[BUGFIX] Upgrade to CKEditor4 v4.18.0
Recent CKEditor4 v4.18.0 addressed several vulnerabilities: * CVE-2022-24728 (XSS via attributes & comments) * CVE-2022-24729 (reDoS via Dialog Plugin API) * see https://ckeditor.com/cke4/release/CKEditor-4.18.0 for details Mentioned known vulnerabilities are not considered relevant for the TYPO3 backend user interface. By-passing CKEditor's XSS protection allows to persist malicious markup in database fields, which is mitigated during frontend rendering by typo3/html-sanitizer. That's why this issue is handled as regular bugfix. Executed commands: cd Build/ nvm use yarn add ckeditor4@^4.18.0 rm -r ../typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/ yarn exec grunt build Resolves: #97239 Releases: main, 11.5, 10.4 Change-Id: I3be12120c316b334e7efd237d0300e6d3cd165a8 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74058 Tested-by:core-ci <typo3@b13.com> Tested-by:
Stefan Bürk <stefan@buerk.tech> Tested-by:
Benni Mack <benni@typo3.org> Reviewed-by:
Stefan Bürk <stefan@buerk.tech> Reviewed-by:
Benni Mack <benni@typo3.org>
Showing
- Build/package.json 1 addition, 1 deletionBuild/package.json
- Build/yarn.lock 4 additions, 4 deletionsBuild/yarn.lock
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/ckeditor.js 635 additions, 632 deletions..._ckeditor/Resources/Public/JavaScript/Contrib/ckeditor.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/_translationstatus.txt 1 addition, 1 deletion...ces/Public/JavaScript/Contrib/lang/_translationstatus.txt
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/af.js 2 additions, 2 deletions...e_ckeditor/Resources/Public/JavaScript/Contrib/lang/af.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/ar.js 2 additions, 2 deletions...e_ckeditor/Resources/Public/JavaScript/Contrib/lang/ar.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/az.js 2 additions, 2 deletions...e_ckeditor/Resources/Public/JavaScript/Contrib/lang/az.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/bg.js 2 additions, 2 deletions...e_ckeditor/Resources/Public/JavaScript/Contrib/lang/bg.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/bn.js 2 additions, 2 deletions...e_ckeditor/Resources/Public/JavaScript/Contrib/lang/bn.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/bs.js 3 additions, 3 deletions...e_ckeditor/Resources/Public/JavaScript/Contrib/lang/bs.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/ca.js 2 additions, 2 deletions...e_ckeditor/Resources/Public/JavaScript/Contrib/lang/ca.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/cs.js 3 additions, 3 deletions...e_ckeditor/Resources/Public/JavaScript/Contrib/lang/cs.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/cy.js 2 additions, 2 deletions...e_ckeditor/Resources/Public/JavaScript/Contrib/lang/cy.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/da.js 2 additions, 2 deletions...e_ckeditor/Resources/Public/JavaScript/Contrib/lang/da.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/de-ch.js 2 additions, 2 deletions...keditor/Resources/Public/JavaScript/Contrib/lang/de-ch.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/de.js 2 additions, 2 deletions...e_ckeditor/Resources/Public/JavaScript/Contrib/lang/de.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/el.js 2 additions, 2 deletions...e_ckeditor/Resources/Public/JavaScript/Contrib/lang/el.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/en-au.js 2 additions, 2 deletions...keditor/Resources/Public/JavaScript/Contrib/lang/en-au.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/en-ca.js 2 additions, 2 deletions...keditor/Resources/Public/JavaScript/Contrib/lang/en-ca.js
- typo3/sysext/rte_ckeditor/Resources/Public/JavaScript/Contrib/lang/en-gb.js 2 additions, 2 deletions...keditor/Resources/Public/JavaScript/Contrib/lang/en-gb.js
Please register or sign in to comment