<p><div><div><div><div data-show-faces="false" data-height="21" data-width="100" data-layout="button_count" data-send="true" data-href="https://www.r-bloggers.com/pym-js-library-vulnerability-in-widgetframe-package/"></div></div><div></div></div><div></div></div>
<div>
(This article was first published on <strong><a href="https://rud.is/b/2018/02/16/pym-js-library-vulnerability-in-widgetframe-package/"> R – rud.is</a></strong>, and kindly contributed to <a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers)</a> </div>
<h2>What’s Up?</h2>
<p>The NPR Visuals Team created and maintains a <a rel="nofollow" href="http://blog.apps.npr.org/pym.js/" target="_blank">javascript library</a> that makes it super easy to embed iframes on web pages and have said documents still be responsive.</p>
<p>The <a rel="nofollow" href="https://cran.r-project.org/web/packages/widgetframe/index.html" target="_blank"><code>widgetframe</code></a> R htmlwidget uses <code>pym.js</code> to bring this (much needed) functionality into widgets and (eventually) shiny apps.</p>
<p>NPR <a rel="nofollow" href="http://blog.apps.npr.org/2018/02/15/pym-security-vulnerability.html" target="_blank">reported</a> a <strong>critical</strong> vulnerability in this library on February 15th, 2018 with no details (said details will be coming next week).</p>
<p>Per NPR’s guidance, <strong>any production code using pym.js needs to be pulled or updated to use this new library</strong>.</p>
<p>I created <a rel="nofollow" href="https://github.com/bhaskarvk/widgetframe/issues/12" target="_blank">an issue</a> &amp; pushed up a <a rel="nofollow" href="https://github.com/bhaskarvk/widgetframe/pull/13" target="_blank">PR</a> that incorporates the new version. NOTE that the YAML config file in the existing CRAN package and GitHub dev version incorrectly has 1.3.2 as the version (it’s really the 1.3.1 dev version).</p>
<p>A look at the diff:<br>
<a rel="nofollow" href="https://i2.wp.com/rud.is/b/wp-content/uploads/2018/02/Screenshot-2018-2-16-Updated-pym-js-to-1-3-2-it-was-1-3-1-tho-the-yaml-said-1-3-2-by-hrbrmstr-%C2%B7-Pull-Request-13-%C2%B7-bhaska....png?ssl=1" target="_blank"><img data-orig-file="https://i2.wp.com/rud.is/b/wp-content/uploads/2018/02/Screenshot-2018-2-16-Updated-pym-js-to-1-3-2-it-was-1-3-1-tho-the-yaml-said-1-3-2-by-hrbrmstr-·-Pull-Request-13-·-bhaska....png?fit=1530%2C358&amp;ssl=1" data-orig-size="1530,358" data-medium-file="https://i2.wp.com/rud.is/b/wp-content/uploads/2018/02/Screenshot-2018-2-16-Updated-pym-js-to-1-3-2-it-was-1-3-1-tho-the-yaml-said-1-3-2-by-hrbrmstr-·-Pull-Request-13-·-bhaska....png?fit=300%2C70&amp;ssl=1" data-attachment-id="8231" data-image-meta="{" data-image-description="" src="https://i2.wp.com/rud.is/b/wp-content/uploads/2018/02/Screenshot-2018-2-16-Updated-pym-js-to-1-3-2-it-was-1-3-1-tho-the-yaml-said-1-3-2-by-hrbrmstr-%C2%B7-Pull-Request-13-%C2%B7-bhaska....png?resize=780%2C183&ssl=1" data-permalink="https://rud.is/b/2018/02/16/pym-js-library-vulnerability-in-widgetframe-package/screenshot-2018-2-16-updated-pym-js-to-1-3-2-it-was-1-3-1-tho-the-yaml-said-1-3-2-by-hrbrmstr-%c2%b7-pull-request-13-%c2%b7-bhaska/" data-large-file="https://i2.wp.com/rud.is/b/wp-content/uploads/2018/02/Screenshot-2018-2-16-Updated-pym-js-to-1-3-2-it-was-1-3-1-tho-the-yaml-said-1-3-2-by-hrbrmstr-·-Pull-Request-13-·-bhaska....png?fit=530%2C124&amp;ssl=1" alt="" data-image-title="Screenshot-2018-2-16 Updated pym js to 1 3 2 (it was 1 3 1 tho the yaml said 1 3 2) by hrbrmstr · Pull Request #13 · bhaska[…]" width="450" data-comments-opened="1" class="wp-image-8231" data-recalc-dims="1"></a></p>
<p>suggest that the library was not performing URL sanitization (and now is).</p>
<h2>Watch Out For Standalone Docs</h2>
<p>Any R markdown docs compiled in “standalone” mode will need to be recompiled and re-published as the vulnerable <code>pym.js</code> library comes along for the ride in those documents. </p>
<p>Regardless of “standalone mode”, if you used <code>widgetframe</code> in any context, including:</p>
<ul>
<li><a rel="nofollow" href="http://rmarkdown.rstudio.com/flexdashboard/" target="_blank">Flex Dashboard</a></li>
<li><a rel="nofollow" href="https://rud.is/b/2018/02/16/pym-js-library-vulnerability-in-widgetframe-package/rmarkdown.rstudio.com" target="_blank">RMarkdown</a> + <a rel="nofollow" href="https://rud.is/b/2018/02/16/pym-js-library-vulnerability-in-widgetframe-package/yihui.name/knitr/" target="_blank">knitr</a></li>
<li><a rel="nofollow" href="http://rmarkdown.rstudio.com/lesson-13.html" target="_blank">RMarkdown Website</a></li>
<li><a rel="nofollow" href="https://slides.yihui.name/xaringan/" target="_blank">Xaringan Presentations</a> (and other html-based R pres)</li>
<li><a rel="nofollow" href="https://bookdown.org/" target="_blank">Bookdown</a> gitbook</li>
<li><a rel="nofollow" href="https://github.com/rstudio/blogdown/" target="_blank">blogdown</a></li>
</ul>
<p>anything created is vulnerable regardless of standalone compilation or not.</p>
<h2>FIN</h2>
<p>Once the final details are released I’ll update this post and may do a new post. Until then:</p>
<ul>
<li>check if you’ve used <code>widgetframe</code> (directly or indirectly)</li>
<li>REMOVE ALL VULNERABLE DOCS from RPubs, GitHub pages, your web site (etc) today</li>
<li>regenerate all standalone documents ASAP</li>
<li>regenerate your blogs, books, dashboards, etc ASAP with the patched code; DO THIS FOR INTERNAL as well as internet-facing content.</li>
<li>monitor this space</li>
</ul>
	<p>
<div>
<div>To <strong>leave a comment</strong> for the author, please follow the link and comment on their blog: <strong><a href="https://rud.is/b/2018/02/16/pym-js-library-vulnerability-in-widgetframe-package/"> R – rud.is</a></strong>.</div>
<hr>
<a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers.com</a> offers <strong><a rel="nofollow" href="https://feedburner.google.com/fb/a/mailverify?uri=RBloggers">daily e-mail updates</a></strong> about <a rel="nofollow" href="https://www.r-project.org/" title="The R Project for Statistical Computing">R</a> news and <a rel="nofollow" href="https://www.r-bloggers.com/search/tutorial" title="R tutorials">tutorials</a> on topics such as: <a rel="nofollow" href="https://www.r-bloggers.com/search/data%20science" title="Data science">Data science</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/Big%20Data" title="Big Data">Big Data, <a rel="nofollow" href="https://www.r-users.com/" title="R jobs">R jobs</a>, visualization (<a rel="nofollow" href="https://www.r-bloggers.com/search/ggplot2" title="ggplot and ggplot2 tutorials">ggplot2</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/boxplot" title="Boxplots using lattice and ggplot2 tutorials">Boxplots</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/map" title="Maps and gis">maps</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/animation" title="Animation in R">animation</a>), programming (<a rel="nofollow" href="https://www.r-bloggers.com/search/RStudio" title="RStudio IDE for R">RStudio</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/sweave" title="Sweave and literate programming">Sweave</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/LaTeX" title="LaTeX in R">LaTeX</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/SQL" title="SQL and databases">SQL</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/eclipse" title="Eclipse IDE for R">Eclipse</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/git" title="git and github, Version Control System">git</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/hadoop" title="Large data in R using Hadoop">hadoop</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/Web+Scraping" title="Web Scraping of google, facebook, yahoo, twitter and more using R">Web Scraping</a>) statistics (<a rel="nofollow" href="https://www.r-bloggers.com/search/regression" title="Regressions and ANOVA analysis tutorials">regression</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/PCA" title="principal component analysis tutorial">PCA</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/time+series" title="Time series">time series</a>, <a rel="nofollow" href="https://www.r-bloggers.com/search/trading" title="finance trading">trading</a>) and more...
<img alt="" width="1" src="http://feeds.feedburner.com/~r/RBloggers/~4/ks5BXas6T5o" height="1"></a></div>