Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -10,17 +10,17 @@ domainurl: ##DomainURL##

# Security Advisories in Syncfusion<sup style="font-size:70%">&reg;</sup> EJ2 Controls

Syncfusion<sup style="font-size:70%">&reg;</sup> places the utmost priority on the security of our controls. Users can rest assured about the security of our controls, as we have implemented all necessary measures to mitigate security vulnerabilities such as cross-site scripting and insecure dependencies. To meet security standards, Syncfusion<sup style="font-size:70%">&reg;</sup> utilizes the [ESLint](https://eslint.org/) and [ESLint plugin security](https://github.com/eslint-community/eslint-plugin-security#rules) tools for static code analysis. Additionally, Syncfusion<sup style="font-size:70%">&reg;</sup> packages undergo software composition analysis using the [SOOS](https://soos.io/) security tool.
Syncfusion<sup style="font-size:70%">&reg;</sup> places the utmost priority on the security of our controls. Users can rest assured of the security of our controls, as we have implemented all necessary measures to mitigate security vulnerabilities, such as cross-site scripting and insecure dependencies. To meet security standards, Syncfusion<sup style="font-size:70%">&reg;</sup> utilizes the [ESLint](https://eslint.org/) and [ESLint plugin security](https://github.com/eslint-community/eslint-plugin-security#rules) tools for static code analysis. Additionally, Syncfusion<sup style="font-size:70%">&reg;</sup> packages undergo software composition analysis using the [SOOS](https://soos.io/) security tool.

This document provides a description of the security updates available for Syncfusion<sup style="font-size:70%">&reg;</sup> Essential<sup style="font-size:70%">&reg;</sup> JS2 controls for volume release.
This document provides a description of the security updates available for Syncfusion<sup style="font-size:70%">&reg;</sup> Essential<sup style="font-size:70%">&reg;</sup> JS2 controls per volume release.

## Security Updates

The following security updates are available for JavaScript DocumentEditor control and are listed based on the release version.
The following security updates are available for JavaScript (ES5) Document Editor control and are listed based on the release version.

### 2024 Volume 2 (v26.2.4) - July 25, 2024

This release resolves critical and moderate security vulnerabilities affecting the JavaScript Document Editor Docker Image.
This release resolves critical and moderate security vulnerabilities affecting the JavaScript (ES5) Document Editor Docker Image.

**Threat:**

Expand All @@ -42,4 +42,4 @@ For details on common security updates related to Syncfusion<sup style="font-siz

## Security Issue

If users discover any security issues or need assistance in resolving them with Syncfusion<sup style="font-size:70%">&reg;</sup> controls, please contact us by creating a support ticket on [our support site](https://syncfusion.com/support) or by posting your query on Stack Overflow with the tag `syncfusion-ej2`.
If users discover any security issues or need assistance resolving them with Syncfusion<sup style="font-size:70%">&reg;</sup> controls, please contact us by creating a support ticket on [our support site](https://syncfusion.com/support) or by posting your query on Stack Overflow with the tag `syncfusion-ej2`.
Original file line number Diff line number Diff line change
Expand Up @@ -11,52 +11,52 @@ domainurl: ##DomainURL##

## Prerequisites

Have [`Azure account`](https://azure.microsoft.com/en-gb/) and [`Azure CLI`](https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest) setup in your environment.
Ensure you have an [`Azure account`](https://azure.microsoft.com/en-gb/) and the [`Azure CLI`](https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest) installed in your environment.

You can get the example [`web service project from GitHub`](https://github.com/SyncfusionExamples/EJ2-DocumentEditor-Java-WebService) and then perform the following steps to create the packages and host in azure app service.
You can get the example [`web service project from GitHub`](https://github.com/SyncfusionExamples/EJ2-DocumentEditor-Java-WebService) and then perform the following steps to build the package and host it in an Azure App Service.

**Step 1:** Clean the package using following command.
**Step 1:** Clean and package the application using the following command.

```console
mvn clean package
```

**Step 2:** Run the application locally using following command.
**Step 2:** Run the application locally to verify the build using the following command.

```console
mvn spring-boot:run
```

**Step 3:** Build the package using following command.
**Step 3:** Build the final package using the following command.

```console
mvn package
```

Above package generation command creates the `**tomcat-0.0.1-SNAPSHOT.war**` in the below location in the sample folder.
The above package-generation command creates the `**tomcat-0.0.1-SNAPSHOT.war**` in the following location in the sample folder.

