Svelte 3.59.0 introduces subtle yet significant changes from version 3.58.0, impacting development workflows and potentially offering enhanced performance. While the core description remains consistent, "Cybernetically enhanced web apps," the devil is in the details of the dependency updates. Most notable is the bump in @jridgewell/sourcemap-codec from version 1.4.14 to 1.4.15 in the newer version. This dependency is crucial for accurate source map generation, aiding debugging efforts, especially in larger Svelte applications. While seemingly minor, improvements in source map handling can dramatically improve the developer experience by making it easier to pinpoint the origin of errors in the generated code.
Furthermore, the dist object reveals an increase in fileCount from 259 to 277 and a rise in unpackedSize from 10,558,502 to 11,058,022 bytes. This suggests that Svelte 3.59.0 incorporates new features, bug fixes, or internal optimizations that contribute to an expanded codebase. Developers should consider exploring the official changelog and release notes to understand the precise changes that account for the increased size. These changes may address specific edge cases or introduce new functionalities that streamline development. The release date also indicates the newer version is approximately a month newer than the older one.
All the vulnerabilities related to the version 3.59.0 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag