Bump org.openrefine:main from 3.8.5 to 3.8.7

[dependabot]

Bumps org.openrefine:main from 3.8.5 to 3.8.7.

Release notes

Sourced from org.openrefine:main's releases.

OpenRefine 3.8.7

This release fixes an issue (#6977) which prevents exporting Wikidata QuickStatements in OpenRefine 3.8.5 and 3.8.4, as well as an issue (#6941) which prevents login to Wikidata with OpenRefine 3.8.4. This release includes the same collection of important vulnerability fixes as 3.8.4. We encourage users to upgrade swiftly. It also fixes an issue (#7001) in 3.8.6 where the update banner was always displayed. It is otherwise identical to 3.8.6.

To continue using the Google Drive and Google Sheets integration, users need to obtain their own application credentials from the Google API Console.

Note: the vulnerability fixes were originally released as 3.8.3 but that version is dysfunctional due to human errors in the release process. The description of the vulnerabilities is included again here for visibility.

Vulnerabilities in OpenRefine

• PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF). CVE-2024-47879, GHSA-3jm4-c6qf-jrh3. Reported by @​wandernauta, fix by @​wetneb.
• Reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand. Severity: high. CVE-2024-47880, GHSA-79jv-5226-783f. Reported by @​wandernauta, fix by @​wetneb.
• Error page lacks escaping, leading to potential XSS on import of malicious project. Severity: moderate. CVE-2024-47882, GHSA-j8hp-f2mj-586g
• Directory slip in LoadLanguageCommand. Severity: high. GHSA-qfwq-6jh6-8xx4. Reported and fixed by @​wetneb.

Vulnerabilities in bundled extensions

• gdata: Reflected cross-site scripting vulnerability (XSS) in authorized.vt. CVE-2024-47878, GHSA-pw3x-c5vp-mfc3. Reported by @​wandernauta, fix by @​wetneb.
• gdata: leak of OAuth application credentials. Severity: high. GHSA-3pg4-qwc8-426r. Reported and fixed by @​wetneb.
• database: SQLite integration allows filesystem access, remote code execution (RCE). Severity: high. CVE-2024-47881, GHSA-87cf-j763-vvh8. Reported by @​wandernauta, fix by @​wetneb.

Vulnerabilities in Butterfly (web framework used in OpenRefine)

• Path/URL confusion in resource handling leading to multiple weaknesses. Severity: critical. CVE-2024-47883. GHSA-3p8v-w8mr-m3x8. Reported by @​wandernauta, fix by @​wetneb.
• parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE). Severity: moderate. GHSA-mpcw-3j5p-p99x. Reported by @​wandernauta, fix by @​wetneb.

Special thanks to @​wandernauta for the hard work that went into analyzing and reporting those vulnerabilities responsibly and to @​tfmorris for reviewing mitigations.

Full Changelog: OpenRefine/OpenRefine@3.8.5...3.8.6

3.8.6

This release fixes an issue (#6977) which prevents exporting Wikidata QuickStatements in OpenRefine 3.8.5 and 3.8.4, as well as an issue (#6941) which prevents login to Wikidata with OpenRefine 3.8.4. This release includes the same collection of important vulnerability fixes as 3.8.4. We encourage users to upgrade swiftly.

To continue using the Google Drive and Google Sheets integration, users need to obtain their own application credentials from the Google API Console.

Note: the vulnerability fixes were originally released as 3.8.3 but that version is dysfunctional due to human errors in the release process. The description of the vulnerabilities is included again here for visibility.

Vulnerabilities in OpenRefine

• PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF). CVE-2024-47879, GHSA-3jm4-c6qf-jrh3. Reported by @​wandernauta, fix by @​wetneb.
• Reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand. Severity: high. CVE-2024-47880, GHSA-79jv-5226-783f. Reported by @​wandernauta, fix by @​wetneb.
• Error page lacks escaping, leading to potential XSS on import of malicious project. Severity: moderate. CVE-2024-47882, GHSA-j8hp-f2mj-586g
• Directory slip in LoadLanguageCommand. Severity: high. GHSA-qfwq-6jh6-8xx4. Reported and fixed by @​wetneb.

Vulnerabilities in bundled extensions

• gdata: Reflected cross-site scripting vulnerability (XSS) in authorized.vt. CVE-2024-47878, GHSA-pw3x-c5vp-mfc3. Reported by @​wandernauta, fix by @​wetneb.
• gdata: leak of OAuth application credentials. Severity: high. GHSA-3pg4-qwc8-426r. Reported and fixed by @​wetneb.
• database: SQLite integration allows filesystem access, remote code execution (RCE). Severity: high. CVE-2024-47881, GHSA-87cf-j763-vvh8. Reported by @​wandernauta, fix by @​wetneb.

... (truncated)

Commits

• b1819fc Bump version to 3.8.7 to fix unversioned RefineServlet
• c1f11d0 Bump version to 3.8.6
• 8bba910 Fix inclusion of CSRF token in QuickStatements export (#6978). Fixes #6977
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.