because it cannot find the marked package when importing. I think the reason why is because our files in @carbon/ibmdotcom-react are importing from the published @carbon/ibmdotcom-utilities, so the imports won't resolve properly until this is merged and published in a new release

jeffchew · 2022-01-18T20:18:32Z

it looks like the react unit tests are failing because it cannot find the marked package when importing. I think the reason why is because our files in @carbon/ibmdotcom-react are importing from the published @carbon/ibmdotcom-utilities, so the imports won't resolve properly until this is merged and published in a new release

One way I can think of to get around this is to set a resolution in package.json in the root to resolve to v4. We can move the resolution out once everything is merged and published.

emyarod · 2022-01-19T16:32:04Z

@jeffchew I'm not sure if setting the yarn resolutions would work here since the issue is in the currently published version of the utilities package which doesn't use the new import method for marked, unless I am misunderstanding

emyarod · 2022-01-27T18:39:15Z

snapshots should be fixed with the latest updates now, related #7935

jeffchew

LGTM!

renovate bot requested a review from a team as a code owner January 14, 2022 23:30

renovate bot requested review from oliviaflory and annawen1 January 14, 2022 23:30

This was referenced Jan 18, 2022

chore(deps): bump marked from 2.0.0 to 4.0.10 #8042

Closed

[Inefficient Regular Expression Complexity in marked]: high vulnerability found in @carbon/ibmdotcom-react #8048

Closed

renovate bot force-pushed the renovate/npm-marked-vulnerability branch 2 times, most recently from f478451 to 9b120c7 Compare January 18, 2022 16:44

emyarod force-pushed the renovate/npm-marked-vulnerability branch from d9dbf8c to ce48872 Compare January 18, 2022 17:49

emyarod force-pushed the renovate/npm-marked-vulnerability branch 2 times, most recently from ce48872 to 727c8ad Compare January 19, 2022 14:56

emyarod force-pushed the renovate/npm-marked-vulnerability branch 6 times, most recently from 5342eb3 to 3c0be57 Compare January 21, 2022 15:48

ariellalgilmore mentioned this pull request Jan 24, 2022

[npm vulnerabilities]: dependency marked needs to be update #8130

Closed

2 tasks

renovate bot force-pushed the renovate/npm-marked-vulnerability branch 2 times, most recently from 2174b51 to e75bd11 Compare January 25, 2022 03:54

emyarod force-pushed the renovate/npm-marked-vulnerability branch from e75bd11 to 2278c32 Compare January 25, 2022 15:37

renovate-bot and others added 10 commits January 26, 2022 15:31

chore(deps): update dependency marked to v4 [security]

1f52888

fix: use updated marked import

81febe1

chore: bump marked version

bfe9a1b

chore: update snapshots

69fde6b

chore: set marked package resolution

4ca8329

chore: use canary utilities package

c57e728

chore(utilities): temporarily switch to canary version

fa95ea0

test(services-store): add ignore pattern for utilities package

4e981e9

chore(deps): removed global resolutions for marked

e54eeb5

test(jest): add utilities package to transform ignore rule

7d44d71

emyarod force-pushed the renovate/npm-marked-vulnerability branch from 2278c32 to 7d44d71 Compare January 26, 2022 21:32

emyarod added 3 commits January 27, 2022 12:05

chore: combine storybook build and visual snapshot scripts

a9a56b0

docs: update markdown spacing for lists

74e0013

docs: update content-block-copy size prop

612bace

chore: update snapshots

108312f

jeffchew approved these changes Jan 28, 2022

View reviewed changes

jeffchew added the Ready to merge Label for the pull requests that are ready to merge label Jan 28, 2022

jeffchew and others added 2 commits January 28, 2022 17:05

Merge branch 'main' into renovate/npm-marked-vulnerability

f892d5f

Merge branch 'main' into renovate/npm-marked-vulnerability

fa8868a

kodiakhq bot merged commit 3f7bf20 into main Jan 28, 2022

kodiakhq bot deleted the renovate/npm-marked-vulnerability branch January 28, 2022 23:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency marked to v4 [security] #8037

chore(deps): update dependency marked to v4 [security] #8037

renovate bot commented Jan 14, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 14, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 14, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 14, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 14, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 14, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 15, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 15, 2022 •

edited

Loading

emyarod commented Jan 18, 2022

jeffchew commented Jan 18, 2022

emyarod commented Jan 19, 2022

emyarod commented Jan 27, 2022

jeffchew left a comment

chore(deps): update dependency marked to v4 [security] #8037

chore(deps): update dependency marked to v4 [security] #8037

Conversation

renovate bot commented Jan 14, 2022 • edited Loading

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

References

For more information

Impact

Patches

Workarounds

References

For more information

Release Notes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

BREAKING CHANGES

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

BREAKING CHANGES

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Configuration

ibmdotcom-bot commented Jan 14, 2022 • edited Loading

ibmdotcom-bot commented Jan 14, 2022 • edited Loading

ibmdotcom-bot commented Jan 14, 2022 • edited Loading

ibmdotcom-bot commented Jan 14, 2022 • edited Loading

ibmdotcom-bot commented Jan 14, 2022 • edited Loading

ibmdotcom-bot commented Jan 15, 2022 • edited Loading

ibmdotcom-bot commented Jan 15, 2022 • edited Loading

emyarod commented Jan 18, 2022

jeffchew commented Jan 18, 2022

emyarod commented Jan 19, 2022

emyarod commented Jan 27, 2022

jeffchew left a comment

Choose a reason for hiding this comment

renovate bot commented Jan 14, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 14, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 14, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 14, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 14, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 14, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 15, 2022 •

edited

Loading

ibmdotcom-bot commented Jan 15, 2022 •

edited

Loading