https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43243
Bug ID: 43243
Summary: Remove pdfmake from DataTables
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: unspecified
Hardware: All
OS: All
Status: NEW
Severity: minor
Priority: P5 - low
Component: Templates
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
Target Milestone: ---
For a long time, the bundled datatables library has included "pdfmake" which is
required for the "PDF HTML5 export button".
But... we don't actually use the "PDF HTML5 export button" in Koha.
I also got some hits on ClamAV for :
/usr/share/koha/intranet/htdocs/intranet-tmpl/lib/datatables/datatables.min.js:
Html.Phishing.SVGDynamicFunction-10060409-0 FOUND
/usr/share/koha/intranet/htdocs/intranet-tmpl/lib/datatables/datatables.js:
Html.Phishing.SVGDynamicFunction-10060409-0 FOUND
A brief look for SVG shows the "pdfmake" library and if you clone that repo and
checkout 0.2.7 which is the version we're using... and then run clamav against
that you'll get the same hit.
However, it looks like it's a false positive. I prove this in my report to
pdfmake: https://github.com/bpampuch/pdfmake/issues/2942
So... not a real security problem but it will probably start popping up on
people scanning Koha.
It does look like the signature doesn't match against the "pdfmake" master
branch, so we could look at upgrading the DataTables and its pdfmake library,
or we could remove it (although we'll probably need to upgrade our DataTables
due to how the DataTables bundler works)
--
You are receiving this mail because:
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
