fix(deps): update dependency trix to v2.1.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
trix (source)	2.1.0 -> 2.1.1

GitHub Vulnerability Alerts

CVE-2024-34341

The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts which are executed within the context of the application.

Vulnerable Versions:

• 1.x series up to and including 1.3.1
• 2.x series up to and including 2.1.0

Fixed Versions:

• v1.3.2
• v2.1.1

Vector:

• Bug 1: When copying content manipulated by a script, such as:

document.addEventListener('copy', function(e){
  e.clipboardData.setData('text/html', '<div><noscript><div class="123</noscript>456<img src=1 onerror=alert(1)//"></div></noscript></div>');
  e.preventDefault();
});

and pasting into the Trix editor, the script within the content is executed.

• Bug 2: Similar execution occurs with content structured as:

document.write(`copy<div data-trix-attachment="{&quot;contentType&quot;:&quot;text/html&quot;,&quot;content&quot;:&quot;&lt;img src=1 onerror=alert(101)&gt;HELLO123&quot;}"></div>me`);

Impact:

An attacker could exploit these vulnerabilities to execute arbitrary JavaScript code within the context of the user's session, potentially leading to unauthorized actions being performed or sensitive information being disclosed.

Remediation:

Update Recommendation: Users should upgrade to Trix editor version 2.1.1 or later, which incorporates proper sanitization of input from copied content.

CSP Enhancement: Additionally, enhancing the Content Security Policy (CSP) to disallow inline scripts can significantly mitigate the risk of such vulnerabilities. Set CSP policies such as script-src 'self' to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using script-src-elem.

References:

• https://github.com/basecamp/trix/releases/tag/v2.1.1
• https://github.com/basecamp/trix/pull/1147
• https://github.com/basecamp/trix/pull/1149
• https://github.com/basecamp/trix/pull/1153

Credit: These issues were reported by security researchers loknop and pinpie.

---

Release Notes

basecamp/trix (trix)

v2.1.1

Compare Source

What's Changed

• Bump tar from 6.2.0 to 6.2.1 by @​dependabot in https://github.com/basecamp/trix/pull/1146
• Sanitize noscript to prevent copy and paste XSS by @​lewispb in https://github.com/basecamp/trix/pull/1147
• Sanitize HTML content in data-trix-* attributes by @​lewispb & @​afcapel in https://github.com/basecamp/trix/pull/1149

New Contributors

• @​lewispb made their first contribution in https://github.com/basecamp/trix/pull/1147

Full Changelog: basecamp/trix@v2.1.0...v2.1.1

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
opencollective-frontend	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 22, 2024 11:26am
opencollective-styleguide	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 22, 2024 11:26am