Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Disable eval support in pdfjs #5694

Merged
merged 1 commit into from
Jun 10, 2024
Merged

Disable eval support in pdfjs #5694

merged 1 commit into from
Jun 10, 2024

Conversation

thornbill
Copy link
Member

Changes
Disables eval support in pdfjs to prevent XSS vulnerability

Refs: GHSA-wgrm-67xf-hhpq

Issues
N/A

@thornbill thornbill added stable backport Backport into the next stable release security This PR or issue mainly concerns security labels Jun 10, 2024
@thornbill thornbill added this to the v10.9.7 milestone Jun 10, 2024
@thornbill thornbill requested a review from a team as a code owner June 10, 2024 15:59
@sonarcloud SonarCloud
Copy link

sonarcloud bot commented Jun 10, 2024

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

@thornbill thornbill merged commit 4bb0c67 into jellyfin:release-10.9.z Jun 10, 2024
9 checks passed
@thornbill thornbill mentioned this pull request Jun 10, 2024
Closed
joshuaboniface pushed a commit that referenced this pull request Jun 23, 2024
@thornbill @joshuaboniface
Backport pull request #5694 from jellyfin-web/release-10.9.z
2cbc9e4 
Disable eval support in pdfjs

Original-merge: 4bb0c67

Merged-by: thornbill <thornbill@users.noreply.github.com>

Backported-by: Joshua M. Boniface <joshua@boniface.me>
@jellyfin-bot jellyfin-bot removed the stable backport Backport into the next stable release label Jun 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@scampower3 scampower3 scampower3 approved these changes

Assignees
No one assigned
Labels
security This PR or issue mainly concerns security
Projects
No open projects
Release 10.9.z
Status: Done
Milestone
v10.9.7
Development

Successfully merging this pull request may close these issues.
3 participants
@thornbill @scampower3 @jellyfin-bot