fix(components): close PDF.js vulnerability

getflip · May 8, 2024 · 7d5ea77 · 7d5ea77
1 parent 4344be8
commit 7d5ea77
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/.changeset/twenty-ads-cry.md b/.changeset/twenty-ads-cry.md
@@ -0,0 +1,7 @@
+---
+"@getflip/swirl-components": patch
+"@getflip/swirl-components-angular": patch
+"@getflip/swirl-components-react": patch
+---
+
+Close PDF.js vulnerability (https://github.com/advisories/GHSA-wgrm-67xf-hhpq)
diff --git a/.../src/components/swirl-file-viewer/viewers/swirl-file-viewer-pdf/swirl-file-viewer-pdf.tsx b/.../src/components/swirl-file-viewer/viewers/swirl-file-viewer-pdf/swirl-file-viewer-pdf.tsx
@@ -211,7 +211,9 @@ export class SwirlFileViewerPdf {
         this.doc.destroy();
       }
 
-      this.doc = await getDocument(this.file).promise;
+      // Don't remove the isEvalSupported property. https://github.com/advisories/GHSA-wgrm-67xf-hhpq
+      this.doc = await getDocument({ isEvalSupported: false, url: this.file })
+        .promise;
 
       const pages = [];