[🐸 Frogbot] Update version of org.jsoup:jsoup to 1.15.3

[github-actions]

📦 Vulnerable Dependencies

Severity	ID	Contextual Analysis	Direct Dependencies	Impacted Dependency	Fixed Versions
High	CVE-2021-37714	Applicable	org.jsoup:jsoup:1.8.3	org.jsoup:jsoup 1.8.3	[1.14.2]

🔖 Details

Vulnerability Details

Jfrog Research Severity:	Medium
Contextual Analysis:	Applicable
Direct Dependencies:	org.jsoup:jsoup:1.8.3
Impacted Dependency:	org.jsoup:jsoup:1.8.3
Fixed Versions:	[1.14.2]
CVSS V3:	7.5

Unsanitized input parsed by the jsoup library can cause an infinite loop or an unhandled exception, resulting in Denial of Service.

🔬 JFrog Research Details

Description:
jsoup is a Java library for parsing HTML which implements the WHATWG HTML5 specification.

In jsoup prior to 1.14.2, An attacker that can supply crafted HTML input to one of jsoup's parsing methods, for example Jsoup.parse(html_data) or Jsoup.connect(url), can lead to an infinite loop and/or an exception being thrown, which could cause a denial of service.

The vulnerability is due to to the fact that the WHATWG specification includes multiple states during the HTML processing, one of them is the insertion mode which is a state variable that controls the primary operation of the tree construction stage. It accesses the stack of open elements and adds or removes elements according to the parsed elements from the HTML, in that way, it can deal with nested tags. In some cases, it will go upwards across all of the tags in the stack.

Remediation:

Development mitigations

Set a watchdog timer to limit Jsoup's parsing duration, for example:

import java.util.concurrent.*;
import org.jsoup.nodes.Document;
import org.jsoup.Jsoup;

public class App {
    private static int MAX_TIME = 3;
    public static void main(String[] args) throws InterruptedException, ExecutionException {
        ExecutorService executorService = Executors.newSingleThreadExecutor();

        Callable<Document> callable = () -> {
            Document doc = Jsoup.connect("http://evil.com").get();
            System.out.println(String.format((doc.title())));
            return doc;
        };

        Future<Document> future = executorService.submit(callable);

        try {
            Document doc = future.get(MAX_TIME, TimeUnit.SECONDS); // Limit Jsoup execution time
            System.out.println(doc);
        } catch (InterruptedException e) { // Handle interruptions
            System.out.println("job was interrupted");
        } catch (ExecutionException e) {
            System.out.println("caught exception: " + e.getCause());
        } catch (TimeoutException e) {
            future.cancel(true);              // If timeout expired, cancel Jsoup
            System.out.println("timeout");
        }

        executorService.shutdown();
    }

}

---

🐸 JFrog Frogbot