MicroStrategy response to Polyfill.io in June 2024

Polyfill .io hosted JavaScript files used by websites to provide support for a wide range of web browsers.  In June 2024 it was revealed that the site’s files were serving up malicious code. 
Reference: Polyfill.io JavaScript supply chain attack impacts over 100K sites (bleepingcomputer.com) 
 
Strategy Community Connector, a web application providing connectivity to web hosted data storage services including Box and OneDrive for analytics datasets, contains a reference to Polyfill .io.  As of June 27th, public DNS resolution for Polyfill .io domain has been taken down, eliminating the ongoing risk.
Strategy’s current release (June 2024) contains updated Community Connectors code which removes the polyfill reference.  Strategy provides the following steps for customers unable to upgrade and who wish to manually remove the reference within Community Connectors.   
Community Connectors is an optional component included as part of the Strategy Platform Installer.  Community Connectors needs to be deployed onto a webserver from the CommunityConnectors.WAR file.  Customers who have not installed or deployed the CommunityConnectors.WAR file do not need to take any steps.
 
Steps to remove references to Polyfill .io in CommunityConnectors: 

1. Files to be modified:  
   
1. /[path_to_your_web_server]/CommunityConnectors/onedrive-cc/index.html 
2. /[path_to_your_web_server]/CommunityConnectors/box-cc/index.html 
2. Remove the <script> tag for the CDN 
   
1. Open the two index.html files and find the code <script src="https://cdn.polyfill.io/v2/polyfill.min.js?features=Element.prototype.classList"></script> 
   
2. Remove the full line and save the file 
   
3. The change will take effect immediately, no restart is needed.