WS-2018-0022 (Medium) detected in angular-sanitize-1.5.0.js

[mend-for-github-com]

WS-2018-0022 - Medium Severity Vulnerability

Vulnerable Library - angular-sanitize-1.5.0.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.0/angular-sanitize.js

Path to dependency file: /node_modules/ui-select/docs-out/demo-tagging.html

Path to vulnerable library: /node_modules/ui-select/docs-out/demo-tagging.html,/node_modules/ui-select/docs/index.html,/node_modules/ui-select/docs-built/demo-object-as-source.html

Dependency Hierarchy:

• ❌ angular-sanitize-1.5.0.js (Vulnerable Library)

Found in HEAD commit: 1674c97b7650cfe7549a39b0ce4527f9692c7b67

Found in base branch: main

Vulnerability Details

XSS vulnerability in angular.js (1.6.8 and before)

Publish Date: 2018-01-06

URL: WS-2018-0022

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-01-06

Fix Resolution: 1.6.9

[AMoo-Miki]

Probably needs a bump in ui-select

[ananzh]

The angular-sanitize module is specifically related to AngularJS, and it's used to sanitize HTML content. Currently it is used in legacy discover which we will remove in 2.10. There is another usage in tile_map

// TODO: Determine why visualizations don't populate without this
import 'angular-sanitize';

I think we should have map team to check on this. I will contact them and follow up here.

[ananzh]

We have removed angularJS dependencies in main. Close this issue.

[joshuarrrr]

Resolved via #5086