🤝 Sync alphagov/main into this repository
#5
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Pages that are indexed in search results have their entire contents indexed, including any HTML code snippets. These HTML snippets would appear in the search results unsanitised, so it was possible to render arbitrary HTML or run arbitrary scripts: >  >  This is a largely theoretical security issue; to exploit it, an attacker would need to find a way of committing malicious code to a page indexed by a site that uses tech-docs-gem (which are typically not editable by untrusted users). Their code would also be limited by the relatively short length that's rendered in the corresponding search result. Nevertheless, the XSS would then be triggerable by visiting a pre-constructed URL (`/search/index.html?q=some+search+term`), which users could be tricked into clicking on through social engineering. This commit sanitises the HTML before rendering it to the page. It does so whilst retaining the `<mark data-markjs="true">` behaviour that highlights the search term in the result: >  I've used jQuery's `text()` function for sanitisation, as that is the approach used elsewhere in the project ([1]). I did consider using native JavaScript (using the same approach as in Mustache [2]) to avoid the jQuery dependency, but this itself may contain bugs and would lead to having two sanitisation approaches to maintain, so I opted against it. For future reference, the code in this commit can be swapped out with: ```js var entityMap = { '&': '&', '<': '<', '>': '>', '"': '"', "'": '&alphagov#39;', '/': '/', '`': '`', '=': '=' }; var sanitizedContent = String(content).replace(/[&<>"'`=\/]/g, function (s) { return entityMap[s]; }); ``` [1]: https://github.com/alphagov/tech-docs-gem/blob/66cc7ab0a06dc2f1fe89de8cba2270fcf46f6466/lib/assets/javascripts/_modules/search.js#L202-L204 [2]: https://github.com/janl/mustache.js/blob/972fd2b27a036888acfcb60d6119317744fac7ee/mustache.js#L60-L75
Fix XSS vulnerability on search results page
Release v3.3.1
Use latest long term support (LTS) version of Node.js for tests and publishing. Also use the new version 2 lockfile format for current versions of npm.
Use current latest stable release of Ruby for tests. Ruby 2.7 reached end of life on 2023-03-31. We still test on the older version for completeness, as Middleman v4 plans to keep support for Ruby 2.7 indefinitely [[1]]. [1]: middleman/middleman#2614 (comment)
Ran `bundle exec rubocop -a` then fixed the rest by hand.
middleman-syntax does not support Haml 6 [[1]]. However, it does not place any restriction on the version of Haml used, so bundler will try and install the latest version of Haml. This commit adds a restriction on the version of Haml in our gemspec. This is a bit of a hack, as we don't actually require Haml ourselves, but it will make our tests pass and provide a better experience for our users until middleman-syntax is fixed. [1]: middleman/middleman-syntax#80
Add tests for Ruby 3.x support
GitHub Actions is warning about deprecation of Node 12 actions, bump actions/checkout to fix this.
GitHub Actions has deprecated the use of the `set-output` command [[1]], we should use environment files instead. [1]: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
The ruby/setup-ruby action needs a version of Ruby specified to work. Previously it was reading the `.ruby-version` file, however we removed that in commit 2aa58cc. We could restore that file, but because `ruby-install` doesn't support loose version specifiers, we'd have to keep it maintained. Instead we just tell the action to install the latest version of Ruby 3.
…ing header and footer links.
Specify Ruby version for publish workflow
…-when-generating-relative-links TRG-668: Support sites deployed on a path other than "/" when generating header and footer links.
Release v3.4.0
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We're 20 commits behind, this brings this repository up to date and also includes the changes which were made in this repository.