`target/tomcat-0.0.1-SNAPSHOT.war`

**Step 4:** Create a Azure app service with Java & Tomcat. For example, create the app services name as `documenteditorjava`.
**Step 4:** Create an Azure App Service with Java & Tomcat. For example, create an App Service named `documenteditorjava`.

**Step 5:** After creating app service, navigate to `Advanced Tools` options under `Development Tools`.
**Step 5:** After creating the App Service, navigate to the **Advanced Tools** option under **Development Tools**.

![Advanced tools ](../images/azure_java_advancedtools.png)

Then, click `Go` and select the `CMD` options under `Debug console`.
Then, click **Go** and select the **CMD** option under **Debug console**.

![Debug console ](../images/azure_java_debugconsole.png)

**Step 6:** Once the file manager is opened, please navigate to
**Step 6:** Once the file manager is opened, navigate to

`site -> wwwroot -> webapps`

**Step 7:** Now, upload the generated war file `tomcat-0.0.1-SNAPSHOT.war`. Uploaded war file gets extracted automatically, it will uploaded like below:
**Step 7:** Now, upload the generated WAR file `tomcat-0.0.1-SNAPSHOT.war`. The uploaded WAR file is extracted automatically, as shown below:

![Uploaded war](../images/java_azure_uploaded.png)

**Step 8:** Browse to the app.

Browse to the deployed app at `http://<app_name>.azurewebsites.net`, i.e. `http://documenteditorjava.azurewebsites.net`. Browse this link and it navigate to the Document Editor Web API control `http://documenteditorjava.azurewebsites.net/tomcat-0.0.1-SNAPSHOT`. It returns the default get method response.
Browse to the deployed app at `http://<app_name>.azurewebsites.net` (for example, `http://documenteditorjava.azurewebsites.net`). Navigating to this link opens the Document Editor Web API at `http://documenteditorjava.azurewebsites.net/tomcat-0.0.1-SNAPSHOT`, which returns the default GET-method response.

Append the app service running the URL `http://documenteditorjava.azurewebsites.net/tomcat-0.0.1-SNAPSHOT` to the service URL in the client-side Document Editor control. For more information about the Document Editor control, refer to this [`getting started page`](../getting-started).
Append the running App Service URL `http://documenteditorjava.azurewebsites.net/tomcat-0.0.1-SNAPSHOT` to the `serviceUrl` in the client-side Document Editor control. For more information about the Document Editor control, refer to the [`Getting Started` page](../getting-started).
Original file line number Diff line number Diff line change
Expand Up @@ -11,25 +11,25 @@ domainurl: ##DomainURL##

## Prerequisites

* `AWS Account` :Have Amazon account
* `AWS Account`: Have an Amazon Web Services (AWS) account.
* `AWS CLI`: Install the AWS Command Line Interface (CLI) on your local machine.
* `Kubectl` : Install the Kubernetes command-line tool kubectl on your local machine.
* `Kubectl`: Install the Kubernetes command-line tool `kubectl` on your local machine.
* `Docker`: Install Docker on your local machine.
* `Word Processor Docker Image`: Have a Docker image of the Word Processor server ready to deploy.

To deploy the Word Processor server docker image, need to follow the below process
To deploy the Word Processor server Docker image, you need to follow the process below:

* Push Docker Image to Registry (Amazon Elastic Registry)
* Push Docker Image to Registry (Amazon Elastic Container Registry)
* Deploy Docker Image on Amazon Kubernetes Service

Lets us discuss briefly about the each process
Let us briefly discuss each process.

