Problem/Motivation

raw-loader is used to inline svg in our cke5 wepack build. there is a security issue in one of the dependency of raw-loader: https://github.com/advisories/GHSA-76p3-8jx3-jpfq

raw-loader itself is deprecated in webpack5 so we don't need it.

Steps to reproduce

Proposed resolution

use wepack5 features to replace raw-loader.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

CommentFileSizeAuthor
#8 interdiff-4-9.txt1.82 KBnod_
#8 core-3319917-9.5-8.patch6.44 KBnod_
#5 core-3319917-9.5-4.patch4.26 KBnod_
#4 core-3319917-10.0-3.patch4.57 KBnod_
#2 core-3319917-2.patch4.57 KBnod_
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

nod_ created an issue. See original summary.

nod_’s picture

nod_
Primary language French
Location Lille
CreditAttribution: nod_ at Acquia commented
FileSize
core-3319917-2.patch4.57 KB

no changes to the built files.

nod_’s picture

nod_
Primary language French
Location Lille
CreditAttribution: nod_ at Acquia commented
Status: Active » Needs review
nod_’s picture

nod_
Primary language French
Location Lille
CreditAttribution: nod_ at Acquia commented
FileSize
core-3319917-10.0-3.patch4.57 KB

10.0 version

nod_’s picture

nod_
Primary language French
Location Lille
CreditAttribution: nod_ at Acquia commented
FileSize
core-3319917-9.5-4.patch4.26 KB

and the 9.5 version while i'm at it.

nod_’s picture

nod_
Primary language French
Location Lille
CreditAttribution: nod_ at Acquia commented
Parent issue: #3258933: [meta] Update JavaScript dependencies for Drupal 10 » #3238507: Drupal 10 JavaScript dependency plan
lauriii’s picture

lauriii
he/him
Primary language Finnish
Location Finland
CreditAttribution: lauriii at Acquia commented
Status: Needs review » Needs work
  1. This change is recommended by https://webpack.js.org/guides/asset-modules/ which is great 👍
  2. I tried modifying one of the SVGs that is loaded inline to CSS and the change appeared in the generated CSS 👍
  3. I noticed that there are couple other changes in the generated CSS. I think we should generate new patch where we run yarn build:css ⚠️
nod_’s picture

nod_
Primary language French
Location Lille
CreditAttribution: nod_ at Acquia commented
Status: Needs work » Needs review
FileSize
core-3319917-9.5-8.patch6.44 KB
interdiff-4-9.txt1.82 KB

css changes are in 9.5 because of missing changes in the postcss patch, didn't want to step anywhere so removed it. Adding it back.

lauriii’s picture

lauriii
he/him
Primary language Finnish
Location Finland
CreditAttribution: lauriii at Acquia commented
Status: Needs review » Reviewed & tested by the community

That's right, I realized the patch should only have an impact on CKEditor 5 build. I tested again with CKEditor 5 related SVG and confirmed those are still loaded too 😇. To me #8 seems fine even though the changes are unrelated because that's the result of running yarn build (which should always be run when reviewing changes to package.json / yarn.lock).

Confirmed that Drupal 10 looks all good 👍

  • longwave committed b2bc383 on 10.1.x 
    Issue #3319917 by nod_, lauriii: Remove raw-loader dependency

  • longwave committed c0b30d9 on 10.0.x 
    Issue #3319917 by nod_, lauriii: Remove raw-loader dependency

(cherry...
longwave’s picture

longwave
he/him
Primary language English
Location UK
CreditAttribution: longwave at Full Fat Things commented
Version: 10.1.x-dev » 9.5.x-dev

Committed and pushed b2bc383ebe to 10.1.x and c0b30d9236 to 10.0.x. Thanks!

Will backport to 9.5.x once #8 comes back green.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
CreditAttribution: alexpott at Acro Commerce, Thunder commented

@longwave congrats on your first commit!

lauriii’s picture

lauriii
he/him
Primary language Finnish
Location Finland
CreditAttribution: lauriii at Acquia commented

Congrats @longwave 🥳 🎉

nod_’s picture

nod_
Primary language French
Location Lille
CreditAttribution: nod_ at Acquia commented

and it's green :D

longwave’s picture

longwave
he/him
Primary language English
Location UK
CreditAttribution: longwave at Full Fat Things commented
Status: Reviewed & tested by the community » Fixed

Committed f18b610 and pushed to 9.5.x. Thanks!

  • longwave committed f18b610 on 9.5.x 
    Issue #3319917 by nod_, lauriii: Remove raw-loader dependency

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.