Skip to content

Bump css_parser to 3.0.0 (CVE-2026-53727) #4353

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
akostadinov-bot wants to merge 3 commits into
base: master
Choose a base branch
from
+24 −11
Open

Bump css_parser to 3.0.0 (CVE-2026-53727) #4353

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4288852
Bump css_parser to 3.0.0 and prawn-svg to 0.40.3 (CVE-2026-53727)
akostadinov-bot[bot] Jul 22, 2026
1926910
Strip SVG anchor wrappers to prevent empty PDF link annotations
akostadinov-bot[bot] Jul 22, 2026
4e90f3e
permit GPL-2.0-only license
akostadinov Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 16 additions & 11 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,7 @@ GEM
activerecord (>= 3.0)
acts_as_tree (2.9.1)
activerecord (>= 3.0.0)
addressable (2.8.8)
addressable (2.9.0)

@akostadinov akostadinov Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jlledom there was something with addressable but I forgot what it was 🤔

public_suffix (>= 2.0.2, < 8.0)
afm (0.2.2)
after_commit_queue (1.1.0)
Expand Down Expand Up @@ -273,8 +273,9 @@ GEM
bigdecimal
rexml
crass (1.0.6)
css_parser (1.21.1)
css_parser (3.0.0)
addressable
ssrf_filter (~> 1.5)
cssbundling-rails (1.4.3)
railties (>= 6.0.0)
csv (3.3.5)
Expand Down Expand Up @@ -588,7 +589,7 @@ GEM
racc
pastel (0.8.0)
tty-color (~> 0.5)
pdf-core (0.9.0)
pdf-core (0.10.0)
pdf-inspector (1.3.0)
pdf-reader (>= 1.0, < 3.0.a)
pdf-reader (2.11.0)
Expand All @@ -605,13 +606,15 @@ GEM
json (~> 2.7, >= 2.7.1)
pp (0.6.2)
prettyprint
prawn (2.4.0)
pdf-core (~> 0.9.0)
ttfunk (~> 1.7)
prawn-svg (0.32.0)
css_parser (~> 1.6)
prawn (2.5.0)
matrix (~> 0.4)
pdf-core (~> 0.10.0)
ttfunk (~> 1.8)
prawn-svg (0.40.3)
css_parser (>= 1.17.1, < 4)
matrix (~> 0.4.2)
prawn (>= 0.11.1, < 3)
rexml (~> 3.2)
rexml (>= 3.4.2, < 4)
prettyprint (0.2.0)
prism (1.4.0)
prometheus-client-mmap (1.3.0)
Expand Down Expand Up @@ -640,7 +643,7 @@ GEM
psych (5.2.6)
date
stringio
public_suffix (7.0.2)
public_suffix (7.0.5)
raabro (1.4.0)
racc (1.8.1)
rack (2.2.23)
Expand Down Expand Up @@ -902,6 +905,7 @@ GEM
actionpack (>= 6.1)
activesupport (>= 6.1)
sprockets (>= 3.0.0)
ssrf_filter (1.5.0)
state_machines (0.5.0)
state_machines-activemodel (0.8.0)
activemodel (>= 5.1)
Expand Down Expand Up @@ -940,7 +944,8 @@ GEM
timeout (0.6.0)
tomlrb (2.0.3)
tsort (0.2.0)
ttfunk (1.7.0)
ttfunk (1.8.0)
bigdecimal (~> 3.1)
tty-color (0.6.0)
tty-cursor (0.7.1)
tty-markdown (0.7.2)
Expand Down
2 changes: 2 additions & 0 deletions app/lib/pdf/report.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,8 @@ def traffic_graph

def traffic_graph_style(svg)
xml = Nokogiri::XML(svg)
# cleaning up `a` elements can be removed with prawn-svg 0.40.4+
xml.css('a').each { |a| a.replace(a.children) }

@qltysh qltysh Bot Jul 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pdf::Report#traffic_graph_style has the variable name 'a' [reek:UncommunicativeVariableName]

@akostadinov akostadinov Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

svg-graph wraps data points in elements (empty
URL) when show_data_points is true. prawn-svg 0.32 treated as a plain
container and ignored the href. prawn-svg 0.40 added a new Anchor element
class that creates PDF link annotations from them — even with an empty URL,
PDF viewers render a hover box.

style = xml.at_css("style")
css = CssParser::Parser.new
css.load_string!(style.text.gsub(/ff0000/i, "9273ED"))
Expand Down
6 changes: 6 additions & 0 deletions doc/dependency_decisions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -250,3 +250,9 @@
:why: Approved by OSI and Fedora
:versions: []
:when: 2026-04-29 07:57:00.547859043 Z
- - :permit
- GPL-2.0-only

@akostadinov akostadinov Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also see prawnpdf/prawn#1397

- :who: Aleksandar Kostadinov
:why: this is the preferred SPDX name of the already approved but deprecated GPL-2 and GPL-2.0 identifiers
:versions: []
:when: 2026-07-24 18:16:05.649037719 Z