[Security] Bump auth0-lock from 10.20.0 to 11.21.0

[dependabot-preview]

Bumps auth0-lock from 10.20.0 to 11.21.0. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects auth0-lock

Overview

Auth0 Lock version 11.20.4 and earlier did not properly sanitize the generated HTML code. Customers using the additionalSignUpFields customization option to add a checkbox to the sign-up dialog that are passing a placeholder property obtained from an untrusted source (e.g. a query parameter) could allow cross-site scripting (XSS) on their signup pages.

Am I affected?

You are affected by this vulnerability if all of the following conditions apply:

• You are using Auth0 Lock version 11.20.4 or earlier.
• You pass additionalSignUpFields as options when initializing Lock which includes a field of type checkbox whose placeholder value is obtained from an untrusted source.

An example of a vulnerable snippet is the following where the placeholder value is partially user-controlled by the name query parameter:

<script>
    var params = new URLSearchParams(window.location.search);
    var options = {
        auth: {
            redirectUrl: 'http://localhost:12345/callback',
            responseType: 'code',
</tr></table> ... (truncated)
Affected versions: < 11.21.0

Release notes

Sourced from auth0-lock's releases.

v11.21.0

Security

• Make placeholder text-only, add new placeholderHTML for additionalSignUpFields #1788 (davidpatrick)

v11.20.4

Fixed

• Fix for login button being cut off on some mobile devices #1785 (stevehobbsdev)
• Emit authorization_error event on passwordless error #1784 (stevehobbsdev)

v11.20.3

Changed

• Bumped Auth0.js to 9.12.2 #1780 (stevehobbsdev)
• Prevent loading overlay from showing when using Sign In With Apple #1779 (stevehobbsdev)

Fixed

• Fix translation pt-PT #1776 (mario-moura-silva)

v11.20.2

Fixed

• [CAUTH-277] prevent posting when captcha is required and empty #1774 (jfromaniello)

v11.20.1

Fixed

• Set the default token validation leeway to 60 sec #1770 (stevehobbsdev)

v11.20.0

Added

• add captcha support #1765 (jfromaniello)

Security

• [SDK-980] Bumped auth0.js to 9.12.0 #1767 (stevehobbsdev)

v11.19.0

Added

• New Feature: Signup Success Event #1754 (fostergn)

Fixed

• [SDK-1191] Lock social buttons now render as links instead of buttons #1760 (stevehobbsdev)
• [SDK-1141] Altered readme samples to remove ref to localstorage #1759 (stevehobbsdev)
• Applied overflow style only on mobile views #1758 (stevehobbsdev)
• Bugfix for WebExtension #1750 (STK913)

v11.18.1

Added

• added hungarian transalation for social_signup_needs_terms_acception #1744 (smatyas)
• Add a Lock event 'sso login' #1742 (countergram)
• fix: Add missing property for finnish translation #1740 (petetnt)

Fixed

... (truncated)

Changelog

Sourced from auth0-lock's changelog.

v11.21.0 (2020-01-30)

Full Changelog

Security

• Make placeholder text-only, add new placeholderHTML for additionalSignUpFields #1788 (davidpatrick)

v11.20.4 (2020-01-29)

Full Changelog

Fixed

• Fix for login button being cut off on some mobile devices #1785 (stevehobbsdev)
• Emit authorization_error event on passwordless error #1784 (stevehobbsdev)

v11.20.3 (2020-01-15)

Full Changelog

Changed

• Bumped Auth0.js to 9.12.2 #1780 (stevehobbsdev)
• Prevent loading overlay from showing when using Sign In With Apple #1779 (stevehobbsdev)

Fixed

• Fix translation pt-PT #1776 (mario-moura-silva)

v11.20.2 (2020-01-06)

Full Changelog

Fixed

• [CAUTH-277] prevent posting when captcha is required and empty #1774 (jfromaniello)

v11.20.1 (2019-12-20)

Full Changelog

Fixed

• Set the default token validation leeway to 60 sec #1770 (stevehobbsdev)

v11.20.0 (2019-12-16)

Full Changelog

Added

... (truncated)

Commits

• ec6fdab v11.21.0
• 698efa4 Release 11.21.0 (#1789)
• 6c15e56 support for placeholderHTML (#1788)
• ecd2493 Release 11.20.4 (#1787)
• b474e38 Fix for login button being cut off on some mobile devices (#1785)
• b0788f6 Emit authorization_error event on passwordless error (#1784)
• 243fc7b Release 11.20.3 (#1781)
• a79d7b7 Prevent loading overlay from showing when using Sign In With Apple (#1779)
• b8af2d6 Bumped Auth0.js to 9.12.2 (#1780)
• a6df11b Merge pull request #1776 from mario-moura-silva/master
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[dependabot-preview]

Superseded by #48.