Skip to content

Commit e449bae

Browse files
jag-jjag-j
authored
Merge pull request #1720 from forcedotcom/m2d/v4.8.0
Main2Dev @W-17291574@ Merging main-4 to dev-4 after v4.8.0
2 parents b380618 + 07d13ae commit e449bae

File tree

4 files changed

+1716
-1358
lines changed

4 files changed

+1716
-1358
lines changed

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "@salesforce/sfdx-scanner",
33
"description": "Static code scanner that applies quality and security rules to Apex code, and provides feedback.",
4-
"version": "4.7.0",
4+
"version": "4.8.0",
55
"author": "Salesforce Code Analyzer Team",
66
"bugs": "https://github.com/forcedotcom/sfdx-scanner/issues",
77
"dependencies": {

‎retire-js/RetireJsVulns.json‎

Lines changed: 112 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2576,6 +2576,23 @@
25762576
"https://github.com/dojo/dojo/pull/307"
25772577
]
25782578
},
2579+
{
2580+
"below": "1.2.0",
2581+
"severity": "medium",
2582+
"cwe": [
2583+
"CWE-79"
2584+
],
2585+
"identifiers": {
2586+
"summary": "Versions of dojo prior to 1.2.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize HTML code in user-controlled input, allowing attackers to execute arbitrary JavaScript in the victim's browser.",
2587+
"CVE": [
2588+
"CVE-2015-5654"
2589+
],
2590+
"githubID": "GHSA-p82g-2xpp-m5r3"
2591+
},
2592+
"info": [
2593+
"https://nvd.nist.gov/vuln/detail/CVE-2015-5654"
2594+
]
2595+
},
25792596
{
25802597
"atOrAbove": "1.2",
25812598
"below": "1.2.4",
@@ -2670,23 +2687,6 @@
26702687
"https://github.com/dojo/dojo/pull/307"
26712688
]
26722689
},
2673-
{
2674-
"below": "1.9.1",
2675-
"severity": "medium",
2676-
"cwe": [
2677-
"CWE-79"
2678-
],
2679-
"identifiers": {
2680-
"summary": "Versions of dojo prior to 1.2.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize HTML code in user-controlled input, allowing attackers to execute arbitrary JavaScript in the victim's browser.",
2681-
"CVE": [
2682-
"CVE-2015-5654"
2683-
],
2684-
"githubID": "GHSA-p82g-2xpp-m5r3"
2685-
},
2686-
"info": [
2687-
"https://nvd.nist.gov/vuln/detail/CVE-2015-5654"
2688-
]
2689-
},
26902690
{
26912691
"atOrAbove": "1.10.0",
26922692
"below": "1.10.10",
@@ -4365,6 +4365,28 @@
43654365
"https://github.com/cure53/DOMPurify/releases"
43664366
]
43674367
},
4368+
{
4369+
"atOrAbove": "0",
4370+
"below": "2.4.2",
4371+
"cwe": [
4372+
"CWE-1321"
4373+
],
4374+
"severity": "high",
4375+
"identifiers": {
4376+
"summary": "DOMPurify vulnerable to tampering by prototype polution",
4377+
"CVE": [
4378+
"CVE-2024-48910"
4379+
],
4380+
"githubID": "GHSA-p3vf-v8qc-cwcr"
4381+
},
4382+
"info": [
4383+
"https://github.com/advisories/GHSA-p3vf-v8qc-cwcr",
4384+
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr",
4385+
"https://nvd.nist.gov/vuln/detail/CVE-2024-48910",
4386+
"https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc",
4387+
"https://github.com/cure53/DOMPurify"
4388+
]
4389+
},
43684390
{
43694391
"atOrAbove": "0",
43704392
"below": "2.5.0",
@@ -5106,6 +5128,27 @@
51065128
"https://github.com/advisories/GHSA-4p24-vmcr-4gqj"
51075129
]
51085130
},
5131+
{
5132+
"atOrAbove": "1.4.0",
5133+
"below": "3.4.1",
5134+
"cwe": [
5135+
"CWE-79"
5136+
],
5137+
"severity": "medium",
5138+
"identifiers": {
5139+
"summary": "Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes",
5140+
"CVE": [
5141+
"CVE-2024-6485"
5142+
],
5143+
"githubID": "GHSA-vxmc-5x29-h64v"
5144+
},
5145+
"info": [
5146+
"https://github.com/advisories/GHSA-vxmc-5x29-h64v",
5147+
"https://nvd.nist.gov/vuln/detail/CVE-2024-6485",
5148+
"https://github.com/twbs/bootstrap",
5149+
"https://www.herodevs.com/vulnerability-directory/cve-2024-6485"