## Push the Docker image to the Amazon Elastic Registry
## Push the Docker image to the Amazon Elastic Container Registry

**Step 1:** Dockerize the Word Processor Server Application with the image name [syncfusion/word-processor-server](https://hub.docker.com/r/syncfusion/word-processor-server)
**Step 1:** Dockerize the Word Processor Server application using the [syncfusion/word-processor-server](https://hub.docker.com/r/syncfusion/word-processor-server) image.

```
docker build -t <your-image-name>
docker build -t <your-image-name> .
```

**Step 2:** Create a private repository name ‘documenteditor’ in Amazon Elastic Container Registry (ECR) using the AWS CLI or AWS Console to push the docker image
Expand All @@ -43,13 +43,13 @@ aws ecr create-repository --repository-name <repository-name>
```
docker tag <your-image-name>:latest <your_ECR_registry_URI>/<your_repository_name>:latest
```
Refer to the following example to tag the image
Refer to the following example to tag the image:

```
docker tag syncfusion/word-processor-server:latest 123456.dkr.ecr.us-east-1.amazonaws.com/documenteditor:latest
```

> Get the ECR registry URI from AWS console or using the below AWS CLI command
N> Get the ECR registry URI from the AWS console or with the following AWS CLI command:

```
aws ecr describe-repositories --repository-names <repository-name> --query 'repositories[*].repositoryUri' --output text
Expand All @@ -61,28 +61,28 @@ aws ecr describe-repositories --repository-names <repository-name> --query 'repo
aws ecr get-login-password --region <region> | docker login --username AWS --password-stdin <your_ECR_registry_URI>
```

Replace <region> with your AWS region and <your_ECR_registry_URI> with your ECR registry URI.
Replace `<region>` with your AWS region and `<your_ECR_registry_URI>` with your ECR registry URI.

**Step 5:** Push the tagged image to ECR

```
docker push <your_ECR_registry_URI>/<your_image_name>:latest
docker push <your_ECR_registry_URI>/<your_repository_name>:latest
```

## Deploy Docker Image on Amazon Kubernetes Service

Follow the below steps to deploy the Docker image from the Amazon Elastic Registry( ECR) to Amazon Kubernetes Services (EKS)
Follow the steps below to deploy the Docker image from the Amazon Elastic Container Registry (ECR) to Amazon Kubernetes Service (EKS).

**Step 1:** DCreate Amazon EKS cluster using the AWS Console
**Step 1:** Create an Amazon EKS cluster using the AWS console.

**Step 2:** Authenticate with AWS ECR
Need to get the authenticate with the AWS ECR to pull the image from the registry
You need to authenticate with AWS ECR to pull the image from the registry.

```
aws ecr get-login-password --region <your-region> | docker login --username AWS --password-stdin <your-aws-account-id>.dkr.ecr.<your-region>.amazonaws.com
```

**Step 3:** : Configure Kubernetes to Communicate with the Cluster
**Step 3:** Configure Kubernetes to communicate with the cluster

```
aws eks --region <region> update-kubeconfig --name <cluster-name>
Expand All @@ -104,47 +104,47 @@ In this command:
* <your-region> should be replaced with your AWS region.


**Step 5:** To create Kubernetes deployment write Kubernetes manifest
**Step 5:** To create a Kubernetes deployment, write a Kubernetes manifest.

**i.** Create a Kubernetes Deployment manifest (deployment.yaml) for your application. Specify the Docker image location.
**i.** Create a Kubernetes Deployment manifest (`deployment.yaml`) for your application. Specify the Docker image location.

```
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: ```your-deployment```
name: your-deployment
spec:
replicas: 3
selector:
matchLabels:
app: ```your-app```
app: your-app
template:
metadata:
labels:
app: ```your-app```
app: your-app
spec:
containers:
- name: your-container
image: ```<account-id>.dkr.ecr.<region>.amazonaws.com/your-repository-name:tag```
image: <account-id>.dkr.ecr.<region>.amazonaws.com/your-repository-name:tag
ports:
- containerPort: 80
```
**ii.** Apply the Deployment manifest to create the deployment in your EKS cluster
**ii.** Apply the Deployment manifest to create the deployment in your EKS cluster.

```
kubectl apply -f deployment.yaml
```

**iii.** Use port forwarding to access the Word Processor Server application locally and verify its functionality
**iii.** Use port-forwarding to access the Word Processor Server application locally and verify its functionality.

