Vulnerability with the bootstrap version

[stepintooracledba]

Hi Team,

Looks like covr still uses older version of bootstrap which has below vulnerability.

XSS is possible in the collapse data-parent attribute.

Can we get the latest version of bootstrap updated?

[jimhester]

The only place bootstrap is used in covr is to generate the interactive reports, which are run by the developer directly. In addition this is all coming from the DT package and its dependencies, not covr directly, there is nothing we can do in covr to change this.

[DSGeoff]

It looks like old versions of bootstrap are hard coded in a couple places. That seems like it could be fixed pretty easily. I can't say for sure if this is what's causing the issue, but an old version of bootstrap is still causing issues, creating a blocking vulnerability for covr.

In R/report.R, bootstrap 3.3.5 is hard coded:

covr/R/report.R

Lines 281 to 289 in f1866d2

	# from htmldeps::html_dependency_bootstrap (not yet on CRAN)
	html_dependency_bootstrap <- function () {
	htmltools::htmlDependency(name = "bootstrap", version = "3.3.5",
	src = system.file(file = "www/shared/bootstrap", package = "covr"),
	meta = list(viewport = "width=device-width, initial-scale=1"),
	script = c("js/bootstrap.min.js", "shim/html5shiv.min.js", "shim/respond.min.js"),
	stylesheet = c("css/bootstrap.min.css", "css/bootstrap-theme.min.css")
	)
	}

In tests/testthat/test-report.htm, bootstrap 3.3.7 is hard coded:

covr/tests/testthat/test-report.htm

Lines 14 to 17 in f1866d2

	<link href="lib/bootstrap-3.3.7/css/bootstrap.min.css" rel="stylesheet" />
	<script src="lib/bootstrap-3.3.7/js/bootstrap.min.js"></script>
	<script src="lib/bootstrap-3.3.7/shim/html5shiv.min.js"></script>
	<script src="lib/bootstrap-3.3.7/shim/respond.min.js"></script>