Svelte 3.43.2 is a minor update to the popular JavaScript framework, building upon version 3.43.1. Both versions share the core description of "Cybernetically enhanced web apps," highlighting Svelte's focus on performance and developer experience. A key difference lies in the updated dependencies. Svelte 3.43.2 includes a bump in @sveltejs/eslint-config from v5.7.0 to v5.8.0. This suggests improvements or fixes in the linting rules and configurations used for Svelte projects, potentially leading to cleaner and more maintainable code. Additionally, puppeteer was downgraded from version 2.1.1 to 2.0.0. Developers who rely on puppeteer for end-to-end testing might want to investigate potential compatibility changes or bug fixes that could have prompted the downgrade. The unpacked size of 3.43.2 is marginally larger, indicating potential inclusion of new tests, documentation updates, or minor additions to the codebase. The increased releaseDate indicates the later released version.
For developers, the newer version encourages updating for the latest linting rules and best practices enforced by @sveltejs/eslint-config. While the puppeteer downgrade needs to be taken into account when choosing which version to use according to the use case. As always, carefully inspect the changelog for a comprehensive understanding of all modifications and their impact on existing projects. Overall, Svelte 3.43.2 continues to deliver a streamlined and efficient approach to building web applications, empowering developers with tools and technologies to create high-performance user interfaces.
All the vulnerabilities related to the version 3.43.2 of the package
Svelte vulnerable to XSS when using objects during server-side rendering
The package svelte before 3.49.0 is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag