Update dependency highlight.js to v10.1.2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
highlight.js (source)	10.0.2 -> 10.1.2

GitHub Vulnerability Alerts

CVE-2020-26237

Impact

Affected versions of this package are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable.

The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector.

If your website or application does not render user provided data it should be unaffected.

Patches

Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

Workarounds

Patch your library

Manually patch your library to create null objects for both languages and aliases:

const HLJS = function(hljs) {
  // ...
  var languages = Object.create(null);
  var aliases = Object.create(null);

Filter out bad data from end users

Filter the language names that users are allowed to inject into your HTML to guarantee they are valid.

References

• What is Prototype Pollution?
• use null prototype objects for languages/aliases highlightjs/highlight.js#2636

For more information

If you have any questions or comments about this advisory:

• Please file an issue against highlight.js

---

Release Notes

highlightjs/highlight.js

v10.1.2

Compare Source

Fixes:

• fix(night) Prevent object prototype values from being returned by getLanguage (#​2636) night

v10.1.1

Compare Source

Fixes:

• Resolve issue on Node 6 due to dangling comma (#​2608) Edwin Hoogerbeets
• Resolve index.d.ts is not a module error (#​2603) Josh Goebel

v10.1.0

Compare Source

New themes:

• NNFX and NNFX-dark by Jim Mason
• lioshi by lioshi

Parser Engine:

• (parser) Now escapes quotes in text content when escaping HTML (#​2564) Josh Goebel
• (parser) Adds keywords.$pattern key to grammar definitions (#​2519) Josh Goebel
• (parser) Adds SHEBANG utility mode Josh Goebel
• (parser) Adds registerAliases method (#​2540) [Taufik Nurrohman][]
• (enh) Added on:begin callback for modes (#​2261) Josh Goebel
• (enh) Added on:end callback for modes (#​2261) Josh Goebel
• (enh) Added ability to programatically ignore begin and end matches (#​2261) Josh Goebel
• (enh) Added END_SAME_AS_BEGIN mode to replace endSameAsBegin parser attribute (#​2261) Josh Goebel
• (fix) fixMarkup would rarely destroy markup when useBR was enabled (#​2532) Josh Goebel

Deprecations:

• htmlbars grammar is now deprecated. Use handlebars instead. (#​2344) Nils Knappmeier
• when using highlightBlock result.re deprecated. Use result.relevance instead. (#​2552) Josh Goebel
• ditto for result.second_best.re => result.second_best.relevance (#​2552)
• lexemes is now deprecated in favor of keywords.$pattern key (#​2519) Josh Goebel
• endSameAsBegin is now deprecated. (#​2261) Josh Goebel

Language Improvements:

• fix(groovy) strings are not allowed inside ternary clauses (#​2217) Josh Goebel
• fix(typescript) add readonly keyword (#​2562) Martin (Lhoerion)
• fix(javascript) fix regex inside parens after a non-regex (#​2530) Josh Goebel
• enh(typescript) use identifier to match potential keywords, preventing false positivites (#​2519) Josh Goebel
• enh(javascript) use identifier to match potential keywords, preventing false positivites (#​2519) Josh Goebel
• [enh] Add OPTIMIZE: and HACK: to the labels highlighted inside comments Josh Goebel
• enh(typescript/javascript/coffeescript/livescript) derive ECMAscript keywords from a common foudation (#​2518) Josh Goebel
• enh(typescript) add setInterval, setTimeout, clearInterval, clearTimeout (#​2514) Josh Goebel
• enh(javascript) add setInterval, setTimeout, clearInterval, clearTimeout (#​2514) Vania Kucher
• enh(cpp) add pair, make_pair, priority_queue as built-ins (#​2538) Hankun Lin
• enh(cpp) recognize priority_queue pair as cpp containers (#​2541) Hankun Lin
• fix(javascript) prevent set keyword conflicting with setTimeout, etc. (#​2514) Vania Kucher
• fix(cpp) Fix highlighting of unterminated raw strings (#​2261) David Benjamin
• fix(javascript) => function with nested () in params now works (#​2502) Josh Goebel
• fix(typescript) => function with nested () in params now works (#​2502) Josh Goebel
• fix(yaml) Fix tags to include non-word characters (#​2486) Peter Plantinga
• fix(swift) @objcMembers was being partially highlighted (#​2543) Nick Randall
• enh(dart) Add late and required keywords, the Never built-in type, and nullable built-in types (#​2550) Sam Rawlins
• enh(erlang) Add underscore separators to numeric literals (#​2554) Sergey Prokhorov
• enh(handlebars) Support for sub-expressions, path-expressions, hashes, block-parameters and literals (#​2344) Nils Knappmeier
• enh(protobuf) Support multiline comments (#​2597) Pavel Evstigneev
• fix(toml) Improve key parsing (#​2595) Antoine du Hamel

v10.0.3

Compare Source

---

Renovate configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Enabled.

♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by WhiteSource Renovate. View repository job log here.