Bump dompurify to a version >= 3.1.3 & => 2.5.4

[tasso94]

Acceptance Criteria (Required on creation)

Bump dompurify to a version >= 3.1.3

Hints

Links

• https://jira.camunda.com/browse/SEC-1120
• https://jira.camunda.com/browse/SEC-1150

Breakdown

Pull Requests

Preview Give feedback

1. chore(webapps, engine-rest/docs): bump dompurify #4892
   +0
   
2. https://github.com/camunda/camunda-bpm-platform-maintenance/pull/1348
3. https://github.com/camunda/camunda-bpm-platform-maintenance/pull/1349
4. https://github.com/camunda/camunda-bpm-platform-maintenance/pull/1350

Dev2QA handover

• Does this ticket need a QA test and the testing goals are not clear from the description? Add a Dev2QA handover comment

[venetrius]

Engine rest docs use 2.4.7 updated issue title to specify min. bump version for 2.x as well.

[venetrius]

/set-version-labels

[venetrius]

I realised that webapps already uses a safe version of dompurify ( CE uses 3.1.3 in all Camunda version, EE uses mixed versions >=3.1.6) 🙃 🙃
The package-lock.json does contain both 3.1.2 (vulnerable) & 3.1.3 (safe) versions in CE but version is resolved to 3.1.3. I think this is what confused me when qualifying the security tickets.
engine-rest/docs/ uses a vulnerable 2.4.7 version I am bumping that up to a safe 2.5.6.

app version	env	dompurify v. in webbapps	dompurify v. in rest-docs	action
7.23-SNAPSHOT	CE	3.1.3	2.4.x	updated rest-dcos
7.23-SNAPSHOT	EE	3.1.7	N/A	N/A
7.22	CE	3.1.6	2.4.x	updated rest-dcos
7.22	EE	3.1.7	NA	N/A
7.21	CE	3.1.3	2.4.x	updated rest-dcos
7.21	EE	3.1.3	N/A	N/A
7.20	CE	3.1.3	2.4.7	updated rest-dcos
7.20	EE	3.2.0	N/A	N/A

[venetrius]

@tasso94 please see the previous comment related to code changes

[KBGenerali]

@venetrius & @tasso94 our OWASP Dependencycheck still finds vulnerable version 3.0.9 of DOMPurify in deps.js

camunda-webapp-webjar-ee-7.22.2-ee.jar: deps.js (pkg:javascript/[email protected], pkg:javascript/[email protected]) : CVE-2024-45801, CVE-2024-47875, CVE-2024-6484, Bootstrap before 4.0.0 is end-of-life and no longer maintained.

Is this fix not included in Camunda 7.22.2-ee? Could you please check again if there is anything missing or is this a false positive?

[venetrius]

@KBGenerali ,
Thanks for letting us know. We will investigate to see if the vulnerable version is still present or if this is a false positive.

[venetrius]

@KBGenerali,

Thanks, for the heads up. The investigation has the following results:

• pkg:javascript/[email protected] is a false positive hit, we are shipping long term support version of bootstrap that is not effected.
• an old version of DOMPurify is included in one of our dependencies but it does not effect Camunda.

In the future ( or if you have more questions) please create an issue via Camunda trust-center.

[monsieur-gurr]

@venetrius
Thanks for investigating.
Will the old version of DOMPurify (which is not effecting Camunda) still be updated in the next patch/minor release?

[tasso94]

Hi @monsieur-gurr,

Yes. We have a ticket for that: #4913

Best,
Tassilo