Vulnerable DOMPurify 2.3.3 ships in the production bundle, inlined by @toast-ui/editor (no upstream fix)

[rubenvdlinde]

Summary

js/softwarecatalog-main.js ships DOMPurify 2.3.3, which is covered by 15 open advisories (XSS, mutation-XSS, sanitisation bypasses). It cannot be fixed by bumping a dependency, and a naive fix would produce a false green.

Why the obvious fix does not work

Dependabot / npm audit flag node_modules/@toast-ui/editor/node_modules/dompurify@2.5.9.

That copy is installed but never loaded. @toast-ui/editor inlines DOMPurify into its own dist at its build time and never require()s the dompurify package:

$ grep -c "require('dompurify')" node_modules/@toast-ui/editor/dist/toastui-editor.js
0
$ grep -oE "DOMPurify [0-9.]+" node_modules/@toast-ui/editor/dist/toastui-editor.js
DOMPurify 2.3.3

And it reaches the shipped bundle — from the production build's extracted licence banners:

$ grep -ohE "DOMPurify [0-9.]+" js/*.LICENSE.txt | sort | uniq -c
      1 DOMPurify 2.3.3     <- inlined by @toast-ui/editor, in softwarecatalog-main.js
      1 DOMPurify 3.4.12
      3 DOMPurify 3.4.13

So adding an npm overrides entry for dompurify would silence the audit while the vulnerable code keeps shipping. That was deliberately not done in #443.

No upstream fix

@toast-ui/editor@3.2.2 is the latest release and still declares "dompurify": "^2.3.3". DOMPurify 2.x is end-of-life. The project has had no release since 3.2.2.

Reachability

Real. src/modals/object/ViewObject.vue imports { Editor } from '@toast-ui/editor' and renders user-supplied object content through it, which is exactly the sanitisation path the advisories target.

Options

1. Replace @toast-ui/editor with a maintained editor (largest change, cleanest outcome).
2. patch-package the toast-ui dist to delegate to the hoisted dompurify@3.4.13 — the v2 → v3 sanitize() surface toast-ui uses is broadly compatible. Needs testing of the editor's sanitiser hooks.
3. Vendor a rebuilt toast-ui from source against dompurify 3.

Recommendation: option 2 as a stopgap, option 1 as the real fix.

Do not

Do not add a dompurify npm overrides entry to close this. It changes nothing that ships and removes the alert that tracks a genuine exposure.