major
minor
major
minor
Currently, version 1.14.3 of the JavaScript library Jsoup is in use.
This version contains a security vulnerability:
Jsoup is a Java HTML parser designed for HTML editing, cleaning, scraping, and cross-site scripting (XSS) protection. Jsoup may incorrectly sanitize HTML containing `javascript:` URL expressions, which could enable XSS attacks if a user subsequently clicks that link. If the non-default SafeList.preserveRelativeLinks option is enabled, HTML containing `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site where this HTML is published does not set a Content Security Policy, an XSS attack is then possible. This issue is fixed in jsoup 1.15.3. Users should upgrade to this version. Additionally, since the unsanitized input may have been persisted, old content should be processed again using the updated version. To address this issue without upgrading immediately: - Disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs. - Ensure that an appropriate Security Policy(https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of whether you upgrade, as a best practice for defense-in-depth.)
Test
The CheckDependencies build task should not contain any errors of the type “com.top-logic:tl-parent-all.pkg:maven/org.jsoup/jsoup@1.14.3.”