fix: exclude vulnerable Bootstrap runtime plugins

chen21019 · chen21019 · commit b17901d02b51 · 2026-08-01T10:45:01.000+08:00
diff --git a/app/components/page-header/template.hbs b/app/components/page-header/template.hbs
@@ -70,7 +70,7 @@
               </ul>
               {{#if item.showAlert}}
                 {{#tooltip-element class="tooltip-warning" type='tooltip-warning' tooltipFor="showAlert"}}
-                  {{#link-to item.alertRoute data-toggle="tooltip" data-placement="bottom"}}!{{/link-to}}
+                  {{#link-to item.alertRoute}}!{{/link-to}}
                 {{/tooltip-element}}
               {{/if}}
             </li>
diff --git a/docs/baselines/npm-package-lock.sass-replacement.node24-ignore-scripts.json b/docs/baselines/npm-package-lock.sass-replacement.node24-ignore-scripts.json
@@ -1,12 +1,12 @@
 {
   "name": "@pasturestack/web-console",
-  "version": "1.6.56-pasturestack.35",
+  "version": "1.6.56-pasturestack.36",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@pasturestack/web-console",
-      "version": "1.6.56-pasturestack.35",
+      "version": "1.6.56-pasturestack.36",
       "license": "Apache-2.0",
       "dependencies": {
         "sass": "1.99.0"
diff --git a/docs/modernization.md b/docs/modernization.md
@@ -45,6 +45,15 @@ responsive local, OpenID Connect, SAML, MFA, and recovery layout; a
 reduced-motion animated gradient; new PastureStack-owned authentication and
 favicon assets; and a root favicon response so the login console remains clean.
 
+`v1.6.56-pasturestack.36` removes the unsupported aggregate Bootstrap 3
+JavaScript bundle from the production graph. The compatibility UI now loads
+only the reviewed transition, collapse, and dropdown modules required by the
+navigation and menus. The vulnerable Button, Tooltip, and Popover plug-ins are
+excluded from both test and production artifacts, and source gates prevent
+their data APIs or jQuery entry points from being restored accidentally.
+Bootstrap-derived Sass remains temporarily isolated behind the existing theme
+boundary and must be replaced as a separate visual migration.
+
 Production candidate packages omit JavaScript and third-party Intl source maps.
 They also omit the development-only `none` pseudo-locale. Development and test
 builds retain application source maps and the pseudo-locale for local diagnostics.
diff --git a/ember-cli-build.js b/ember-cli-build.js
@@ -105,7 +105,13 @@ module.exports = function(defaults) {
   app.import('node_modules/@xterm/xterm/css/xterm.css');
   app.import('node_modules/@xterm/xterm/lib/xterm.js');
   app.import('node_modules/@xterm/addon-fit/lib/addon-fit.js');
-  app.import('vendor/bootstrap-sass/assets/javascripts/bootstrap.js');
+  // Bootstrap 3 is out of support.  Keep its reviewed styles during the
+  // compatibility migration, but only ship the two JavaScript behaviours the
+  // console still uses.  In particular, do not re-introduce button.js,
+  // tooltip.js, popover.js, or the aggregate bootstrap.js bundle.
+  app.import('vendor/bootstrap-sass/assets/javascripts/bootstrap/transition.js');
+  app.import('vendor/bootstrap-sass/assets/javascripts/bootstrap/collapse.js');
+  app.import('vendor/bootstrap-sass/assets/javascripts/bootstrap/dropdown.js');
   app.import('node_modules/jgrowl/jquery.jgrowl.js');
   app.import('node_modules/jgrowl/jquery.jgrowl.css');
   app.import('node_modules/jquery.cookie/jquery.cookie.js');
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@pasturestack/web-console",
-  "version": "1.6.56-pasturestack.35",
+  "version": "1.6.56-pasturestack.36",
   "private": true,
   "directories": {
     "doc": "doc",
diff --git a/scripts/check-modernization-blockers b/scripts/check-modernization-blockers
@@ -41,8 +41,8 @@ with open('package.json', encoding='utf-8') as f:
     print(json.load(f).get('version', ''))
 PY
 )
-if [[ "$version" != "1.6.56-pasturestack.35" ]]; then
-  echo "UNEXPECTED_UI_ARTIFACT_VERSION version=$version expected=1.6.56-pasturestack.35"
+if [[ "$version" != "1.6.56-pasturestack.36" ]]; then
+  echo "UNEXPECTED_UI_ARTIFACT_VERSION version=$version expected=1.6.56-pasturestack.36"
   failures=$((failures + 1))
 fi
 
diff --git a/scripts/check-ui-bootstrap-sass-bower-migration b/scripts/check-ui-bootstrap-sass-bower-migration
@@ -5,6 +5,7 @@ cd "$(dirname "$0")/.."
 
