Bump rails-html-sanitizer from 1.0.4 to 1.4.4

[dependabot]

Bumps rails-html-sanitizer from 1.0.4 to 1.4.4.

Release notes

Sourced from rails-html-sanitizer's releases.

1.4.4 / 2022-12-13

• Address inefficient regular expression complexity with certain configurations of Rails::Html::Sanitizer.

  Fixes CVE-2022-23517. See GHSA-5x79-w82f-gw8w for more information.

  Mike Dalessio

• Address improper sanitization of data URIs.

  Fixes CVE-2022-23518 and #135. See GHSA-mcvf-2q2m-x72m for more information.

  Mike Dalessio

• Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

  Fixes CVE-2022-23520. See GHSA-rrfc-7g8p-99q8 for more information.

  Mike Dalessio

• Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

  Fixes CVE-2022-23519. See GHSA-9h9g-93gc-623h for more information.

  Mike Dalessio

1.4.3 / 2022-06-09

• Address a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

  Prevent the combination of select and style as allowed tags in SafeListSanitizer.

  Fixes CVE-2022-32209

  Mike Dalessio

1.4.2 / 2021-08-23

• Slightly improve performance.

  Assuming elements are more common than comments, make one less method call per node.

1.4.1 / 2021-08-18

• Fix regression in v1.4.0 that did not pass comment nodes to the scrubber.

  Some scrubbers will want to override the default behavior and allow comments, but v1.4.0 only passed through elements to the scrubber's keep_node? method.

... (truncated)

Changelog

Sourced from rails-html-sanitizer's changelog.

1.4.4 / 2022-12-13

• Address inefficient regular expression complexity with certain configurations of Rails::Html::Sanitizer.

  Fixes CVE-2022-23517. See GHSA-5x79-w82f-gw8w for more information.

  Mike Dalessio

• Address improper sanitization of data URIs.

  Fixes CVE-2022-23518 and #135. See GHSA-mcvf-2q2m-x72m for more information.

  Mike Dalessio

• Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

  Fixes CVE-2022-23520. See GHSA-rrfc-7g8p-99q8 for more information.

  Mike Dalessio

• Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

  Fixes CVE-2022-23519. See GHSA-9h9g-93gc-623h for more information.

  Mike Dalessio

1.4.3 / 2022-06-09

• Address a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

  Prevent the combination of select and style as allowed tags in SafeListSanitizer.

  Fixes CVE-2022-32209

  Mike Dalessio

1.4.2 / 2021-08-23

• Slightly improve performance.

  Assuming elements are more common than comments, make one less method call per node.

... (truncated)

Commits

• fd63dea version bump to v1.4.4
• 48ae90a dep: bump dependency on loofah
• 0713caf fix: escape CDATA nodes using Loofah's escaping methods
• e6d52d3 revert 45a5c10
• d1223a2 fix: use Loofah's scrub_uri_attribute method
• f0e3347 fix: replace slow regex attribute check with Loofah method
• df03f2f ci: pin system lib test to 20.04
• 3e2a0f3 Merge pull request #145 from rails/flavorjones-get-14x-green
• 11752a6 tests: handle libxml 2.10.0 incorrectly-opened comment parsing
• f83f08c version bump to v1.4.3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[guardrails]

⚠️ We detected 65 security issues in this pull request:

Vulnerable Libraries (37)

