🚨 [security] Update svelte 3.42.1 → 4.2.19 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ svelte (3.42.1 → 4.2.19) · Repo · Changelog

Security Advisories 🚨

🚨 Svelte has a potential mXSS vulnerability due to improper HTML escaping

Summary

A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.

Details

Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:

• If the string is an attribute value:
  • " -> "
  • & -> &
  • Other characters -> No conversion
• Otherwise:
  • < -> <
  • & -> &
  • Other characters -> No conversion

The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.

PoC

A vulnerable page (+page.svelte):

<script>
import { page } from "$app/stores"
// user input

let href = $page.url.searchParams.get("href") ?? "https://example.com";

</script>
<noscript>

<a href={href}>test</a>

</noscript>

If a user accesses the following URL,

http://localhost:4173/?href=</noscript><script>alert(123)</script>

then, alert(123) will be executed.

Impact

XSS, when using an attribute within a noscript tag

🚨 Svelte vulnerable to XSS when using objects during server-side rendering

The package svelte before 3.49.0 is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.

Release Notes

Too many releases to show here. View the full release notes.

🆕 @​ampproject/remapping (added, 2.3.0)

🆕 @​jridgewell/gen-mapping (added, 0.3.5)

🆕 @​jridgewell/resolve-uri (added, 3.1.2)

🆕 @​jridgewell/set-array (added, 1.2.1)

🆕 @​jridgewell/sourcemap-codec (added, 1.5.0)

🆕 @​jridgewell/trace-mapping (added, 0.3.25)

🆕 aria-query (added, 5.3.0)

🆕 axobject-query (added, 4.1.0)

🆕 code-red (added, 1.0.4)

🆕 css-tree (added, 2.3.1)

🆕 dequal (added, 2.0.3)

🆕 locate-character (added, 3.0.0)

🆕 mdn-data (added, 2.0.30)

🆕 periscopic (added, 3.1.0)

🆕 source-map-js (added, 1.2.0)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)