 python3 - <<'PY_CHECK'
 import json
+import re
 from pathlib import Path
 
 pkg = json.loads(Path("package.json").read_text())
@@ -22,14 +23,62 @@ if vendor_package.get("version") != "3.4.3":
     raise SystemExit("vendor bootstrap-sass must track npm bootstrap-sass 3.4.3")
 if vendor_package.get("license") != "MIT":
     raise SystemExit("vendor bootstrap-sass license metadata must remain MIT")
+
+build = Path("ember-cli-build.js").read_text(encoding="utf-8")
+runtime_imports = re.findall(
+    r"app\.import\('(?P<path>vendor/bootstrap-sass/assets/javascripts/[^']+)'\)",
+    build,
+)
+expected_imports = [
+    "vendor/bootstrap-sass/assets/javascripts/bootstrap/transition.js",
+    "vendor/bootstrap-sass/assets/javascripts/bootstrap/collapse.js",
+    "vendor/bootstrap-sass/assets/javascripts/bootstrap/dropdown.js",
+]
+if runtime_imports != expected_imports:
+    raise SystemExit(
+        "Bootstrap runtime allowlist drift: "
+        f"actual={runtime_imports!r} expected={expected_imports!r}"
+    )
+
+forbidden_source_patterns = {
+    "Bootstrap loading-state data API": re.compile(r"data-loading-text", re.I),
+    "Bootstrap Button data API": re.compile(r"data-toggle\s*=\s*['\"]buttons?['\"]", re.I),
+    "Bootstrap Tooltip data API": re.compile(r"data-toggle\s*=\s*['\"]tooltip['\"]", re.I),
+    "Bootstrap Popover data API": re.compile(r"data-toggle\s*=\s*['\"]popover['\"]", re.I),
+    "Bootstrap Button jQuery API": re.compile(r"\.button\s*\("),
+    "Bootstrap Tooltip jQuery API": re.compile(r"\.tooltip\s*\("),
+    "Bootstrap Popover jQuery API": re.compile(r"\.popover\s*\("),
+}
+active_sources = [
+    path
+    for root in (Path("app"), Path("tests"))
+    for path in root.rglob("*")
+    if path.is_file() and path.suffix in {".js", ".hbs", ".html"}
+]
+violations = []
+for path in active_sources:
+    source = path.read_text(encoding="utf-8")
+    for description, pattern in forbidden_source_patterns.items():
+        if pattern.search(source):
+            violations.append(f"{path}: {description}")
+if violations:
+    raise SystemExit(
+        "Vulnerable Bootstrap runtime API restored:\n" + "\n".join(violations)
+    )
 PY_CHECK
 
 if grep -R "bower_components/bootstrap-sass-official\\|node_modules/bootstrap-sass" -n ember-cli-build.js app/styles package.json docs/baselines/npm-package-lock.sass-replacement.node24-ignore-scripts.json 2>/dev/null; then
   echo "Bootstrap Sass must be imported from vendored maintenance source, not Bower or node_modules" >&2
   exit 1
 fi
 
-grep -q "vendor/bootstrap-sass/assets/javascripts/bootstrap.js" ember-cli-build.js
+if grep -q "app.import('vendor/bootstrap-sass/assets/javascripts/bootstrap.js')" ember-cli-build.js; then
+  echo "The unsupported aggregate Bootstrap JavaScript bundle must not be imported" >&2
+  exit 1
+fi
+grep -q "vendor/bootstrap-sass/assets/javascripts/bootstrap/transition.js" ember-cli-build.js
+grep -q "vendor/bootstrap-sass/assets/javascripts/bootstrap/collapse.js" ember-cli-build.js
+grep -q "vendor/bootstrap-sass/assets/javascripts/bootstrap/dropdown.js" ember-cli-build.js
 grep -q "vendor/bootstrap-sass/assets/stylesheets/bootstrap" app/styles/app-light.scss
 grep -q "vendor/bootstrap-sass/assets/stylesheets/bootstrap" app/styles/app-dark.scss
 test -f vendor/bootstrap-sass/LICENSE
diff --git a/scripts/check-ui-console-workspace b/scripts/check-ui-console-workspace
@@ -134,4 +134,4 @@ if [[ -n ${PASTURESTACK_PRIVATE_MARKER:-} ]] && grep -RInF -- "$PASTURESTACK_PRI
 fi
 
