diff --git a/audit.log b/audit.log index 364713bdb..2b09bf892 100644 --- a/audit.log +++ b/audit.log @@ -1,48 +1,23 @@ ┌─────────────────────┬────────────────────────────────────────────────────────┐ -│ moderate │ js-yaml: YAML merge-key chains can force quadratic CPU │ -│ │ consumption in js-yaml │ +│ high │ brace-expansion: DoS via unbounded expansion length │ +│ │ causing an out-of-memory process crash │ ├─────────────────────┼────────────────────────────────────────────────────────┤ -│ Package │ js-yaml │ +│ Package │ brace-expansion │ ├─────────────────────┼────────────────────────────────────────────────────────┤ -│ Vulnerable versions │ >=5.0.0 <=5.1.0 │ +│ Vulnerable versions │ <=5.0.7 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ -│ Patched versions │ >=5.1.1 │ +│ Patched versions │ >=5.0.8 │ ├─────────────────────┼────────────────────────────────────────────────────────┤ -│ Paths │ .>node-yaml-config>js-yaml │ +│ Paths │ .>ejs>jake>filelist>minimatch>brace-expansion │ │ │ │ -│ │ .>mocha>js-yaml │ -├─────────────────────┼────────────────────────────────────────────────────────┤ -│ More info │ https://github.com/advisories/GHSA-g796-fgmg-93mv │ -└─────────────────────┴────────────────────────────────────────────────────────┘ -┌─────────────────────┬────────────────────────────────────────────────────────┐ -│ moderate │ js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap │ -│ │ tag in YAML11_SCHEMA │ -├─────────────────────┼────────────────────────────────────────────────────────┤ -│ Package │ js-yaml │ -├─────────────────────┼────────────────────────────────────────────────────────┤ -│ Vulnerable versions │ >=5.0.0 <=5.2.0 │ -├─────────────────────┼────────────────────────────────────────────────────────┤ -│ Patched versions │ >=5.2.1 │ -├─────────────────────┼────────────────────────────────────────────────────────┤ -│ Paths │ .>node-yaml-config>js-yaml │ +│ │ .>mocha>minimatch>brace-expansion │ │ │ │ -│ │ .>mocha>js-yaml │ -├─────────────────────┼────────────────────────────────────────────────────────┤ -│ More info │ https://github.com/advisories/GHSA-724g-mxrg-4qvm │ -└─────────────────────┴────────────────────────────────────────────────────────┘ -┌─────────────────────┬────────────────────────────────────────────────────────┐ -│ low │ body-parser vulnerable to denial of service when │ -│ │ invalid limit value silently disables size enforcement │ -├─────────────────────┼────────────────────────────────────────────────────────┤ -│ Package │ body-parser │ -├─────────────────────┼────────────────────────────────────────────────────────┤ -│ Vulnerable versions │ >=2.0.0 <2.3.0 │ -├─────────────────────┼────────────────────────────────────────────────────────┤ -│ Patched versions │ >=2.3.0 │ -├─────────────────────┼────────────────────────────────────────────────────────┤ -│ Paths │ .>mock-http-server>body-parser │ +│ │ .