mirror of
https://github.com/toeverything/AFFiNE.git
synced 2026-07-11 07:06:28 +08:00
renovate[bot]
50f41c2212
This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [happy-dom](https://redirect.github.com/capricorn86/happy-dom) | [`^18.0.0` -> `^20.0.0`](https://renovatebot.com/diffs/npm/happy-dom/18.0.1/20.0.0) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2025-61927](https://redirect.github.com/capricorn86/happy-dom/security/advisories/GHSA-37j7-fg3j-429f) # Escape of VM Context gives access to process level functionality ## Summary Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality. What the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the `require()` function to import modules. Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment. ## Reproduce ### CommonJS (Possible to get hold of require) ```javascript const { Window } = require('happy-dom'); const window = new Window({ console }); window.document.write(` <script> const process = this.constructor.constructor('return process')(); const require = process.mainModule.require; console.log('Files:', require('fs').readdirSync('.').slice(0,3)); </script> `); ``` ### ESM (Not possible to get hold of import or require) ```javascript const { Window } = require('happy-dom'); const window = new Window({ console }); window.document.write(` <script> const process = this.constructor.constructor('return process')(); console.log('PID:', process.pid); </script> `); ``` ## Potential Impact #### Server-Side Rendering (SSR) ```javascript const { Window } = require('happy-dom'); const window = new Window(); window.document.innerHTML = userControlledHTML; ``` #### Testing Frameworks Any test suite using Happy-DOM with untrusted content may be at risk. ## Attack Scenarios 1. **Data Exfiltration**: Access to environment variables, configuration files, secrets 2. **Lateral Movement**: Network access for connecting to internal systems. Happy DOM already gives access to the network by fetch, but has protections in place (such as CORS and header validation etc.). 3. **Code Execution**: Child process access for running arbitrary commands 4. **Persistence**: File system access ## Recommended Immediate Actions 1. Update Happy DOM to v20 or above - This version has JavaScript evaluation disabled by default - This version will output a warning if JavaScript is enabled in an insecure environment 2. Run Node.js with the "--disallow-code-generation-from-strings" if you need JavaScript evaluation enabled - This makes sure that evaluation can't be used at process level to escape the VM - `eval()` and `Function()` can still be used within the Happy DOM VM without any known security risk - Happy DOM v20 and above will output a warning if this flag is not in use 4. If you can't update Happy DOM right now, it's recommended to disable JavaScript evaluation, unless you completely trust the content within the environment ## Technical Root Cause All classes and functions inherit from [Function](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function). By walking the constructor chain it's possible to get hold of [Function](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function) at process level. As [Function](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function) can evaluate code from strings, it's possible to execute code at process level. Running Node with the "--disallow-code-generation-from-strings" flag protects against this. --- ### Release Notes <details> <summary>capricorn86/happy-dom (happy-dom)</summary> ### [`v20.0.0`](https://redirect.github.com/capricorn86/happy-dom/compare/v19.0.2...819d15ba289495439eda8be360d92a614ce22405) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v19.0.2...v20.0.0) ### [`v19.0.2`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v19.0.2) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v19.0.1...v19.0.2) ##### :construction\_worker\_man: Patch fixes - Fixes issue related to CSS pseudo selector `:scope` that didn't work correctly for direct descendants to root - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1620](https://redirect.github.com/capricorn86/happy-dom/issues/1620) ### [`v19.0.1`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v19.0.1) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v19.0.0...v19.0.1) ##### :construction\_worker\_man: Patch fixes - Fixes issue with sending in URLs as string in `@happy-dom/server-renderer` config using CLI - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1908](https://redirect.github.com/capricorn86/happy-dom/issues/1908) ### [`v19.0.0`](https://redirect.github.com/capricorn86/happy-dom/releases/tag/v19.0.0) [Compare Source](https://redirect.github.com/capricorn86/happy-dom/compare/v18.0.1...v19.0.0) ##### 💣 Breaking Changes - Removes support for CommonJS - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Support for CommonJS is no longer needed as Node.js v18 is deprecated and v20 and above supports loading ES modules from CommonJS using `require()` - Updates Jest to v30 in the `@happy-dom/jest-environment` package - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Makes Jest packages peer dependencies to make it easier to align versions with the project using `@happy-dom/jest-environment` - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) ##### 🎨 Features - Adds a new package called `@happy-dom/server-renderer` - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - This package provides a simple way to statically render (SSG) or server-side render (SSR) your client-side application - Read more in the Wiki under [Server-Renderer](https://redirect.github.com/capricorn86/happy-dom/wiki/Server-Renderer) - Adds support for `import.meta` to the ESM compiler - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Adds support for the CSS pseudo selector `:scope` - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1620](https://redirect.github.com/capricorn86/happy-dom/issues/1620) - Improves support for `MediaList` - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Adds support for `CSSKeywordValue`, `CSSStyleValue`, `StylePropertyMap`, `StylePropertyMap`, `StylePropertyMapReadOnly` - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Improves debug information in the ESM compiler - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Adds validation of browser settings when creating a new `Browser` instance - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Adds support for the browser setting [navigation.beforeContentCallback](https://redirect.github.com/capricorn86/happy-dom/wiki/IBrowserSettings) which makes it possible to inject event listeners or logic before content is loaded to the document when navigating a browser frame - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Adds support for the browser setting [fetch.requestHeaders](https://redirect.github.com/capricorn86/happy-dom/wiki/IBrowserSettings) which provides with a declarative and simple way to add request headers - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Adds support for setting an object to [timer.preventTimerLoops](https://redirect.github.com/capricorn86/happy-dom/wiki/IBrowserSettings) which makes it possible to define different settings for `setTimeout()` and `requestAnimationFrame()` - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Adds support for the browser setting [viewport](https://redirect.github.com/capricorn86/happy-dom/wiki/IBrowserSettings) which makes it possible to define a default viewport size - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Adds support for the parameters `beforeContentCallback` and `headers` to `BrowserFrame.goto()`, `BrowserFrame.goBack()`, `BrowserFrame.goForward()`, `BrowserFrame.goSteps()` and `BrowserFrame.reload()` - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Adds support for `PopStateEvent` and trigger the event when navigating the page history using `History.pushState()` - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Use local file paths for virtual server files in stack traces - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Adds support for `ResponseCache.fileSystem.load()` and `ResponseCache.fileSystem.save()` for storing and loading cache from the file system - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) ##### :construction\_worker\_man: Patch fixes - Fixes a bug in the ESM compiler that caused it to fail to parse certain code - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Disables the same origin policy when navigating a browser frame using `BrowserFrame.goto()` - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Fixes bug where CSS selectors with the pseudos "+" and ">" failed for selectors without arguments - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) - Adds try and catch to listeners for events dispatched from `XMLHttpRequest` to prevent it from being set to an invalid state if a listener throws an Error - By **[@​capricorn86](https://redirect.github.com/capricorn86)** in task [#​1730](https://redirect.github.com/capricorn86/happy-dom/issues/1730) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNDMuMSIsInVwZGF0ZWRJblZlciI6IjQxLjE0My4xIiwidGFyZ2V0QnJhbmNoIjoiY2FuYXJ5IiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
174 lines
7.7 KiB
JSON
174 lines
7.7 KiB
JSON
{
|
|
"name": "@affine/monorepo",
|
|
"version": "0.22.4",
|
|
"private": true,
|
|
"author": "toeverything",
|
|
"license": "MIT",
|
|
"workspaces": [
|
|
".",
|
|
"blocksuite/**/*",
|
|
"packages/*/*",
|
|
"packages/common/y-octo/node",
|
|
"packages/frontend/apps/*",
|
|
"tools/*",
|
|
"docs/reference",
|
|
"tools/@types/*",
|
|
"tests/*"
|
|
],
|
|
"engines": {
|
|
"node": "<23.0.0"
|
|
},
|
|
"scripts": {
|
|
"affine": "r affine.ts",
|
|
"af": "r affine.ts",
|
|
"dev": "yarn affine dev",
|
|
"build": "yarn affine build",
|
|
"lint:eslint": "cross-env NODE_OPTIONS=\"--max-old-space-size=8192\" eslint --report-unused-disable-directives-severity=off . --cache",
|
|
"lint:eslint:fix": "yarn lint:eslint --fix --fix-type problem,suggestion,layout",
|
|
"lint:prettier": "prettier --ignore-unknown --cache --check .",
|
|
"lint:prettier:fix": "prettier --ignore-unknown --cache --write .",
|
|
"lint:ox": "oxlint -c oxlint.json --deny-warnings",
|
|
"lint": "yarn lint:eslint && yarn lint:prettier",
|
|
"lint:fix": "yarn lint:eslint:fix && yarn lint:prettier:fix",
|
|
"test": "vitest --run",
|
|
"test:ui": "vitest --ui",
|
|
"test:coverage": "vitest run --coverage",
|
|
"typecheck": "tsc -b tsconfig.json --verbose",
|
|
"postinstall": "yarn affine init && yarn husky"
|
|
},
|
|
"lint-staged": {
|
|
"*": "prettier --write --ignore-unknown --cache",
|
|
"*.{ts,tsx,mjs,js,jsx}": [
|
|
"prettier --ignore-unknown --write",
|
|
"cross-env NODE_OPTIONS=\"--max-old-space-size=8192\" eslint --cache --fix"
|
|
],
|
|
"*.toml": [
|
|
"taplo format"
|
|
],
|
|
"*.rs": [
|
|
"cargo fmt --"
|
|
]
|
|
},
|
|
"devDependencies": {
|
|
"@affine-tools/cli": "workspace:*",
|
|
"@capacitor/cli": "^7.0.0",
|
|
"@eslint/js": "^9.16.0",
|
|
"@faker-js/faker": "^10.0.0",
|
|
"@istanbuljs/schema": "^0.1.3",
|
|
"@magic-works/i18n-codegen": "^0.6.1",
|
|
"@playwright/test": "=1.52.0",
|
|
"@smarttools/eslint-plugin-rxjs": "^1.0.8",
|
|
"@taplo/cli": "^0.7.0",
|
|
"@toeverything/infra": "workspace:*",
|
|
"@types/eslint": "^9.6.1",
|
|
"@types/node": "^22.0.0",
|
|
"@typescript-eslint/parser": "^8.18.0",
|
|
"@vanilla-extract/vite-plugin": "^5.0.0",
|
|
"@vitest/browser": "3.1.3",
|
|
"@vitest/coverage-istanbul": "3.1.3",
|
|
"@vitest/ui": "3.1.3",
|
|
"cross-env": "^7.0.3",
|
|
"electron": "^35.0.0",
|
|
"eslint": "^9.16.0",
|
|
"eslint-config-prettier": "^10.0.0",
|
|
"eslint-import-resolver-typescript": "^4.0.0",
|
|
"eslint-plugin-import-x": "^4.5.0",
|
|
"eslint-plugin-react": "^7.37.2",
|
|
"eslint-plugin-react-hooks": "^5.1.0",
|
|
"eslint-plugin-simple-import-sort": "^12.1.1",
|
|
"eslint-plugin-sonarjs": "^3.0.1",
|
|
"eslint-plugin-unicorn": "^59.0.0",
|
|
"happy-dom": "^20.0.0",
|
|
"husky": "^9.1.7",
|
|
"lint-staged": "^16.0.0",
|
|
"msw": "^2.6.8",
|
|
"oxlint": "~1.18.0",
|
|
"prettier": "^3.4.2",
|
|
"semver": "^7.6.3",
|
|
"serve": "^14.2.4",
|
|
"typescript": "^5.7.2",
|
|
"typescript-eslint": "^8.18.0",
|
|
"unplugin-swc": "^1.5.1",
|
|
"vite": "^6.0.3",
|
|
"vitest": "3.1.3"
|
|
},
|
|
"packageManager": "yarn@4.9.1",
|
|
"resolutions": {
|
|
"array-buffer-byte-length": "npm:@nolyfill/array-buffer-byte-length@^1",
|
|
"array-includes": "npm:@nolyfill/array-includes@^1",
|
|
"array.prototype.flat": "npm:@nolyfill/array.prototype.flat@^1",
|
|
"array.prototype.flatmap": "npm:@nolyfill/array.prototype.flatmap@^1",
|
|
"array.prototype.tosorted": "npm:@nolyfill/array.prototype.tosorted@^1",
|
|
"arraybuffer.prototype.slice": "npm:@nolyfill/arraybuffer.prototype.slice@^1",
|
|
"asynciterator.prototype": "npm:@nolyfill/asynciterator.prototype@^1",
|
|
