Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependency pdfjs-dist to v4 [SECURITY] #5462

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
+103 −28
Open

Update dependency pdfjs-dist to v4 [SECURITY] #5462

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4f6586f
Update dependency pdfjs-dist to v4 [SECURITY]
renovate[bot] Sep 8, 2024
0bff493
Fix pdf.js bundling
thornbill Sep 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .escheckrc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@
"modules": "false",
"files": "./dist/**/*.js",
"not": [
"./dist/libraries/pdf.worker.js",
"./dist/libraries/pdf.worker.mjs",
"./dist/node_modules.pdfjs-dist.*",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file includes dynamic imports that are only used in nodejs environments, so it should be safe to ignore.

"./dist/libraries/worker-bundle.js",
"./dist/serviceworker.js"
]
Expand Down
109 changes: 91 additions & 18 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@
"stylelint-no-browser-hacks": "1.3.0",
"stylelint-order": "6.0.4",
"stylelint-scss": "5.3.2",
"transform-async-modules-webpack-plugin": "1.1.1",
"ts-loader": "9.5.1",
"typescript": "5.5.4",
"vitest": "2.0.5",
Expand Down Expand Up @@ -111,7 +112,7 @@
"material-design-icons-iconfont": "6.7.0",
"material-react-table": "2.13.2",
"native-promise-only": "0.8.1",
"pdfjs-dist": "3.11.174",
"pdfjs-dist": "4.2.67",
"react": "18.3.1",
"react-blurhash": "0.3.0",
"react-dom": "18.3.1",
Expand Down
7 changes: 2 additions & 5 deletions src/plugins/pdfPlayer/plugin.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,13 +205,10 @@ export class PdfPlayer {
const downloadHref = apiClient.getItemDownloadUrl(item.Id);

this.bindEvents();
GlobalWorkerOptions.workerSrc = appRouter.baseUrl() + '/libraries/pdf.worker.js';
GlobalWorkerOptions.workerSrc = appRouter.baseUrl() + '/libraries/pdf.worker.min.mjs';

const downloadTask = getDocument({
url: downloadHref,
// Disable for PDF.js XSS vulnerability
// https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
isEvalSupported: false
url: downloadHref
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workaround is no longer required.

});
return downloadTask.promise.then(book => {
if (this.cancellationToken) return;
Expand Down
9 changes: 6 additions & 3 deletions webpack.common.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ const CopyPlugin = require('copy-webpack-plugin');
const ForkTsCheckerWebpackPlugin = require('fork-ts-checker-webpack-plugin');
const HtmlWebpackPlugin = require('html-webpack-plugin');
const MiniCssExtractPlugin = require('mini-css-extract-plugin');
const { TransformAsyncModulesPlugin } = require('transform-async-modules-webpack-plugin');
const { DefinePlugin, IgnorePlugin } = require('webpack');
const packageJson = require('./package.json');

Expand All @@ -15,7 +16,7 @@ const Assets = [
'@jellyfin/libass-wasm/dist/js/subtitles-octopus-worker.js',
'@jellyfin/libass-wasm/dist/js/subtitles-octopus-worker.wasm',
'@jellyfin/libass-wasm/dist/js/subtitles-octopus-worker-legacy.js',
'pdfjs-dist/build/pdf.worker.js'
'pdfjs-dist/build/pdf.worker.min.mjs'
];

const DEV_MODE = process.env.NODE_ENV !== 'production';
Expand Down Expand Up @@ -109,7 +110,9 @@ const config = {
typescript: {
configFile: path.resolve(__dirname, 'tsconfig.json')
}
})
}),
// Transform any modules using top-level await (pdf.js)
new TransformAsyncModulesPlugin()
],
output: {
filename: pathData => (
Expand Down Expand Up @@ -205,6 +208,7 @@ const config = {
path.resolve(__dirname, 'node_modules/markdown-it'),
path.resolve(__dirname, 'node_modules/material-react-table'),
path.resolve(__dirname, 'node_modules/mdurl'),
path.resolve(__dirname, 'node_modules/pdfjs-dist'),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't notice any issues moving this back into our standard babel build, but is there anything specific that needs tested here @dmitrylyzo?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tbh, I don't remember. 😅
Maybe it's specific to that version of pdfjs?

At the moment, webOS 1.2 fails with SyntaxError: Use of reserved word 'import' (also tried it in the extra babel list).

case 2:
  _context5.next = 4;
  return import(/*webpackIgnore: true*/_this37.workerSrc);
case 4:

I'm using source-map in webpack.dev.conf, so it doesn't produce eval, which doesn't work in webOS 1.2.

Anyway, pdf.worker doesn't work because of ES6 features.
But it looks like pdfjs has some legacy variant (legacy/ folder).
No, that doesn't work either because of import. 😕

path.resolve(__dirname, 'node_modules/punycode'),
path.resolve(__dirname, 'node_modules/react-blurhash'),
path.resolve(__dirname, 'node_modules/react-lazy-load-image-component'),
Expand Down Expand Up @@ -268,7 +272,6 @@ const config = {
{
test: /\.js$/,
include: [
path.resolve(__dirname, 'node_modules/pdfjs-dist'),
path.resolve(__dirname, 'node_modules/xmldom')
],
use: [{
Expand Down
Loading