https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43243 Bug ID: 43243 Summary: Remove pdfmake from DataTables Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Templates Assignee: oleonard@myacpl.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org Target Milestone: --- For a long time, the bundled datatables library has included "pdfmake" which is required for the "PDF HTML5 export button". But... we don't actually use the "PDF HTML5 export button" in Koha. I also got some hits on ClamAV for : /usr/share/koha/intranet/htdocs/intranet-tmpl/lib/datatables/datatables.min.js: Html.Phishing.SVGDynamicFunction-10060409-0 FOUND /usr/share/koha/intranet/htdocs/intranet-tmpl/lib/datatables/datatables.js: Html.Phishing.SVGDynamicFunction-10060409-0 FOUND A brief look for SVG shows the "pdfmake" library and if you clone that repo and checkout 0.2.7 which is the version we're using... and then run clamav against that you'll get the same hit. However, it looks like it's a false positive. I prove this in my report to pdfmake: https://github.com/bpampuch/pdfmake/issues/2942 So... not a real security problem but it will probably start popping up on people scanning Koha. It does look like the signature doesn't match against the "pdfmake" master branch, so we could look at upgrading the DataTables and its pdfmake library, or we could remove it (although we'll probably need to upgrade our DataTables due to how the DataTables bundler works) -- You are receiving this mail because: You are watching all bug changes.