>ejs>jake>minimatch>brace-expansion │ +│ │ │ +│ │ ... Found 4 paths, run `pnpm why brace-expansion` for │ +│ │ more information │ ├─────────────────────┼────────────────────────────────────────────────────────┤ -│ More info │ https://github.com/advisories/GHSA-v422-hmwv-36x6 │ +│ More info │ https://github.com/advisories/GHSA-mh99-v99m-4gvg │ └─────────────────────┴────────────────────────────────────────────────────────┘ -3 vulnerabilities found -Severity: 1 low | 2 moderate +1 vulnerabilities found +Severity: 1 high diff --git a/lib/plugins/system/oembed/oembed.js b/lib/plugins/system/oembed/oembed.js index 6e7d6c1ff..3d663e9c2 100644 --- a/lib/plugins/system/oembed/oembed.js +++ b/lib/plugins/system/oembed/oembed.js @@ -114,7 +114,15 @@ export default { getData: function(url, oembedLinks, oembedUtils, options, cb) { - var href = oembedLinks[0].href; + const weights = { + 'application/json+oembed': -1, + 'text/xml+oembed': 1 + } + + var href = oembedLinks.sort( + // Prefer JSON + (a,b) => a.type && b.type && (weights[a.type.toLowerCase()] - weights[b.type.toLowerCase()]) || 0 + )[0].href; var skip = CONFIG.SKIP_OEMBED_RE_LIST && CONFIG.SKIP_OEMBED_RE_LIST.some(re => re.test(href)), diff --git a/lib/plugins/system/oembed/oembedUtils.js b/lib/plugins/system/oembed/oembedUtils.js index 6e1ebf861..ab7ba055a 100644 --- a/lib/plugins/system/oembed/oembedUtils.js +++ b/lib/plugins/system/oembed/oembedUtils.js @@ -379,8 +379,10 @@ function xmlStream2oembed(stream, callback) { } else { if (prop) { - if (charset !== 'UTF-8') { - // Decode only non UTF-8 because sax makes decoding. + if (charset /* !== 'UTF-8' */) { // previouly - Decode only non UTF-8 because sax makes decoding. + // UTF-8 is not decoded by default in July 2026 + // Ex.: https://rutube.ru/video/bf4825090681c5c25312534bab3c7f62/ + var oldValue = value; value = encodeText(charset, value); // log(' -- decode oembed xml (charset, in, out):', charset, oldValue, value); diff --git a/package.json b/package.json index ccdbaa5fe..4a244ad68 100644 --- a/package.json +++ b/package.json @@ -29,7 +29,7 @@ "ejs": "3.1.10", "entities": "1.1.2", "express": "^5.1.0", - "got": "^14.4.4", + "got": "^14.4.5", "graceful-cluster": "^0.0.5", "htmlparser2": "^7.2.0", "iconv-lite": "^0.6.3", @@ -54,7 +54,7 @@ "feedparser": "2.2.10", "mocha": "^11.7.5", "mock-http-server": "^1.4.5", - "mongoose": "^8.22.1", + "mongoose": "^8.24.1", "supertest": "^7.1.4" }, "iframely-proxy-plugins": true, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 09ed79445..f3de6b14f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -58,7 +58,7 @@ importers: specifier: ^5.1.0 version: 5.1.0(supports-color@8.1.1) got: - specifier: ^14.4.4 + specifier: ^14.4.5 version: 14.4.5 graceful-cluster: specifier: ^0.0.5 @@ -128,8 +128,8 @@ importers: specifier: ^1.4.5 version: 1.4.5 mongoose: - specifier: ^8.22.1 - version: 8.24.0 + specifier: ^8.24.1 + version: 8.24.1 supertest: specifier: ^7.1.4 version: 7.1.4(supports-color@8.1.1) @@ -239,10 +239,6 @@ packages: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} - body-parser@2.2.1: - resolution: {integrity: sha512-nfDwkulwiZYQIGwxdy0RUmowMhKcFVcYXUU7m4QlKYim1rUtg83xm2yjZ40QjDuc291AJjjeSc9b++AWHSgSHw==} - engines: {node: '>=18'} - body-parser@2.3.0: resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} engines: {node: '>=18'} @@ -256,9 +252,9 @@ packages: brace-expansion@2.1.2: resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} - brace-expansion@5.0.7: - resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==} - engines: {node: 18 || 20 || >=22} + brace-expansion@5.0.8: + resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} + engines: {node: 20 || >=22} browser-stdout@1.3.1: resolution: {integrity: sha512-qhAVI1+Av2X7qelOfAIYwXONood6XlZE/fXaBSmW/T5SzLAmCgzi+eiWE7fUvbHaeNBQH13UftjpXxsfLkMpgw==} @@ -785,8 +781,8 @@ packages: engines: {node: '>=10'} hasBin: true - js-yaml@5.1.0: - resolution: {integrity: sha512-s8VA5jkR8f22S3NAXmhKPFqGUduqZGlsufabVOgN14iTdw/RXcym7bKkbwjxLK9Yw2lEvvmJjFp119+KPeo8Kg==} + js-yaml@5.2.2: + resolution: {integrity: sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==} hasBin: true jslint@0.12.1: @@ -969,8 +965,8 @@ packages: socks: optional: true - mongoose@8.24.0: - resolution: {integrity: sha512-EEZwOibDPZ5uZN3bFapfnRskEbdljAf6sP9ln6u+P4e5IfkOAh6Tqw2g8/Tag++KHOAJ095WXT/c0uqRq4Vckg==} + mongoose@8.24.1: + resolution: {integrity: sha512-UpHBA0l5kHyKJQFjmBaFYQFo5sgz1DK0TRqDkOyBLYbqiIbKKhIvBpHWBXqeo0rgW4kGI1UhhAw+kTQZoj1BdA==} engines: {node: '>=16.20.1'} mpath@0.9.0: @@ -1132,10 +1128,6 @@ packages: resolution: {integrity: sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==} engines: {node: '>= 0.6'} - raw-body@3.0.1: - resolution: {integrity: sha512-9G8cA+tuMS75+6G/TzW8OtLzmBDMo8p1JRxN5AZ+LAp8uxGA8V8GZm4GQ4/N5QNQEnLmg6SS7wyuSmbKepiKqA==} - engines: {node: '>= 0.10'} - raw-body@3.0.2: resolution: {integrity: sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==} engines: {node: '>= 0.10'} @@ -1469,20 +1461,6 @@ snapshots: balanced-match@4.0.4: {} - body-parser@2.2.1: - dependencies: - bytes: 3.1.2 - content-type: 1.0.5 - debug: 4.4.3 - http-errors: 2.0.0 - iconv-lite: 0.7.0 - on-finished: 2.4.1 - qs: 6.15.2 - raw-body: 3.0.1 - type-is: 2.0.1 - transitivePeerDependencies: - - supports-color - body-parser@2.3.0: dependencies: bytes: 3.1.2 @@ -1508,7 +1486,7 @@ snapshots: dependencies: balanced-match: 1.0.2 - brace-expansion@5.0.7: + brace-expansion@5.0.8: dependencies: balanced-match: 4.0.4 @@ -2079,7 +2057,7 @@ snapshots: filelist: 1.0.4 minimatch: 3.1.5 - js-yaml@5.1.0: + js-yaml@5.2.2: dependencies: argparse: 2.0.1 @@ -2164,7 +2142,7 @@ snapshots: minimatch@10.2.4: dependencies: - brace-expansion: 5.0.7 + brace-expansion: 5.0.8 minimatch@3.1.5: dependencies: @@ -2193,7 +2171,7 @@ snapshots: glob: 13.0.0 he: 1.2.0 is-path-inside: 3.0.3 - js-yaml: 5.1.0 + js-yaml: 5.2.2 log-symbols: 4.1.0 minimatch: 9.0.9 ms: 2.1.3 @@ -2208,7 +2186,7 @@ snapshots: mock-http-server@1.4.5: dependencies: - body-parser: 2.2.1 + body-parser: 2.3.0 connect: 3.7.0 multiparty: 4.3.0 underscore: 1.13.8 @@ -2228,7 +2206,7 @@ snapshots: bson: 6.10.4 mongodb-connection-string-url: 3.0.2 - mongoose@8.24.0: + mongoose@8.24.1: dependencies: bson: 6.10.4 kareem: 2.6.3 @@ -2283,7 +2261,7 @@ snapshots: node-yaml-config@1.0.0: dependencies: - js-yaml: 5.1.0 + js-yaml: 5.2.2 node.extend: 2.0.2 node.extend@2.0.2: @@ -2394,13 +2372,6 @@ snapshots: range-parser@1.2.1: {} - raw-body@3.0.1: - dependencies: - bytes: 3.1.2 - http-errors: 2.0.0 - iconv-lite: 0.7.0 - unpipe: 1.0.0 - raw-body@3.0.2: dependencies: bytes: 3.1.2