OWASP Dependency Check flagged RetireJS vulnerability pkg:javascript/DOMPurify@2.0.7 in swagger-ui-bundle.js provided by springfox-swagger-ui-3.0.0.jar

[volkert-fastned]

Please take the time to search the repository, if your question has already been asked or answered.

• What version of the library are you using?

springfox-swagger-ui-3.0.0.jar

What kind of issue is this?

• Bug report. (Possible vulnerability)

Running the OWASP Dependency Check on a project that has springfox-swagger-ui-3.0.0.jar as one of its dependencies yields the following flagged vulnerability:

springfox-swagger-ui-3.0.0.jar: swagger-ui-bundle.js (pkg:javascript/DOMPurify@2.0.7) : Fix a possible XSS in Chrome that is hidden behind #enable-experimental-web-platform-features, Fixed a new MathML-based bypass submitted by PewGrand. Fixed a new SVG-related bypass submitted by SecurityMB, Fixed an mXSS bypass dropped on us publicly via, Fixed an mXSS issue reported, Fixed an mXSS-based bypass caused by nested forms inside MathML, Fixed another bypass causing mXSS by using MathML, Fixed several possible mXSS patterns, thanks @hackvertor

Apparently, this is a "RetireJS" vulnerability, and it lacks both a CPE pattern and a CVE number. But the mentioned DOMPurify fixes do imply some kind of XSS vulnerability.

Is it possible to release a new version of springfox-swagger-ui that mitigates this? Or is there a good argument to be made for considering this a false positive? Thanks.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[volkert-fastned]

Can someone please look into this? Thanks.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically closed because it has not had recent activity. Please re-open a new issue if this is still an issue.