From 832de294a1c3b93eb989c4d4928d97803087c20b Mon Sep 17 00:00:00 2001 From: German Parente Date: Mon, 27 Jul 2026 20:53:20 +0200 Subject: [PATCH] Fix OCPBUGS-98775: CVE-2026-48801 Co-Authored-By: Claude Opus 4.6 --- frontend/package.json | 5 ++- frontend/public/components/utils/link.tsx | 19 ++++++++- frontend/yarn.lock | 50 ++++++++--------------- 3 files changed, 36 insertions(+), 38 deletions(-) diff --git a/frontend/package.json b/frontend/package.json index 4d6fc05c773..8319a901bab 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -96,7 +96,7 @@ "^.+\\.(gql|graphql)$": "jest-transform-graphql" }, "transformIgnorePatterns": [ - "/node_modules/(?!(@patternfly(-\\S+)?|d3(-\\S+)?|delaunator|robust-predicates|internmap|lodash-es|@console|@novnc|@spice-project|@popperjs|i18next(-\\S+)?|@babel/runtime)/.*)" + "/node_modules/(?!(@patternfly(-\\S+)?|d3(-\\S+)?|delaunator|robust-predicates|internmap|lodash-es|@console|@novnc|@spice-project|@popperjs|i18next(-\\S+)?|@babel/runtime|linkify-react)/.*)" ], "testPathIgnorePatterns": [ "/node_modules/", @@ -182,6 +182,8 @@ "js-base64": "^2.5.1", "js-yaml": "^3.13.1", "json-schema": "^0.3.0", + "linkify-react": "^4.2.0", + "linkifyjs": "^4.2.0", "lodash-es": "^4.18.1", "monaco-languageclient": "^0.13.0", "murmurhash-js": "1.0.x", @@ -198,7 +200,6 @@ "react-draggable": "4.x", "react-helmet": "^6.1.0", "react-i18next": "^11.7.3", - "react-linkify": "^0.2.2", "react-measure": "^2.2.6", "react-modal": "^3.12.1", "react-monaco-editor": "0.46.x", diff --git a/frontend/public/components/utils/link.tsx b/frontend/public/components/utils/link.tsx index 037bc9cd4d5..209e1fb5de9 100644 --- a/frontend/public/components/utils/link.tsx +++ b/frontend/public/components/utils/link.tsx @@ -1,7 +1,8 @@ import * as React from 'react'; import * as _ from 'lodash-es'; import * as classNames from 'classnames'; -import Linkify from 'react-linkify'; +import Linkify from 'linkify-react/dist/linkify-react.mjs'; +import type { IntermediateRepresentation, Opts } from 'linkifyjs'; import { useTranslation } from 'react-i18next'; import { ClipboardCopyButton } from '@patternfly/react-core'; import { ExternalLinkAltIcon } from '@patternfly/react-icons/dist/esm/icons/external-link-alt-icon'; @@ -152,9 +153,23 @@ export const ExternalLinkWithCopy: React.FC = ({ ); }; +const linkifyOptions: Opts = { + render: ({ attributes, content }: IntermediateRepresentation) => { + const { href, ...props } = attributes; + return ( + + {content} + + ); + }, + validate: { + url: (value: string) => /^https?:\/\//.test(value), + }, +}; + // Open links in a new window and set noopener/noreferrer. export const LinkifyExternal: React.FC<{ children: React.ReactNode }> = ({ children }) => ( - {children} + {children} ); LinkifyExternal.displayName = 'LinkifyExternal'; diff --git a/frontend/yarn.lock b/frontend/yarn.lock index