What changed in Optimizely LanguageManager 5.5.4

Version 5.5.4 of EPiServer.Labs.LanguageManager, the Languages add-on for Optimizely CMS 12, is out on the Optimizely NuGet feed. There are no public release notes, and the release notes inside the package are copied word for word from 5.5.3:

Compatible with Translator Text API. Bugs fix.

I wanted to know what actually changed, so I compared the two packages.

The server side is unchanged

I decompiled EPiServer.Labs.LanguageManager.dll from both versions with ILSpy and compared the output. The only differences are the assembly version, and a few hash IDs in the compiled Razor view for the settings page. Those IDs change when whitespace or comments in a .cshtml file move around. The HTML it renders is the same.

The NuGet dependency is also unchanged: EPiServer.CMS.UI [12.29.0, 13.0.0).

The client side was rebuilt

The real changes are in the client module, the zip file that ends up in modules/_protected. It went from 986 KB to 300 KB.

• The *.js.uncompressed.js debug copies of every Dojo file are gone.
• The React bundle for the settings page went from 2.2 MB to 498 KB. Most of that was an inline source map, which is no longer included.
• The Dojo files are minified with a different tool. Every single file differs byte for byte, but the strings and property names in them are the same. The logic is the same, only written differently.

There is one small difference you might notice. When adding items to a project, invalid content references now give a warning in the browser console. That line has always been in the source code:

contentReferences = contentReferences.filter(function (reference) {
    if (ContentReference.isContentReference(reference)) {
        return true;
    }
    // eslint-disable-next-line no-console
    console.warn("epi-cms/project/ProjectService: the given value '" + reference + "' is not a valid content reference.");
});

The old Dojo build removed all console calls. The new minifier keeps them.

axios was upgraded

The settings page is a React app, and it bundles the HTTP client axios. The version number is easy to find in the minified bundle:

xc.Axios=wc,xc.CanceledError=kl,xc.CancelToken=Ic,xc.isCancel=Nl,xc.VERSION="1.20.0"

In 5.5.3 it was 1.13.2. React is still 17.0.2. This is the only dependency that changed.

Is it a security fix?

Most likely, yes. I went through the security advisories for axios. 36 of them affect version 1.13.2, and 1.20.0 is the first version that fixes all of them.

The timing also fits. axios 1.20.0 was released on 24 August. On 16 September, axios published 12 new advisories that are only fixed in 1.20.0, and six of them affect 1.13.2. LanguageManager 5.5.4 was packaged on 8 October.

Upgrading to exactly the first version that is clean looks like someone fixing a warning from a security scanner, rather than a routine upgrade.

Should you worry?

Not much. Many of the vulnerabilities are in the Node.js parts of axios, like proxy handling, HTTP/2 and socket paths. In LanguageManager, axios runs in the editor's browser, so they don't apply.

Most of the rest are prototype pollution gadgets. To use them, an attacker must first find another way to pollute Object.prototype in the CMS edit interface. And the settings page is only available to editors, calling its own API.

But if your organization scans the files you deploy for known vulnerabilities, 5.5.3 will show up with 36 axios CVEs. 5.5.4 will not.

Conclusion

LanguageManager 5.5.4 has no new features and no bug fixes that I could find. It's a rebuild with a smaller package and an up-to-date axios. If you're on CMS 12, upgrade. It's safe, and it will keep your security scanner quiet.