Karimtantawey

Seven recursive traversals in `lib/dom.js` operate without a depth limit. When processing a sufficiently deeply nested DOM tree, the JavaScript call stack is exhausted, resulting in a `RangeError: Maximum call stack size exceeded` and crashing the application. This can lead to a denial of service if a service accepts attacker-controlled XML and performs any of the affected operations. The affected functions and entry points include - `Node.prototype.normalize()` - `XMLSerializer.serializeToString()` - `Element.getElementsByTagName()`, `getElementsByTagNameNS()`, `getElementsByClassName()`, and `getElementById()` (via the ` visitNode` function) - `Node.cloneNode(true)` - `Document.importNode(node, true)` - `node.textContent` (getter) - `Node.isEqualNode(other)`

The token exchange path accepts invalid `code verifier` values, including one-character strings, for S256 PKCE (Proof Key for Code Exchange) flows, which contradicts RFC7636. Since short or weak verifiers are permitted and failed attempts do not invalidate the authorization code, an attacker who intercepts an authorization code can perform an online brute-force attack on `code verifier` guesses to obtain a token.

jsPDF is a JavaScript library used to generate PDF documents. A flaw exists in the `addJS` method within the Node.js build, versions prior to 4.1.0, due to the use of a shared module-scoped variable (`text`) for storing JavaScript content. In concurrent environments, such as Node.js web servers, this shared variable can lead to Cross-User Data Leakage. Specifically, JavaScript content intended for one user may be overwritten by content from another request before the PDF is fully generated, resulting in a PDF for User A containing the JavaScript payload meant for User B. This issue primarily affects server-side environments, but similar race conditions could potentially occur in client-side implementations.

jsPDF is a JavaScript library used to generate PDF documents. A flaw exists due to user-controlled input to the `addMetadata` function, allowing arbitrary XML injection. If unsanitized input is provided to the `addMetadata` method, a user can inject arbitrary XMP metadata into the generated PDF. This can compromise the integrity of the PDF if it is subsequently signed or processed. The example attack vector demonstrates injecting a fake "dc:creator" (Author) to spoof the document source. The vulnerable function is `addMetadata`. The first argument of the `addMetadata` function is the vulnerable parameter.

jsPDF is a JavaScript library used to generate PDFs. A flaw exists where user-controlled input to the `addImage` method can lead to a denial of service. Specifically, providing a malicious BMP image with large width and/or height values in its header can cause excessive memory allocation, resulting in out-of-memory errors. The `html` method is also affected by this issue. The `addImage` function is vulnerable due to the lack of sanitization of image data or URLs. An example attack involves providing malicious BMP image data as the first argument to the `addImage` function.