Severity	Details
Medium	jquery-ui@1.8.23 upgrade to: >1.13.2
Medium	jquery@1.8.3 upgrade to: >3.5.0
Medium	jquery-validation@1.17.0 upgrade to: >1.19.3
High	moment.js@2.19.0 upgrade to: >2.29.4
High	actionpack@5.1.7 upgrade to: ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1
High	actionview@5.1.7 upgrade to: ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1
High	activerecord@5.1.7 upgrade to: ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1
High	activesupport@5.1.7 upgrade to: ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1
High	json@5.1.7 upgrade to: ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1
High	nokogiri@5.1.7 upgrade to: ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1
High	rack@5.1.7 upgrade to: ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1
High	rails-html-sanitizer@5.1.7 upgrade to: ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1
High	tzinfo@5.1.7 upgrade to: ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1
High	rake@5.1.7 upgrade to: ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1
High	websocket-extensions@5.1.7 upgrade to: ~> 5.2.4, >= 5.2.4.3, >= 6.0.3.1
Low	pkg:gem/actioncable@5.1.7@5.1.7 - no patch available
Medium	pkg:gem/thor@0.19.4@0.19.4 - no patch available
High	pkg:gem/i18n@1.6.0@1.6.0 - no patch available
High	pkg:gem/tzinfo@1.2.5@1.2.5 upgrade to: 0.3.61,1.2.10
Medium	pkg:gem/cucumber@3.1.2@3.1.2 - no patch available
Critical	pkg:gem/railties@5.1.7@5.1.7 - no patch available
High	pkg:gem/websocket-extensions@0.1.3@0.1.3 upgrade to: 0.1.5
Medium	pkg:gem/activesupport@5.1.7@5.1.7 - no patch available
High	pkg:gem/json@2.2.0@2.2.0 upgrade to: 2.3.0
Medium	pkg:gem/loofah@2.2.3@2.2.3 - no patch available
Medium	pkg:gem/rails@5.1.7@5.1.7 - no patch available
Medium	pkg:gem/rails-html-sanitizer@1.0.4@1.0.4 - no patch available
Medium	pkg:gem/eventmachine@1.2.7@1.2.7 - no patch available
Medium	pkg:gem/jquery-rails@4.3.3@4.3.3 - no patch available
Medium	pkg:gem/rack@2.0.7@2.0.7 upgrade to: 1.6.12,2.0.8
High	pkg:gem/rake@12.3.2@12.3.2 - no patch available
Medium	pkg:gem/puma@3.12.1@3.12.1 upgrade to: 3.12.4,4.3.3
Medium	pkg:gem/actionview@5.1.7@5.1.7 upgrade to: 5.2.4.4,6.0.3.3
High	pkg:gem/better_errors@2.5.1@2.5.1 - no patch available
High	pkg:gem/addressable@2.6.0@2.6.0 upgrade to: 2.8.0
Critical	pkg:gem/nokogiri@1.10.2@1.10.2 upgrade to: 1.10.4,1.0.7
Low	pkg:gem/actionpack@5.1.7@5.1.7 - no patch available

More info on how to fix Vulnerable Libraries in JavaScript and Ruby.

---

Insecure Processing of Data (17)

Docs	Details
💡	Title: Potential XSS (Rails), Severity: Medium railsgoat/app/controllers/password_resets_controller.rb Line 36 in b2222bb flash[:error] = "There was an issue sending password reset email to #{params[:email]}".html_safe unless params[:email].nil?
💡	Title: Insecure Deserialization (Marshal), Severity: High railsgoat/app/controllers/password_resets_controller.rb Line 6 in b2222bb user = Marshal.load(Base64.decode64(params[:user])) unless params[:user].nil?
💡	Title: Potential XSS, Severity: Medium railsgoat/app/views/layouts/application.html.erb Line 12 in b2222bb <style>body { font-size:<%= raw cookies[:font] %> !important;}</style>
💡	Title: Potential XSS (unquoted template variable), Severity: Medium railsgoat/app/views/admin/analytics.html.erb Line 9 in b2222bb <table class="table table-striped table-hover table-bordered pull-left <%= "custom" if params[:field] %>" id="data-table">
💡	Title: Potential XSS (link_to), Severity: Medium railsgoat/app/views/messages/show.html.erb Line 26 in b2222bb <td><%= link_to "Delete", user_message_path, {:id => "@message.id", :method => 'delete', :class => "btn btn-danger pull-left"}%></td>
💡	Title: Potential XSS (link_to), Severity: Medium railsgoat/app/views/user_mailer/forgot_password.html.erb Line 16 in b2222bb <%= link_to "Click here to reset your password", @url %><br>
💡	Title: Potential XSS (html_safe) in ERB template, Severity: Medium railsgoat/app/views/layouts/shared/_header.html.erb Line 31 in b2222bb Welcome, <%= current_user.first_name.html_safe %>
💡	Title: Potential XSS (html_safe) in ERB template, Severity: Medium railsgoat/app/views/layouts/shared/_header.html.erb Line 82 in b2222bb $("#modal_div").load(<%= credentials_tutorials_path.inspect.html_safe %>);
💡	Title: Potential XSS (html_safe) in ERB template, Severity: Medium railsgoat/app/views/messages/index.html.erb Line 114 in b2222bb url: <%= "/users/#{current_user.id}/messages.json".inspect.html_safe %>,
💡	Title: Potential XSS (html_safe) in ERB template, Severity: Medium railsgoat/app/views/paid_time_off/index.html.erb Line 135 in b2222bb events: <%= get_pto_schedule_schedule_index_path(:format => "json").inspect.html_safe %>,
💡	Title: Potential XSS (html_safe) in ERB template, Severity: Medium railsgoat/app/views/paid_time_off/index.html.erb Line 160 in b2222bb [ <%= "As of today: #{Date.today}".inspect.html_safe %>, <%= @pto.sick_days_earned %>, <%= @pto.sick_days_taken %>, <%= @pto.sick_days_remaining %> ], ]);
💡	Title: Potential XSS (html_safe) in ERB template, Severity: Medium railsgoat/app/views/paid_time_off/index.html.erb Line 194 in b2222bb [ <%= "As of today: #{Date.today}".inspect.html_safe %>, <%= @pto.pto_earned %>, <%= @pto.pto_taken %>, <%= @pto.pto_days_remaining %> ], ]);
💡	Title: Potential XSS (html_safe) in ERB template, Severity: Medium railsgoat/app/views/performance/index.html.erb Line 63 in b2222bb [ <%= "#{p.date_submitted}".inspect.html_safe %>, <%= p.score %> ],
💡	Title: Potential XSS (html_safe) in ERB template, Severity: Medium railsgoat/app/views/users/account_settings.html.erb Line 87 in b2222bb url: <%= "/users/#{current_user.id}.json".inspect.html_safe %>,
💡	Title: Potential XSS (content_tag) in ERB template, Severity: Medium railsgoat/app/views/layouts/shared/_messages.html.erb Line 6 in b2222bb <%= content_tag :div, msg, :id => "flash_notice" %>
💡	Title: Potential XSS (content_tag) in ERB template, Severity: Medium railsgoat/app/views/layouts/shared/_messages.html.erb Line 11 in b2222bb <%= content_tag :div, msg, :id => "flash_notice" %>
💡	Title: Potential XSS (content_tag) in ERB template, Severity: Medium railsgoat/app/views/layouts/shared/_messages.html.erb Line 16 in b2222bb <%= content_tag :div, msg, :id => "flash_notice" %>