"available-typed-arrays": "npm:@nolyfill/available-typed-arrays@^1",
|
|
"deep-equal": "npm:@nolyfill/deep-equal@^1",
|
|
"define-properties": "npm:@nolyfill/define-properties@^1",
|
|
"es-iterator-helpers": "npm:@nolyfill/es-iterator-helpers@^1",
|
|
"es-set-tostringtag": "npm:@nolyfill/es-set-tostringtag@^1",
|
|
"function-bind": "npm:@nolyfill/function-bind@^1",
|
|
"function.prototype.name": "npm:@nolyfill/function.prototype.name@^1",
|
|
"get-symbol-description": "npm:@nolyfill/get-symbol-description@^1",
|
|
"globalthis": "npm:@nolyfill/globalthis@^1",
|
|
"gopd": "npm:@nolyfill/gopd@^1",
|
|
"has": "npm:@nolyfill/has@^1",
|
|
"has-property-descriptors": "npm:@nolyfill/has-property-descriptors@^1",
|
|
"has-proto": "npm:@nolyfill/has-proto@^1",
|
|
"has-symbols": "npm:@nolyfill/has-symbols@^1",
|
|
"has-tostringtag": "npm:@nolyfill/has-tostringtag@^1",
|
|
"is-arguments": "npm:@nolyfill/is-arguments@^1",
|
|
"is-array-buffer": "npm:@nolyfill/is-array-buffer@^1",
|
|
"is-date-object": "npm:@nolyfill/is-date-object@^1",
|
|
"is-generator-function": "npm:@nolyfill/is-generator-function@^1",
|
|
"is-regex": "npm:@nolyfill/is-regex@^1",
|
|
"is-shared-array-buffer": "npm:@nolyfill/is-shared-array-buffer@^1",
|
|
"is-string": "npm:@nolyfill/is-string@^1",
|
|
"is-symbol": "npm:@nolyfill/is-symbol@^1",
|
|
"is-weakref": "npm:@nolyfill/is-weakref@^1",
|
|
"iterator.prototype": "npm:@nolyfill/iterator.prototype@^1",
|
|
"json-stable-stringify": "npm:@nolyfill/json-stable-stringify@^1",
|
|
"jsonify": "npm:@nolyfill/jsonify@^1",
|
|
"object-is": "npm:@nolyfill/object-is@^1",
|
|
"object-keys": "npm:@nolyfill/object-keys@^1",
|
|
"object.assign": "npm:@nolyfill/object.assign@^1",
|
|
"object.entries": "npm:@nolyfill/object.entries@^1",
|
|
"object.fromentries": "npm:@nolyfill/object.fromentries@^1",
|
|
"object.hasown": "npm:@nolyfill/object.hasown@^1",
|
|
"object.values": "npm:@nolyfill/object.values@^1",
|
|
"on-headers": "npm:on-headers@^1.1.0",
|
|
"reflect.getprototypeof": "npm:@nolyfill/reflect.getprototypeof@^1",
|
|
"regexp.prototype.flags": "npm:@nolyfill/regexp.prototype.flags@^1",
|
|
"safe-array-concat": "npm:@nolyfill/safe-array-concat@^1",
|
|
"safe-regex-test": "npm:@nolyfill/safe-regex-test@^1",
|
|
"side-channel": "npm:@nolyfill/side-channel@^1",
|
|
"string.prototype.matchall": "npm:@nolyfill/string.prototype.matchall@^1",
|
|
"string.prototype.trim": "npm:@nolyfill/string.prototype.trim@^1",
|
|
"string.prototype.trimend": "npm:@nolyfill/string.prototype.trimend@^1",
|
|
"string.prototype.trimstart": "npm:@nolyfill/string.prototype.trimstart@^1",
|
|
"typed-array-buffer": "npm:@nolyfill/typed-array-buffer@^1",
|
|
"typed-array-byte-length": "npm:@nolyfill/typed-array-byte-length@^1",
|
|
"typed-array-byte-offset": "npm:@nolyfill/typed-array-byte-offset@^1",
|
|
"typed-array-length": "npm:@nolyfill/typed-array-length@^1",
|
|
"unbox-primitive": "npm:@nolyfill/unbox-primitive@^1",
|
|
"which-boxed-primitive": "npm:@nolyfill/which-boxed-primitive@^1",
|
|
"which-typed-array": "npm:@nolyfill/which-typed-array@^1",
|
|
"array-flatten": "npm:@nolyfill/array-flatten@^1",
|
|
"array.prototype.findlast": "npm:@nolyfill/array.prototype.findlast@^1",
|
|
"hasown": "npm:@nolyfill/hasown@^1",
|
|
"internal-slot": "npm:@nolyfill/internal-slot@^1",
|
|
"is-core-module": "npm:@nolyfill/is-core-module@^1",
|
|
"is-typed-array": "npm:@nolyfill/is-typed-array@^1",
|
|
"isarray": "npm:@nolyfill/isarray@^1",
|
|
"safe-buffer": "npm:@nolyfill/safe-buffer@^1",
|
|
"safer-buffer": "npm:@nolyfill/safer-buffer@^1",
|
|
"set-function-length": "npm:@nolyfill/set-function-length@^1",
|
|
"string.prototype.repeat": "npm:@nolyfill/string.prototype.repeat@^1",
|
|
"typedarray": "npm:@nolyfill/typedarray@^1",
|
|
"macos-alias": "npm:@napi-rs/macos-alias@0.0.4",
|
|
"fs-xattr": "npm:@napi-rs/xattr@latest",
|
|
"decode-named-character-reference@npm:^1.0.0": "patch:decode-named-character-reference@npm%3A1.0.2#~/.yarn/patches/decode-named-character-reference-npm-1.0.2-db17a755fd.patch",
|
|
"@atlaskit/pragmatic-drag-and-drop": "patch:@atlaskit/pragmatic-drag-and-drop@npm%3A1.4.0#~/.yarn/patches/@atlaskit-pragmatic-drag-and-drop-npm-1.4.0-75c45f52d3.patch",
|
|
"yjs": "patch:yjs@npm%3A13.6.21#~/.yarn/patches/yjs-npm-13.6.21-c9f1f3397c.patch"
|
|
}
|
|
}
|