CVE-2011-3744

[shovale]

Looks like there was a medium severity grade vulnerability that was discovered for htmlpurifier in checkmarx

Just hope a new minor version can be released to fix this issue.
Thank u.

[bytestream]

See #420

[shovale]

We are using version 4.18.0 and the vulnerability still exists.
You can see the version on the top of the image.

[ezyang]

If someone sends a PR for this I'll take it...

[bytestream]

We are using version 4.18.0 and the vulnerability still exists. You can see the version on the top of the image.

tests is excluded in .gitattributes. If you install the package via composer the mentioned file is not present.

[shovale]

This is my gitattributes file:

[bytestream]

I am referring to https://github.com/ezyang/htmlpurifier/blob/master/.gitattributes within this library. How are you installing the library?

[shovale]

Hello,
I'm installing the library through composer.
Composer seems to ignore the .gitattributes file.
What do u think i should do?

[bytestream]

What version of composer? Perhaps attach composer.lock

[shovale]

composer.txt

[shovale]

Composer version 2.8.6

[pieterocp]

I think the question is how is composer being used to install, if you have it set to use either --prefer-source or --prefer-dist then it'll end up ignoring the .gitattributes in it's entirety. This blog post summarises it well - https://php.watch/articles/composer-gitattributes.

[GadyEilat]

Hey @pieterocp I'm working with @shovale .
What should we set the preferred CLI flag for this package in order to solve the issue? if not either --prefer-source or --prefer-dist then what should be used?
This is our current package.json config section and I can add something specific to htmlpurifier... :
"config": { "optimize-autoloader": true, "preferred-install": { "ezyang/htmlpurifier": "", "*": "dist" }, "sort-packages": true, "allow-plugins": { "php-http/discovery": true } },