Skip to content

DataFormsJS v5.14.5

Latest
Latest
Compare
Choose a tag to compare
@ConradSollitt ConradSollitt released this 10 Sep 06:26
· 6 commits to master since this release
5.14.5
2df5276
  • Security update for the starter/example webserver that is included with the main project.
    • The file app.js uses a custom express-like API with a minimal web server which allows DataFormsJS examples to run using Node.js built-in features and no outside dependencies.
    • A Path traversal vulnerability was found with credit thanks to Hamidreza Hamidi and Jafar Akhoundali.
    • The issue was decodeURIComponent was called out of order allowing for Proof-of-concept (POC) Path traversal attacks on a local developer machine using URLs such as http://127.0.0.1:8080/..%2fpackage.json or bash 127.0.0.1:8080/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
    • This impacts the development download of the project but not the NPM published release.
  • Replaced CDN https://unpkg.com/ with https://www.jsdelivr.com/
    • The property jsxLoader.babelUrl was changed and can be set back to unpkg if needed by setting the URL prior to the page being loaded.
    • All example pages and apps referenced unpkg for React and related libraries.
    • Even though IE is no longer supported it still works on legacy Windows Servers but unpkg blocks it from downloading CDN content. Given this fact, its possible they may block other browsers in the future so switching to jsDelivr helps avoid issues were code could break and it allows jsxLoader plus all React examples to work out of the box for IE again.
  • Updated several ImageGallery React and Web Components so that css @media screen and (-ms-high-contrast: active), screen and (-ms-high-contrast: none) {} would only be included if the browser is IE 11.
    • Edge browser started giving a deprecation warning when using this CSS media query.
    • Additionally, the main site, the playground site, and many examples were updated to dynamically handle the CSS media query for IE but not other browsers.
  • Fixed Unit Tests for React and Preact pages
  • Updated Unit Tests to run from Port 4000 instead of Port 5000 because Port 5000 is now used by default on Mac for AirPlay and was causing a conflict when running tests on a Mac.
Assets 2
Loading