```
kubectl port-forward pod-name local-port:container-port
kubectl port-forward <pod-name> <local-port>:<container-port>
```

> Get the pod names in AWS Console or using the below AWS CLI command
N> Get the pod names from the AWS console or with the following AWS CLI command:

```
kubectl get pods
```

Finally you can get the sample in the localhost http://```<your-ip>```/api/documenteditor/
Finally, you can access the sample at `http://localhost:<local-port>/api/documenteditor/`.
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,9 @@ domainurl: ##DomainURL##

## Prerequisites

* Have [`Azure account`](https://azure.microsoft.com/en-gb/) and [`Azure CLI`](https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest) setup in your environment.
* Ensure you have an [`Azure account`](https://azure.microsoft.com/en-gb/) and the [`Azure CLI`](https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest) installed in your environment.

* Run the following command to open the Azure login page. Sign into your [`Microsoft Azure account`](https://azure.microsoft.com/en-gb/).
* Run the following command to open the Azure login page. Sign in to your [`Microsoft Azure account`](https://azure.microsoft.com/en-gb/).

```
az login
Expand All @@ -23,7 +23,7 @@ az login

Create a resource group using the [`az group create`](https://docs.microsoft.com/en-us/cli/azure/group#az-group-create) command.

The following example creates a resource group named documenteditorresourcegroup in the eastus location.
The following example creates a resource group named `documenteditorresourcegroup` in the **East US** location.

```
az group create --name documenteditorresourcegroup --location "East US"
Expand All @@ -41,16 +41,16 @@ az appservice plan create --name documenteditorappservice --resource-group docum

**Step 3:** Create a Docker Compose app.

Create a multi-container [`web app`](https://docs.microsoft.com/en-us/azure/app-service/containers/app-service-linux-intro) in the documenteditorappservice App Service plan with the [`az webapp create`](https://docs.microsoft.com/en-us/cli/azure/webapp?view=azure-cli-latest#az-webapp-create) command. The following command creates the web app using the provided Docker compose file. Please look into the section for getting started with Docker compose to create the Docker compose file for the Document Editor server and use the created Docker compose file here.
Create a multi-container [`web app`](https://docs.microsoft.com/en-us/azure/app-service/containers/app-service-linux-intro) in the `documenteditorappservice` App Service plan with the [`az webapp create`](https://docs.microsoft.com/en-us/cli/azure/webapp?view=azure-cli-latest#az-webapp-create) command. The following command creates the web app using the provided Docker Compose file. **Step 4:** Create the `documenteditor-server-compose.yml` file before running this command. **Step 5:** Use the created Docker Compose file in this command.

```
az webapp create --resource-group documenteditorresourcegroup --plan documenteditorappservice --name documenteditor-server --multicontainer-config-type compose --multicontainer-config-file documenteditor-server-compose.yml
```

**Step 4:** Browse to the app.
**Step 6:** Browse to the app.

Browse to the deployed app at `http://<app_name>.azurewebsites.net`, i.e. `http://documenteditor-server.azurewebsites.net`. Browse this link and navigate to the Document Editor Web API control `http://documenteditor-server.azurewebsites.net/api/documenteditor`. It returns the default get method response.
Browse to the deployed app at `http://<app_name>.azurewebsites.net` (for example, `http://documenteditor-server.azurewebsites.net`). Navigating to this link opens the Document Editor Web API at `http://documenteditor-server.azurewebsites.net/api/documenteditor/`, which returns the default GET-method response.

Append the app service running the URL `http://documenteditor-server.azurewebsites.net/api/documenteditor/` to the service URL in the client-side Document Editor control. For more information about the Document Editor control, refer to this [`getting started page`](../getting-started).
Append the running App Service URL `http://documenteditor-server.azurewebsites.net/api/documenteditor/` to the `serviceUrl` in the client-side Document Editor control. For more information about the Document Editor control, refer to the [`Getting Started` page](../getting-started).

For more information about the app container service, please look deeper into the [`Microsoft Azure Container Service`](https://docs.microsoft.com/en-us/azure/app-service/containers/quickstart-multi-container) for a production-ready setup.
For more information about the app container service, see the [`Microsoft Azure Container Service`](https://docs.microsoft.com/en-us/azure/app-service/containers/quickstart-multi-container) for a production-ready setup.
Loading