5150+
]
5151+
},
51095152
{
51105153
"atOrAbove": "3.0.0",
51115154
"below": "3.4.1",
@@ -5744,6 +5787,27 @@
57445787
"info": [
57455788
"https://github.com/vuejs/vue/releases/tag/v2.6.11"
57465789
]
5790+
},
5791+
{
5792+
"atOrAbove": "2.0.0-alpha.1",
5793+
"below": "3.0.0-alpha.0",
5794+
"cwe": [
5795+
"CWE-1333"
5796+
],
5797+
"severity": "low",
5798+
"identifiers": {
5799+
"summary": "ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function",
5800+
"CVE": [
5801+
"CVE-2024-9506"
5802+
],
5803+
"githubID": "GHSA-5j4c-8p2g-v4jx"
5804+
},
5805+
"info": [
5806+
"https://github.com/advisories/GHSA-5j4c-8p2g-v4jx",
5807+
"https://nvd.nist.gov/vuln/detail/CVE-2024-9506",
5808+
"https://github.com/vuejs/core",
5809+
"https://www.herodevs.com/vulnerability-directory/cve-2024-9506"
5810+
]
57475811
}
57485812
],
57495813
"extractors": {
@@ -5757,11 +5821,16 @@
57575821
],
57585822
"filecontent": [
57595823
"/\\*!\\n \\* Vue.js v(§§version§§)",
5824+
"/\\*\\*?!?\\n ?\\* vue v(§§version§§)",
57605825
"Vue.version = '(§§version§§)';",
57615826
"'(§§version§§)'[^\\n]{0,8000}Vue compiler",
57625827
"\\* Original file: /npm/vue@(§§version§§)/dist/vue.(global|common).js",
57635828
"const version[ ]*=[ ]*\"(§§version§§)\";[\\s]*/\\*\\*[\\s]*\\* SSR utils for \\\\@vue/server-renderer",
5764-
"\\.__vue_app__=.{0,8000}?const [a-z]+=\"(§§version§§)\","
5829+
"\\.__vue_app__=.{0,8000}?const [a-z]+=\"(§§version§§)\",",
5830+
"let [A-Za-z]+=\"(§§version§§)\",..=\"undefined\"!=typeof window&&window.trustedTypes;if\\(..\\)try\\{.=..\\.createPolicy\\(\"vue\",",
5831+
"isCustomElement.{1,5}?compilerOptions.{0,500}exposeProxy.{0,700}\"(§§version§§)\"",
5832+
"\"(§§version§§)\"[\\s\\S]{0,150}\\.createPolicy\\(\"vue\"",
5833+
"devtoolsFormatters[\\s\\S]{50,180}\"(§§version§§)\"[\\s\\S]{50,180}\\.createElement\\(\"template\"\\)"
57655834
]
57665835
}
57675836
},
@@ -6250,7 +6319,7 @@
62506319
},
62516320
{
62526321
"below": "3.8.0",
6253-
"severity": "high",
6322+
"severity": "medium",
62546323
"cwe": [
62556324
"CWE-22"
62566325
],
@@ -6679,7 +6748,7 @@
66796748
]
66806749
},
66816750
{
6682-
"atOrAbove": "13.4.0",
6751+
"atOrAbove": "13.3.1",
66836752
"below": "13.5.0",
66846753
"cwe": [
66856754
"CWE-400"
@@ -6814,6 +6883,29 @@
68146883
"https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda",
68156884
"https://github.com/vercel/next.js"
68166885
]
6886+
},
6887+
{
6888+
"atOrAbove": "9.5.5",
6889+
"below": "14.2.15",
6890+
"cwe": [
6891+
"CWE-285"
6892+
],
6893+
"severity": "high",
6894+
"identifiers": {
6895+
"summary": "Next.js authorization bypass vulnerability",
6896+
"CVE": [
6897+
"CVE-2024-51479"
6898+
],
6899+
"githubID": "GHSA-7gfc-8cq8-jh5f"
6900+
},
6901+
"info": [
6902+
"https://github.com/advisories/GHSA-7gfc-8cq8-jh5f",
6903+
"https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f",
6904+
"https://nvd.nist.gov/vuln/detail/CVE-2024-51479",
6905+
"https://github.com/vercel/next.js/commit/1c8234eb20bc8afd396b89999a00f06b61d72d7b",
6906+
"https://github.com/vercel/next.js",
6907+
"https://github.com/vercel/next.js/releases/tag/v14.2.15"
6908+
]
68176909
}
68186910
],
68196911
"extractors": {

‎test/lib/actions/RuleListAction.test.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ describe("Tests for RuleListAction", () => {
5858
await ruleListAction.run(inputs);
5959

6060
let tableData: Ux.Table.Data[] = display.getLastTableData();
61-
expect(tableData).to.have.length(223);
61+
expect(tableData).to.have.length(230);
6262

6363
for (const rowData of tableData) {
6464
expect(rowData.engine).to.equal('eslint-lwc');

0 commit comments

Comments
 (0)