[SECURITY] Raise bootstrap 3.4.0 to fix XSS in JS components

Fixes an XSS issue in Alert, Carousel, Collapse, Dropdown, Modal, and Tab components. Executed tasks: cd Build yarn add bootstrap-sass@^3.4.0 --dev yarn exec grunt Then copying the contents of Build/node_modules/bootstrap-sass/assets/javascripts/bootstrap.min.js into typo3/sysext/core/Resources/Public/JavaScript/Contrib/bootstrap/bootstrap.js additionally adding the AMD factory wrapper. Resolves: #86580 Releases: master, 9.5, 8.7 Security-Commit: 786f80ffa1492ad0170487f645216a3d043c0a6d Security-Bulletin: TYPO3-CORE-SA-2019-006 Change-Id: I0bbcb11237de779358eeb6c29e596bf37a7c1649 Reviewed-on: https://review.typo3.org/59531 Reviewed-by: Oliver Hader <[email protected]> Tested-by: Oliver Hader <[email protected]>
TYPO3 · Jan 22, 2019 · d578fd3 · d578fd3
1 parent c94f566
commit d578fd3
Show file tree

Hide file tree

Showing 5 changed files with 9 additions and 38 deletions.
diff --git a/Build/package.json b/Build/package.json
@@ -25,7 +25,7 @@
     "@typo3/icons": "1.8.0",
     "autoprefixer": "^6.3.7",
     "autosize": "^3.0.21",
-    "bootstrap-sass": "^3.3.7",
+    "bootstrap-sass": "^3.4.0",
     "bootstrap-slider": "^9.7.3",
     "chosen-js": "^1.7.0",
     "ckeditor": "^4.11.1",

diff --git a/Build/yarn.lock b/Build/yarn.lock
@@ -694,10 +694,10 @@ [email protected]:
   dependencies:
     hoek "4.x.x"
 
-bootstrap-sass@^3.3.7:
-  version "3.3.7"
-  resolved "https://registry.yarnpkg.com/bootstrap-sass/-/bootstrap-sass-3.3.7.tgz#6596c7ab40f6637393323ab0bc80d064fc630498"
-  integrity sha1-ZZbHq0D2Y3OTMjqwvIDQZPxjBJg=
+bootstrap-sass@^3.4.0:
+  version "3.4.0"
+  resolved "https://registry.yarnpkg.com/bootstrap-sass/-/bootstrap-sass-3.4.0.tgz#b1c330a56782347f626d31d497fa4aea16b3f99b"
+  integrity sha512-qdUyw4KmNNPSIdBadn+eyuuQFH0LsZlRCs6tor1zN8sQas7mnY5JNfemauraOdNPiFQd2gFeeo3gZjZZCuohZg==
 
 bootstrap-slider@^9.7.3:
   version "9.10.0"

diff --git a/typo3/sysext/backend/Resources/Public/Css/backend.css b/typo3/sysext/backend/Resources/Public/Css/backend.css
diff --git a/typo3/sysext/core/Resources/Public/JavaScript/Contrib/bootstrap/.bootstrap.diff b/typo3/sysext/core/Resources/Public/JavaScript/Contrib/bootstrap/.bootstrap.diff
diff --git a/typo3/sysext/core/Resources/Public/JavaScript/Contrib/bootstrap/bootstrap.js b/typo3/sysext/core/Resources/Public/JavaScript/Contrib/bootstrap/bootstrap.js