 printf 'UI_CONSOLE_WORKSPACE_OK version=%s persistence=%s cross_tab=%s\n' \
-  1.6.56-pasturestack.35 browser-session broker-broadcast
+  1.6.56-pasturestack.36 browser-session broker-broadcast
diff --git a/scripts/check-ui-static-artifact-layout b/scripts/check-ui-static-artifact-layout
@@ -17,12 +17,21 @@ cat >"$tmpdir/dist/index.html" <<'HTML'
 <script src="assets/vendor-test.js"></script>
 <script src="assets/ui-test.js"></script>
 HTML
-printf 'vendor\n' >"$tmpdir/dist/assets/vendor-test.js"
+printf 'vendor bs.collapse bs.dropdown\n' >"$tmpdir/dist/assets/vendor-test.js"
 printf 'ui\n' >"$tmpdir/dist/assets/ui-test.js"
 printf 'source map\n' >"$tmpdir/dist/assets/ui-test.js.map"
 printf '{}\n' >"$tmpdir/dist/translations/en-us.json"
 printf '{}\n' >"$tmpdir/dist/translations/none.json"
 
+printf 'vendor bs.collapse bs.dropdown bs.tooltip\n' >"$tmpdir/dist/assets/vendor-test.js"
+if SOURCE_DATE_EPOCH=1700000000 bash ./scripts/package-static-candidate \
+    9.9.9 "$tmpdir/dist" "$tmpdir/unsafe.tar.gz" >"$tmpdir/unsafe.out" 2>&1; then
+  echo "VULNERABLE_BOOTSTRAP_RUNTIME_ACCEPTED"
+  exit 1
+fi
+grep -q 'DIST_VULNERABLE_BOOTSTRAP_RUNTIME_PRESENT signature=bs.tooltip' "$tmpdir/unsafe.out"
+printf 'vendor bs.collapse bs.dropdown\n' >"$tmpdir/dist/assets/vendor-test.js"
+
 out="$tmpdir/9.9.9.tar.gz"
 out_repeat="$tmpdir/9.9.9-repeat.tar.gz"
 SOURCE_DATE_EPOCH=1700000000 bash ./scripts/package-static-candidate 9.9.9 "$tmpdir/dist" "$out" >"$tmpdir/ui-static-layout.out"
diff --git a/scripts/check-ui-test-harness-blockers b/scripts/check-ui-test-harness-blockers
@@ -51,8 +51,8 @@ if module_for_count != 0:
     fail("MODULE_FOR_USAGE_COUNT_UNEXPECTED", actual=module_for_count, expected=0)
 if module_for_component_count != 0:
     fail("MODULE_FOR_COMPONENT_USAGE_UNEXPECTED", actual=module_for_component_count, expected=0)
-if direct_qunit_import_count != 58:
-    fail("DIRECT_QUNIT_IMPORT_COUNT_UNEXPECTED", actual=direct_qunit_import_count, expected=58)
+if direct_qunit_import_count != 59:
+    fail("DIRECT_QUNIT_IMPORT_COUNT_UNEXPECTED", actual=direct_qunit_import_count, expected=59)
 
