major
minor
major
minor
Currently, version 2.9.4 of the ChartJS JavaScript library is in use.
ChartJS depends on moment.js, which introduces a security vulnerability:
Moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of Moment were found to use an inefficient parsing algorithm. Specifically, using string-to-date parsing in moment (more specifically, RFC 2822 parsing, which is the default) has quadratic (N^2) complexity for certain inputs. Users may notice a significant slowdown with inputs exceeding 10,000 characters. Users who pass user-provided strings to the `moment` constructor without performing basic length checks are vulnerable to (Re)DoS attacks. The issue has been patched in version 2.29.4; the patch can be applied to all affected versions with minimal adjustments. Users are advised to upgrade. Users unable to upgrade should consider limiting the length of dates accepted from user input.
Migration
Upgrading the library from major version 2 to 3 has resulted in some changes to the chart configuration.
Note: Charts configured within the application must be adjusted according to the chart.js migration guide. Details can be found here.
Test
- Start the demo. After generating demo data, check whether the chart is displayed in the ChartJS tab.
- The CheckDependencies build task should not contain any errors of the type “com.top-logic:tl-parent-all.pkg:javascript/moment.js@2.24.0.”