Skip to content

Commit

Permalink
Force isEvalSupported to false
Browse files Browse the repository at this point in the history 
Fixes [GHSA-wgrm-67xf-hhpq](GHSA-wgrm-67xf-hhpq)
  • Loading branch information
@wojtekmaj
wojtekmaj committed May 7, 2024
1 parent a662cfc commit 671e6ea
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion packages/react-pdf/src/Document.tsx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -505,7 +505,7 @@ const Document = forwardRef(function Document(
return;
}

const optionsWithModifiedIsEvalSupported: Options = { ...options, isEvalSupported: true };
const optionsWithModifiedIsEvalSupported: Options = { ...options, isEvalSupported: false };

const documentInitParams: Source = {
...source,
Expand Down

2 comments on commit 671e6ea

@vinodkumarsharma276
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @wojtekmaj ,
We are using v4.2.0 and recently got a security issue mentioning isEvalSupported: true can cause issues.
I bumped react-pdf to v7.* which should fix the security thread with isEvalSupported: false but I'm getting typing issues.

One of the issue:

We are using component and passing customTextRenderer as:

customTextRederer = (textInfo: { str: string; itemIndex: number }) => {
return (
<span
<..Some span attributes>

);
};

while building the project getting error:

_```
Type '(textInfo: { str: string; itemIndex: number;}) => React.JSX.Element' is not assignable to type 'CustomTextRenderer'.
ERR! Type 'Element' is not assignable to type 'string'.
ERR!
ERR! 117 customTextRenderer={this.customTextRenderer}
ERR! ~~~~~~~~~~~~~~~~~~


I saw the the type of the customTextRenderer is changed to:

export type CustomTextRenderer = (props: {
pageIndex: number;
pageNumber: number;
itemIndex: number;
} & TextItem) => string;


Can we patch this commit with isEvalSupported =  false to v4.2.* ?

@wojtekmaj
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Path for upgrade is clearly outlined both in Wiki and release notes for every major version.
Only v7 and v8 have received a patch and I'm not planning to support older versions.
Read more: #1786

Please sign in to comment.