 direct_qunit_tests = [
     Path("tests/unit/application/route-test.js"),
diff --git a/scripts/node24-lock-smoke.js b/scripts/node24-lock-smoke.js
@@ -1459,10 +1459,13 @@ function expectBootstrapMultiselectVendorGlobal() {
 function expectBootstrapSassAssets() {
   const packagePath = "vendor/bootstrap-sass/package.json";
   const jsPath = "vendor/bootstrap-sass/assets/javascripts/bootstrap.js";
+  const transitionPath = "vendor/bootstrap-sass/assets/javascripts/bootstrap/transition.js";
+  const collapsePath = "vendor/bootstrap-sass/assets/javascripts/bootstrap/collapse.js";
+  const dropdownPath = "vendor/bootstrap-sass/assets/javascripts/bootstrap/dropdown.js";
   const scssPath = "vendor/bootstrap-sass/assets/stylesheets/_bootstrap.scss";
   const variablesPath = "vendor/bootstrap-sass/assets/stylesheets/bootstrap/_variables.scss";
   const fontPath = "vendor/bootstrap-sass/assets/fonts/bootstrap/glyphicons-halflings-regular.woff2";
-  for (const file of [packagePath, jsPath, scssPath, variablesPath, fontPath]) {
+  for (const file of [packagePath, jsPath, transitionPath, collapsePath, dropdownPath, scssPath, variablesPath, fontPath]) {
     if (!fs.existsSync(file)) {
       fail(`bootstrap-sass asset missing: ${file}`);
     }
@@ -1472,14 +1475,20 @@ function expectBootstrapSassAssets() {
     fail(`bootstrap-sass vendor metadata changed: version=${packageJson.version} license=${packageJson.license}`);
   }
   const js = fs.readFileSync(jsPath, "utf8");
+  const transition = fs.readFileSync(transitionPath, "utf8");
+  const collapse = fs.readFileSync(collapsePath, "utf8");
+  const dropdown = fs.readFileSync(dropdownPath, "utf8");
   const scss = fs.readFileSync(scssPath, "utf8");
   if (!js.includes("VERSION  = '3.4.1'") || !js.includes("$.fn.modal") || !js.includes("$.fn.dropdown")) {
     fail("bootstrap-sass JavaScript asset does not look like Bootstrap 3.4.x");
   }
+  if (!transition.includes("emulateTransitionEnd") || !collapse.includes("bs.collapse") || !dropdown.includes("bs.dropdown")) {
+    fail("bootstrap-sass runtime allowlist modules lost expected behavior");
+  }
   if (!scss.includes("bootstrap/variables") || !scss.includes("bootstrap/mixins")) {
     fail("bootstrap-sass SCSS entrypoint lost expected imports");
   }
-  console.log("bootstrap-sass-assets-smoke-ok vendor=3.4.3 bootstrap-js=3.4.1");
+  console.log("bootstrap-sass-assets-smoke-ok vendor=3.4.3 bootstrap-js=3.4.1 runtime=transition,collapse,dropdown");
 }
 
 function expectEmberPowerSelectSassAssets() {
diff --git a/scripts/package-static-candidate b/scripts/package-static-candidate
@@ -63,6 +63,22 @@ if ! find "$dist_dir/assets" -maxdepth 1 -type f -name 'vendor*.js' | grep -q .;
   exit 1
 fi
 
+for required_signature in bs.collapse bs.dropdown; do
+  if ! find "$dist_dir/assets" -maxdepth 1 -type f -name 'vendor*.js' \
+      -exec grep -lF "$required_signature" {} + | grep -q .; then
+    echo "DIST_REQUIRED_BOOTSTRAP_RUNTIME_MISSING signature=$required_signature" >&2
+    exit 1
+  fi
+done
+
+for forbidden_signature in bs.button bs.tooltip bs.popover data-loading-text; do
+  if find "$dist_dir/assets" -maxdepth 1 -type f -name 'vendor*.js' \
+      -exec grep -lF "$forbidden_signature" {} + | grep -q .; then
+    echo "DIST_VULNERABLE_BOOTSTRAP_RUNTIME_PRESENT signature=$forbidden_signature" >&2
+    exit 1
+  fi
+done
+
 tmpdir=$(mktemp -d)
 out_tmp="${out_tar}.tmp.$$"
 cleanup() {
diff --git a/tests/unit/vendor/bootstrap-runtime-boundary-test.js b/tests/unit/vendor/bootstrap-runtime-boundary-test.js
@@ -0,0 +1,14 @@
+import Ember from 'ember';
+import { module, test } from 'qunit';
+
+module('Unit | Vendor | Bootstrap runtime boundary');
+
+test('only the required compatibility plugins are registered', function(assert) {
+  let plugins = Ember.$.fn;
+
+  assert.equal(typeof plugins.collapse, 'function', 'responsive navigation keeps collapse support');
+  assert.equal(typeof plugins.dropdown, 'function', 'menus keep dropdown support');
+  assert.strictEqual(plugins.button, undefined, 'the vulnerable Button plugin is not shipped');
+  assert.strictEqual(plugins.tooltip, undefined, 'the vulnerable Tooltip plugin is not shipped');
+  assert.strictEqual(plugins.popover, undefined, 'the vulnerable Popover plugin is not shipped');
+});

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@pasturestack/web-console",`
`3`		`- "version": "1.6.56-pasturestack.35",`
	`3`	`+ "version": "1.6.56-pasturestack.36",`
`4`	`4`	`"private": true,`
`5`	`5`	`"directories": {`
`6`	`6`	`"doc": "doc",`