Skip to content

Commit 671e6ea

Browse files
committedMay 7, 2024··
Force isEvalSupported to false
Fixes [GHSA-wgrm-67xf-hhpq](GHSA-wgrm-67xf-hhpq)
1 parent a662cfc commit 671e6ea

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed
 

‎packages/react-pdf/src/Document.tsx

+1-1
Original file line numberDiff line numberDiff line change
@@ -505,7 +505,7 @@ const Document = forwardRef(function Document(
505505
return;
506506
}
507507

508-
const optionsWithModifiedIsEvalSupported: Options = { ...options, isEvalSupported: true };
508+
const optionsWithModifiedIsEvalSupported: Options = { ...options, isEvalSupported: false };
509509

510510
const documentInitParams: Source = {
511511
...source,

2 commit comments

Comments
 (2)

vinodkumarsharma276 commented on May 15, 2024

@vinodkumarsharma276

Hi @wojtekmaj ,
We are using v4.2.0 and recently got a security issue mentioning isEvalSupported: true can cause issues.
I bumped react-pdf to v7.* which should fix the security thread with isEvalSupported: false but I'm getting typing issues.

One of the issue:

We are using component and passing customTextRenderer as:

customTextRederer = (textInfo: { str: string; itemIndex: number }) => {
return (
<span
<..Some span attributes>

);
};

while building the project getting error:

_```
Type '(textInfo: { str: string; itemIndex: number;}) => React.JSX.Element' is not assignable to type 'CustomTextRenderer'.
ERR! Type 'Element' is not assignable to type 'string'.
ERR!
ERR! 117 customTextRenderer={this.customTextRenderer}
ERR! ~~~~~~~~~~~~~~~~~~


I saw the the type of the customTextRenderer is changed to:

export type CustomTextRenderer = (props: {
pageIndex: number;
pageNumber: number;
itemIndex: number;
} & TextItem) => string;


Can we patch this commit with isEvalSupported =  false to v4.2.* ?

wojtekmaj commented on May 15, 2024

@wojtekmaj
OwnerAuthor

Path for upgrade is clearly outlined both in Wiki and release notes for every major version.
Only v7 and v8 have received a patch and I'm not planning to support older versions.
Read more: #1786

Please sign in to comment.