Security hardening
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 22.2k
- Forks
- 1.9k
- PR merge metrics
- PR metrics pending
Description
Question
I like the setup of this project and it looks really sleek. Would like to use it. Two questions:
-
Highlight.js 10.1.1 has vulnerabilities. I saw update discussions in #1622 and discussions of swapping it in #1652. Is there any built in way to just disable highlightjs for now?
-
Is there a recommended way to disable book.js / the playgrounds? The point being to prevent code execution.
In my own quick testing it seems one way is to set nothing else but // inside theme/book.js and theme/highlight.js. Does this actually disable them and is this recommended method or is there some value in book.toml I can set to false instead etc? Thank you for your time!
Version
mdbook v0.4.51
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the questions about disabling code execution and the existing theme/book.js, theme/highlight.js, and book.toml files, along with the linked discussions in issues #1622 and #1652. Determine whether configuration already supports disabling these scripts or whether a new setting is needed; done means the behavior is clearly defined and verified for generated books.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100