More info on how to fix Insecure Processing of Data in Ruby.

---

Insecure Use of Language/Framework API (2)

Docs	Details
💡	Title: User Controlled Method Invocation, Severity: Medium railsgoat/config/initializers/strong_parameters.rb Line 2 in b2222bb ActiveRecord::Base.send(:include, ActiveModel::ForbiddenAttributesProtection)
💡	Title: User Controlled Method Invocation, Severity: Medium railsgoat/app/controllers/dashboard_controller.rb Line 16 in b2222bb self.try(params[:graph])

More info on how to fix Insecure Use of Language/Framework API in Ruby.

---

Insecure Use of Dangerous Function (4)

Docs	Details
💡	Title: Potential OS Command Injection, Severity: High railsgoat/app/models/benefits.rb Line 15 in b2222bb silence_streams(STDERR) { system("cp #{full_file_name} #{data_path}/bak#{Time.zone.now.to_i}_#{file.original_filename}") }
💡	Title: Unsafe Constantize, Severity: Medium railsgoat/app/controllers/api/v1/mobile_controller.rb Line 17 in b2222bb model = params[:class].classify.constantize
💡	Title: Unsafe Constantize, Severity: Medium railsgoat/app/controllers/api/v1/mobile_controller.rb Line 10 in b2222bb model = params[:class].classify.constantize
💡	Title: Unsafe Constantize, Severity: Medium railsgoat/app/controllers/benefit_forms_controller.rb Line 11 in b2222bb file = params[:type].constantize.new(path)

More info on how to fix Insecure Use of Dangerous Function in Ruby.

---

Hard-Coded Secrets (2)

Docs	Details
💡	Title: Hard-coded Password (Session Secret), Severity: Medium railsgoat/config/initializers/secret_token.rb Line 9 in b2222bb Railsgoat::Application.config.secret_key_base = "2f1d90a26236c3245d96f5606c201a780dc9ca687e5ed82b45e211bb5dc84c1870f61ca9e002dad5dd8a149c9792d8f07f31a9575065cca064bd6af44f8750e4"
💡	Title: Hex High Entropy String, Severity: Medium railsgoat/config/initializers/secret_token.rb Line 8 in b2222bb Railsgoat::Application.config.secret_token = "2f1d90a26236c3245d96f5606c201a780dc9ca687e5ed82b45e211bb5dc84c1870f61ca9e002dad5dd8a149c9792d8f07f31a9575065cca064bd6af44f8750e4"

More info on how to fix Hard-Coded Secrets in Ruby and General.

---

Insecure Use of SQL Queries (1)

Docs	Details
💡	Title: Potential SQL Injection, Severity: High railsgoat/app/controllers/users_controller.rb Line 29 in b2222bb user = User.where("id = '#{params[:user][:id]}'")[0]

More info on how to fix Insecure Use of SQL Queries in Ruby.

---

Insecure Use of Regular Expressions (1)

Docs	Details
💡	Title: Improper Regex Anchors, Severity: Low railsgoat/app/models/user.rb Line 13 in b2222bb validates_format_of :email, with: /.+@.+\..+/i

More info on how to fix Insecure Use of Regular Expressions in Ruby.

---

Insecure File Management (1)

Docs	Details
💡	Title: Insecure File Access, Severity: High railsgoat/app/controllers/benefit_forms_controller.rb Line 12 in b2222bb send_file file, disposition: "attachment"

More info on how to fix Insecure File Management in Ruby.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.