[Bug 43243] New: Remove pdfmake from DataTables
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43243 Bug ID: 43243 Summary: Remove pdfmake from DataTables Initiative type: --- Sponsorship --- status: Product: Koha Version: unspecified Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Templates Assignee: oleonard@myacpl.org Reporter: dcook@prosentient.com.au QA Contact: testopia@bugs.koha-community.org Target Milestone: --- For a long time, the bundled datatables library has included "pdfmake" which is required for the "PDF HTML5 export button". But... we don't actually use the "PDF HTML5 export button" in Koha. I also got some hits on ClamAV for : /usr/share/koha/intranet/htdocs/intranet-tmpl/lib/datatables/datatables.min.js: Html.Phishing.SVGDynamicFunction-10060409-0 FOUND /usr/share/koha/intranet/htdocs/intranet-tmpl/lib/datatables/datatables.js: Html.Phishing.SVGDynamicFunction-10060409-0 FOUND A brief look for SVG shows the "pdfmake" library and if you clone that repo and checkout 0.2.7 which is the version we're using... and then run clamav against that you'll get the same hit. However, it looks like it's a false positive. I prove this in my report to pdfmake: https://github.com/bpampuch/pdfmake/issues/2942 So... not a real security problem but it will probably start popping up on people scanning Koha. It does look like the signature doesn't match against the "pdfmake" master branch, so we could look at upgrading the DataTables and its pdfmake library, or we could remove it (although we'll probably need to upgrade our DataTables due to how the DataTables bundler works) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43243 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@gmail.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43243 --- Comment #1 from David Cook <dcook@prosentient.com.au> --- This is the URL for the download builder for main: https://datatables.net/download/#dt/jszip-3.10.1/pdfmake-0.2.7/dt-2.3.7/b-3.... Styling: DataTables: v3.0.1 DataTables core: v3.0.1 Buttons: v4.0.1 FixedHeader: v5.0.0 Responsive: v4.0.1 RowGroup: v2.0.0 RowReorder: v2.0.0 JSZip: v3.10.1 pdfmake: v0.2.7 -- So actually it looks like it doesn't offer a pdfmake upgrade in the bundle. I'll flag that with the DataTables author. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43243 --- Comment #2 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #1)
So actually it looks like it doesn't offer a pdfmake upgrade in the bundle. I'll flag that with the DataTables author.
https://github.com/DataTables/DataTablesSrc/issues/404 -- Note: DataTables 3 doesn't require jQuery as a dependency anymore, if I recall correctly, so that's exciting! Note that it still works with jQuery, so our existing jQuery plugin use should keep working as per https://datatables.net/releases/3/new I don't know how we're using DataTables with Vue.js, but it might be interesting to revisit that too... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43243 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CONFIRMED -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43243 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Remove pdfmake from |pdfmake embedded in |DataTables |DataTables raises a false | |positive in ClamAV -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43243 --- Comment #3 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #2)
(In reply to David Cook from comment #1)
So actually it looks like it doesn't offer a pdfmake upgrade in the bundle. I'll flag that with the DataTables author.
Alan, the author of DataTables, has said he's going to look at incorporating a newer version of pdfmake into DataTables to get rid of that false positive message. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43243 --- Comment #4 from David Cook <dcook@prosentient.com.au> --- (In reply to David Cook from comment #3)
(In reply to David Cook from comment #2)
(In reply to David Cook from comment #1)
So actually it looks like it doesn't offer a pdfmake upgrade in the bundle. I'll flag that with the DataTables author.
Alan, the author of DataTables, has said he's going to look at incorporating a newer version of pdfmake into DataTables to get rid of that false positive message.
He's updated the bundler/downloader/builder to use pdfmake 0.3.11 which does not have this ClamAV reported issue. So we can either remove pdfmake from our bundle or update to include the newer version. -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org