BookStack Code Mirror - website/blob - content/blog/2022/security-release-v22-07-3.md

1 +++

2 categories = ["Releases"]

3 tags = ["Releases"]

4 title = "BookStack Security Release v22.07.3"

5 date = 2022-08-11T12:00:00Z

6 author = "Dan Brown"

7 image = "/images/blog-cover-images/unsplash/fence-birds-bonnie-kittle.jpg"

8 slug = "bookstack-release-v22-07-3"

9 draft = false

10 +++

12 BookStack v22.07.3 has been released.

13 This is a security release that adds additional filtering to page content to prevent

14 certain cross-site-scripting techniques. These cross-site-scripting techniques would be

15 already by blocked by BookStack's usage of Content-Security-Policy, but this change will help

16 scenarios where BookStack content is used externally.

18 In addition, the API documentation has been updated with a section focused on content security

19 to explain the security techniques BookStack uses by default, and to relay considerations for using

20 BookStack content in an external system. The security page of our documentation has also been

21 updated with such considerations:

23 https://www.bookstackapp.com/docs/admin/security/#using-bookstack-content-externally

25 Upgrade is advised where BookStack content, accessible to edit by untrusted users, is used externally.

26 Those using BookStack content externally (API-based app developers) should read the new documentation

27 and add any advised protections as necessary.

29 * [Update instructions](https://www.bookstackapp.com/docs/admin/updates)

30 * [GitHub release page](https://github.com/BookStackApp/BookStack/releases/tag/v22.07.3)

32 Thanks to the "JPCERT/CC Vulnerability Coordination Group" contact and the original reporter,

33 Kenichi Okuno of Mitsui Bussan Secure Directions, Inc, for disclosing their report of the relevant vulnerability scenarios.

35 ### Full List of Changes

37 * Added API documentation section to advise of content security. ([#3636](https://github.com/BookStackApp/BookStack/issues/3636))

38 * Updated Persian translations. Thanks to [@samadha56](https://github.com/BookStackApp/BookStack/pull/3639). ([#3639](https://github.com/BookStackApp/BookStack/pull/3639))

39 * Updated code block rendering to help prevent blank blocks on fresh cache. ([#3637](https://github.com/BookStackApp/BookStack/issues/3637))

40 * Updated HTML filtering to prevent SVG animate case. ([#3636](https://github.com/BookStackApp/BookStack/issues/3636))

41 * Updated translations with latest changes from Crowdin. ([#3635](https://github.com/BookStackApp/BookStack/pull/3635))

42 * Updated revision list view to help prevent system memory exhaustion. ([#3633](https://github.com/BookStackApp/BookStack/issues/3633))

43 * Fixed issue with permission checking prevent certain actions where permission should have allowed. ([#3632](https://github.com/BookStackApp/BookStack/pull/3632))

45 ### For More Information

47 If you have any questions or comments about this advisory:

48 * Open an issue in [the BookStack GitHub repository](https://github.com/BookStackApp/BookStack/issues).

49 * Ask on the [BookStack Discord chat](https://discord.gg/ztkBqR2).

50 * Follow the [BookStack security policy](https://github.com/BookStackApp/BookStack/blob/development/.github/SECURITY.md) to contact someone privately.

52 ----

54 <span style="font-size: 0.8em;opacity:0.9;">Header Image Credits: <span>Photo by <a href="https://unsplash.com/@bonniekdesign?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText">Bonnie Kittle</a> on <a href="https://unsplash.com/s/photos/fence?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText">Unsplash</a>

55 </span></span>