overleaf/server-ce/hotfix/5.0.4/pr_18444.patch
Brian Gough 485710538d [CE/SP] Hotfix 5.0.4 (#18434)
* [CE/SP] Hotfix 5.0.4

Remove unused packages with vulnerable dependencies.
Upgrade sanitize-html in scripts directory to get security updates.
Upgrade swagger-tools dependencies to get security updates.

* add note about overrides to server pro release checklist

* remove unused services/web/scripts/translations directory from server-pro

* include #18393 and #18444 in server pro hotfix 5.0.4

* clean up after patching package-lock

apply package-lock patch at start of hotfix build
run npm audit at end of hotfix build

GitOrigin-RevId: a253def01d481961cd16f4374e2ccffa00417c1f
2024-05-27 10:24:39 +00:00

41 lines
2 KiB
Diff

diff --git a/services/web/frontend/js/features/file-view/components/file-view-pdf.tsx b/services/web/frontend/js/features/file-view/components/file-view-pdf.tsx
index 4d3b80bb9a2..3efc61a2199 100644
--- a/services/web/frontend/js/features/file-view/components/file-view-pdf.tsx
+++ b/services/web/frontend/js/features/file-view/components/file-view-pdf.tsx
@@ -33,7 +33,10 @@ const FileViewPdf: FC<{
return
}
- const pdf = await PDFJS.getDocument(preview.url).promise
+ const pdf = await PDFJS.getDocument({
+ url: preview.url,
+ isEvalSupported: false,
+ }).promise
// bail out if loading the PDF took too long
if (!mountedRef.current) {
diff --git a/services/web/frontend/js/features/pdf-preview/util/pdf-js-wrapper.js b/services/web/frontend/js/features/pdf-preview/util/pdf-js-wrapper.js
index 9b419b1397f..6a92630a215 100644
--- a/services/web/frontend/js/features/pdf-preview/util/pdf-js-wrapper.js
+++ b/services/web/frontend/js/features/pdf-preview/util/pdf-js-wrapper.js
@@ -96,6 +96,7 @@ export default class PDFJSWrapper {
rangeChunkSize,
disableAutoFetch: true,
disableStream,
+ isEvalSupported: false,
textLayerMode: 2, // PDFJSViewer.TextLayerMode.ENABLE,
range: rangeTransport,
})
diff --git a/services/web/frontend/js/features/source-editor/extensions/visual/visual-widgets/graphics.ts b/services/web/frontend/js/features/source-editor/extensions/visual/visual-widgets/graphics.ts
index 7321f9e02b5..f6c744aaec2 100644
--- a/services/web/frontend/js/features/source-editor/extensions/visual/visual-widgets/graphics.ts
+++ b/services/web/frontend/js/features/source-editor/extensions/visual/visual-widgets/graphics.ts
@@ -143,7 +143,7 @@ export class GraphicsWidget extends WidgetType {
return
}
- const pdf = await PDFJS.getDocument(url).promise
+ const pdf = await PDFJS.getDocument({ url, isEvalSupported: false }).promise
const page = await pdf.getPage(1)
// bail out if loading the PDF took too long