bc74ab1bcf6..eae882c1a99 100644 --- a/frontend/yarn.lock +++ b/frontend/yarn.lock @@ -16212,12 +16212,20 @@ __metadata: languageName: node linkType: hard -"linkify-it@npm:^2.0.3": - version: 2.1.0 - resolution: "linkify-it@npm:2.1.0" - dependencies: - uc.micro: "npm:^1.0.1" - checksum: 10c0/2fc45f06740a3c58c3393eecb634f91b62afc8b571ec82dd4fb250acded2d15ab1c83730c0fc0c353b8577d594384c7ca9e7f075be4342e9238d41089d0001bf +"linkify-react@npm:^4.2.0": + version: 4.3.3 + resolution: "linkify-react@npm:4.3.3" + peerDependencies: + linkifyjs: "*" + react: ">= 15.0.0" + checksum: 10c0/67885ea9466003cdd1c7c8bbecbc9fb5f903bde93bb3333bab1e61f12b76af93ba0bc40c7d9f0be3751e48d1dd1a10e3b0499691bfc8a249ef3267e62b03770e + languageName: node + linkType: hard + +"linkifyjs@npm:^4.2.0": + version: 4.3.3 + resolution: "linkifyjs@npm:4.3.3" + checksum: 10c0/0eac293927f1465d13625c8c67c83c50d7fda9137c255a4a2ff5970ea4e9ba57de4846b170326e54b9e4e82be24f3705572bc50773737be9b13af5f1e4577798 languageName: node linkType: hard @@ -18500,6 +18508,8 @@ __metadata: js-base64: "npm:^2.5.1" js-yaml: "npm:^3.13.1" json-schema: "npm:^0.3.0" + linkify-react: "npm:^4.2.0" + linkifyjs: "npm:^4.2.0" lint-staged: "npm:^10.2.2" lodash-es: "npm:^4.18.1" mini-css-extract-plugin: "npm:^1.6.2" @@ -18528,7 +18538,6 @@ __metadata: react-draggable: "npm:4.x" react-helmet: "npm:^6.1.0" react-i18next: "npm:^11.7.3" - react-linkify: "npm:^0.2.2" react-measure: "npm:^2.2.6" react-modal: "npm:^3.12.1" react-monaco-editor: "npm:0.46.x" @@ -20246,17 +20255,6 @@ __metadata: languageName: node linkType: hard -"react-linkify@npm:^0.2.2": - version: 0.2.2 - resolution: "react-linkify@npm:0.2.2" - dependencies: - linkify-it: "npm:^2.0.3" - prop-types: "npm:^15.5.8" - tlds: "npm:^1.57.0" - checksum: 10c0/d288311b7f82baa81b9e90d52699c8b1ffbc7a45ebc05a8dd9a935d7662999c9a70818de67803e18c501ae0ff58185d50954101692a2af6bbc76285450a7c8b6 - languageName: node - linkType: hard - "react-measure@npm:^2.2.6, react-measure@npm:^2.3.0": version: 2.5.2 resolution: "react-measure@npm:2.5.2" @@ -23293,15 +23291,6 @@ __metadata: languageName: node linkType: hard -"tlds@npm:^1.57.0": - version: 1.203.1 - resolution: "tlds@npm:1.203.1" - bin: - tlds: bin.js - checksum: 10c0/58f630ec673add064b0cdd3ba675ac23eabe33523a2629cfae6ea31de109503e1c3889bc128625b810855149945ccbdf4b904c38839780c3afab71e604523204 - languageName: node - linkType: hard - "tmp@npm:^0.0.33": version: 0.0.33 resolution: "tmp@npm:0.0.33" @@ -23798,13 +23787,6 @@ __metadata: languageName: node linkType: hard -"uc.micro@npm:^1.0.1": - version: 1.0.6 - resolution: "uc.micro@npm:1.0.6" - checksum: 10c0/9bde2afc6f2e24b899db6caea47dae778b88862ca76688d844ef6e6121dec0679c152893a74a6cfbd2e6fde34654e6bd8424fee8e0166cdfa6c9ae5d42b8a17b - languageName: node - linkType: hard - "uglify-js@npm:^2.6": version: 2.8.29 resolution: "uglify-js@npm:2.8.29"