Repository navigation
Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval - #29
Merged
Merged
Conversation
xfournet
changed the title
Author
|
hi @7rulnik! would be possible to have this PR merged and released ? let me know if something is missing |
Owner
|
@xfournet I will take a look on Monday, thanks |
Author
|
hi @7rulnik ! Hope you're doing well. Did you get a chance to review this PR? |
Owner
|
@xfournet I guess it's better late than never… Thanks and sorry that it took soooo long. I should have set up CI/CD right away but did not expect that someone will actually contribute to this packages. I want to try a few optimizations and will release new version in couple of days |
7rulnik
added a commit
that referenced
this pull request
Sep 30, 2026
Owner
|
it even took longer, huh. |
1 task
meta-codesync Bot
pushed a commit
to facebook/memlab
that referenced
this pull request
Oct 9, 2026
Summary: Bumps [[https://github.com/7rulnik/source-map-js | source-map-js]] from 1.2.1 to 1.2.2. == Release notes == //Sourced from [[https://github.com/7rulnik/source-map-js/releases | source-map-js's releases]].// > **v1.2.2** > > - Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval ([[7rulnik/source-map-js#29 | #29]]) [[https://github.com/xfournet | @xfournet]] > - Fix denial of service from malicious indexed source maps (CVE-2026-93749) ([[7rulnik/source-map-js#79 | #79]]) Reported by [[https://github.com/waydeshi | @waydeshi]] in [[7rulnik/source-map-js#76 | #76]]. A fix was also proposed by [[https://github.com/aniebiet | @aniebiet]] in [[7rulnik/source-map-js#78 | #78]]. == Changelog == //Sourced from [[https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md | source-map-js's changelog]].// > **1.2.2** > > - Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval ([[7rulnik/source-map-js#29 | #29]]) [[https://github.com/xfournet | @xfournet]] > - Fix denial of service from malicious indexed source maps (CVE-2026-93749) ([[7rulnik/source-map-js#79 | #79]]) Reported by [[https://github.com/waydeshi | @waydeshi]] in [[7rulnik/source-map-js#76 | #76]]. A fix was also proposed by [[https://github.com/aniebiet | @aniebiet]] in [[7rulnik/source-map-js#78 | #78]]. == Commits == - [[7rulnik/source-map-js@0a1d334 | 0a1d334]] 1.2.2 - [[7rulnik/source-map-js@4c6fa26 | 4c6fa26]] Update changelog - [[7rulnik/source-map-js@cf76580 | cf76580]] Fix denial of service from malicious indexed source maps (CVE-2026-93749) ([[7rulnik/source-map-js#79 | #79]]) - [[7rulnik/source-map-js@7899a86 | 7899a86]] Fix crash when executing browser with CSP script-src that don't permit unsafe... - See full diff in [[7rulnik/source-map-js@v1.2.1...v1.2.2 | compare view]] Pull Request resolved: #161 Reviewed By: boujeepossum Differential Revision: D124273775 Pulled By: JacksonGL fbshipit-source-id: db3ef2c2a265f6211e8bbcf6cda1ca4c3b890c6e
vharseko
pushed a commit
to OpenIdentityPlatform/OpenAM
that referenced
this pull request
Oct 12, 2026
…source-map section offsets (1.2.1 -> 1.2.2) (#1168) Bumps `source-map-js` from 1.2.1 to 1.2.2 in `openam-ui/openam-ui-js-sdk` (`package-lock.json` only), clearing Dependabot alert #363. `openam-ui-js-sdk` is the only lock file in the repository that resolves `source-map-js`. ## Advisory **CVE-2026-93749 / GHSA-68fv-2mgg-jv7q** (fixed in 1.2.2) — Improper validation of specified index, position, or offset in input (CWE-1284). An indexed source map (`{ "sections": [...] }`) carries a per-section `offset.line` that was never validated. Fed through `SourceNode.fromStringWithSourceMap`, it drives a line-padding loop that pushes one newline per line up to that offset, so a tiny map with a huge `offset.line` blocks the event loop for an attacker-chosen time, and `1e999` (which `JSON.parse` yields as `Infinity`) ends in `RangeError: Invalid array length`. The fix (7rulnik/source-map-js#79) closes four amplification paths reachable from untrusted map input: - section offsets must be non-negative safe integers, and `offset.line` is capped at 10,000,000 including the summed offsets of nested sections; - the `IndexedSourceMapConsumer` `sources` getter, which was exponential in nesting depth, reads each section once; - `_serializeMappings` builds large `;` gaps as one flat string instead of a rope that could exhaust the heap; - `fromStringWithSourceMap` stops padding once the generated code is exhausted. | | Severity | Affected | Fixed in | |---|---|---|---| | GHSA-68fv-2mgg-jv7q | High — CVSS 3.1 7.5 (`AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`) | >= 1.0.0, < 1.2.2 | 1.2.2 | Availability-only: no code execution, no data exposure. ## Impact on OpenAM None at runtime, none in practice in the build. `source-map-js` is a transitive development dependency of `openam-ui-js-sdk` (`dev: true`), pulled in by `postcss` 8.5.23 (under `vite` 8.0.16), `sass` 1.93.2 and `css-tree` 3.1.0 (under `jsdom` via `cssstyle` and `@asamuzakjp/dom-selector`). No OpenAM source imports it, and it does not end up in the SDK bundle (`target/lib`, `target/app`) or the WAR — the runtime dependencies are only `react`, `react-dom` and `react-router`. The Maven build reaches these tools through `npm run build` (Vite, which compiles `src/index.scss` through Sass) and `npm run test:run` (Vitest with jsdom). What they read is the repository's own source — `src/index.scss` has no `@import` / `@use` — and the packages pinned in the lock file, never a source map from outside, so the attacker-supplied indexed source map the advisory requires does not exist here. The bump takes the development toolchain out of the vulnerable range. ## Change The `node_modules/source-map-js` entry in `openam-ui/openam-ui-js-sdk/package-lock.json`: 1.2.1 → 1.2.2 (`version`, `resolved`, `integrity`). `package.json` is untouched — `postcss` asks for `^1.2.1`, `css-tree` for `^1.0.1` and `sass` for `>=0.6.2 <2.0.0`, all satisfied by 1.2.2. No code change; 1.2.2 additionally stops crashing in browsers whose CSP `script-src` forbids `unsafe-eval` (7rulnik/source-map-js#29), which does not apply to a build-time dependency. Verified: - the lock file `integrity` matches `npm view source-map-js@1.2.2 dist.integrity` - `node_modules/source-map-js` is the only `source-map-js` entry in this lock file ## References - GHSA-68fv-2mgg-jv7q - https://nvd.nist.gov/vuln/detail/CVE-2026-93749 - 7rulnik/source-map-js#76 - 7rulnik/source-map-js#79 - https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2 Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Graceful fallback to 'unoptimized' code when eval is not available (eg in a browser with CSP that don't allow unsafe-eval)