GHSA-q56w-52fg-7qp7: 
JavaScript vulnerability analysis and mitigation

Impact

An app that renders Block Kit JSON written by someone else (a message preview, a workflow editor, a bot that echoes payloads) could be made to fail or hang:

• Crash. A field of the wrong type, such as a number where a text object goes, an object in place of a list, or a block type of "constructor", made the render throw. In the browser that unmounts the host's React tree up to the nearest error boundary; in a server render (renderToString or a framework's SSR) it fails the whole response, and error boundaries don't run there.
• Stack overflow. Blocks nested thousands deep inside callouts, containers or conditions, or a markdown block with lists or emphasis nested thousands deep, overflowed the call stack.
• Stall. Text built to defeat the parsers took seconds of CPU per render, blocking the tab or the server's event loop: long mrkdwn strings with unclosed markers or many date tokens, and markdown blocks with long runs of * or _ or a line of thousands of list markers (9 to 11 s at Slack's 12,000-character limit). Separately, Copy table put table cells on the clipboard unchanged, so a cell such as =HYPERLINK(...) ran as a formula when the reader pasted it into a spreadsheet, and a tab or line break in a cell could add cells or rows of its own. No data is read or written by the renderer itself; the impact is availability of the page or server that renders the payload, and the formula risk in the reader's spreadsheet.

Patches

0.8.3 reads every payload field through shape checks and leaves out a value of the wrong type, caps rendered nesting at 32 levels, parses mrkdwn in linear time, guards the markdown parser against deep nesting, and writes copied cells with the same formula guard as downloads.

Workarounds

Validate payloads against Slack's limits and the Block Kit schema before rendering them, render untrusted payloads inside an error boundary in the browser, and wrap server renders in try/catch, in a worker with a time limit so a stalled render can be stopped.

References

• #371 fix(mrkdwn): parse long text and date tokens in linear time
• #372 fix(render): render payloads of the wrong shape without throwing
• #373 fix(markdown): parse deeply nested emphasis and lists without stalling
• #374 fix(table): keep copied cells from running as spreadsheet formulas