Update dependency hono to v4.5.8 [SECURITY] - autoclosed

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
hono (source)	`4.4.13` -> `4.5.8`

GitHub Vulnerability Alerts

CVE-2024-43787

Summary

Hono CSRF middleware can be bypassed using crafted Content-Type header.

Details

MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case.

https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.ts#L16-L17

As a result, attacker can bypass csrf middleware using upper-case form-like MIME type, such as "Application/x-www-form-urlencoded".

PoC

<html>
  <head>
    <title>CSRF Test</title>
    <script defer>
      document.addEventListener("DOMContentLoaded", () => {
        document.getElementById("btn").addEventListener("click", async () => {
          const res = await fetch("http://victim.example.com/test", {
            method: "POST",
            credentials: "include",
            headers: {
              "Content-Type": "Application/x-www-form-urlencoded",
            },
          });
        });
      });
    </script>
  </head>
  <body>
    <h1>CSRF Test</h1>
    <button id="btn">Click me!</button>
  </body>
</html>

Impact

Bypass csrf protection implemented with hono csrf middleware.

Discussion

I'm not sure that omitting csrf checks for Simple POST request is a good idea. CSRF prevention and CORS are different concepts even though CORS can prevent CSRF in some cases.

Release Notes

honojs/hono (hono)

### [`v4.5.8`](https://togithub.com/honojs/hono/releases/tag/v4.5.8) [Compare Source](https://togithub.com/honojs/hono/compare/v4.5.7...v4.5.8) ##### Security Fix for CSRF Protection Middleware Before this release, in versions 4.5.7 and below, the CSRF Protection Middleware did not treat requests including `Content-Types` with uppercase letters (e.g., `Application/x-www-form-urlencoded`) as potential attacks, allowing them to pass. This could cause unexpected behavior, leading to a vulnerability. If you are using the CSRF Protection Middleware, please upgrade to version 4.5.8 or higher immediately. For more details, see the report here: https://github.com/honojs/hono/security/advisories/GHSA-rpfr-3m35-5vx5 ### [`v4.5.7`](https://togithub.com/honojs/hono/releases/tag/v4.5.7) [Compare Source](https://togithub.com/honojs/hono/compare/v4.5.6...v4.5.7) ##### What's Changed - fix(jsx/dom): Fixed a bug that caused Script elements to turn into Style elements. by [@usualoma](https://togithub.com/usualoma) in [https://github.com/honojs/hono/pull/3294](https://togithub.com/honojs/hono/pull/3294) - perf(jsx/dom): improve performance by [@usualoma](https://togithub.com/usualoma) in [https://github.com/honojs/hono/pull/3288](https://togithub.com/honojs/hono/pull/3288) - feat(jsx): improve a-tag types with well known values by [@ssssota](https://togithub.com/ssssota) in [https://github.com/honojs/hono/pull/3287](https://togithub.com/honojs/hono/pull/3287) - fix(validator): Fixed a bug in hono/validator where URL Encoded Data could not be validated if the Content-Type included charset. by [@uttk](https://togithub.com/uttk) in [https://github.com/honojs/hono/pull/3297](https://togithub.com/honojs/hono/pull/3297) - feat(jsx): improve `target` and `formtarget` attribute types by [@ssssota](https://togithub.com/ssssota) in [https://github.com/honojs/hono/pull/3299](https://togithub.com/honojs/hono/pull/3299) - docs(README): change Twitter to X by [@nakasyou](https://togithub.com/nakasyou) in [https://github.com/honojs/hono/pull/3301](https://togithub.com/honojs/hono/pull/3301) - fix(client): replace optional params to url correctly by [@yusukebe](https://togithub.com/yusukebe) in [https://github.com/honojs/hono/pull/3304](https://togithub.com/honojs/hono/pull/3304) - feat(jsx): improve input attribute types based on react by [@ssssota](https://togithub.com/ssssota) in [https://github.com/honojs/hono/pull/3302](https://togithub.com/honojs/hono/pull/3302) ##### New Contributors - [@uttk](https://togithub.com/uttk) made their first contribution in [https://github.com/honojs/hono/pull/3297](https://togithub.com/honojs/hono/pull/3297) **Full Changelog**: https://github.com/honojs/hono/compare/v4.5.6...v4.5.7 ### [`v4.5.6`](https://togithub.com/honojs/hono/releases/tag/v4.5.6) [Compare Source](https://togithub.com/honojs/hono/compare/v4.5.5...v4.5.6) #### What's Changed - fix(jsx): handle async component error explicitly and throw the error in the response by [@usualoma](https://togithub.com/usualoma) in [https://github.com/honojs/hono/pull/3274](https://togithub.com/honojs/hono/pull/3274) - fix(validator): support multipart headers without a separating space by [@Ernxst](https://togithub.com/Ernxst) in [https://github.com/honojs/hono/pull/3286](https://togithub.com/honojs/hono/pull/3286) - fix(validator): Allow form data will mutliple values appended by [@nicksrandall](https://togithub.com/nicksrandall) in [https://github.com/honojs/hono/pull/3273](https://togithub.com/honojs/hono/pull/3273) - feat(jsx): improve meta-tag types with well known values by [@ssssota](https://togithub.com/ssssota) in [https://github.com/honojs/hono/pull/3276](https://togithub.com/honojs/hono/pull/3276) #### New Contributors - [@Ernxst](https://togithub.com/Ernxst) made their first contribution in [https://github.com/honojs/hono/pull/3286](https://togithub.com/honojs/hono/pull/3286) - [@ssssota](https://togithub.com/ssssota) made their first contribution in [https://github.com/honojs/hono/pull/3276](https://togithub.com/honojs/hono/pull/3276) **Full Changelog**: https://github.com/honojs/hono/compare/v4.5.5...v4.5.6 ### [`v4.5.5`](https://togithub.com/honojs/hono/releases/tag/v4.5.5) [Compare Source](https://togithub.com/honojs/hono/compare/v4.5.4...v4.5.5) #### What's Changed - fix(jsx): allow null, undefined, and boolean to be returned from function component by [@usualoma](https://togithub.com/usualoma) in [https://github.com/honojs/hono/pull/3241](https://togithub.com/honojs/hono/pull/3241) - feat(context): Add types for `c.header` by [@nakasyou](https://togithub.com/nakasyou) in [https://github.com/honojs/hono/pull/3221](https://togithub.com/honojs/hono/pull/3221) - fix(jsx): fix draggable type to accept boolean by [@yasuaki640](https://togithub.com/yasuaki640) in [https://github.com/honojs/hono/pull/3253](https://togithub.com/honojs/hono/pull/3253) - feat(context): add Context-Type types to `c.header` by [@nakasyou](https://togithub.com/nakasyou) in [https://github.com/honojs/hono/pull/3255](https://togithub.com/honojs/hono/pull/3255) - fix(serve-static): supports directory contains `.` and not end `/` by [@yusukebe](https://togithub.com/yusukebe) in [https://github.com/honojs/hono/pull/3256](https://togithub.com/honojs/hono/pull/3256) **Full Changelog**: https://github.com/honojs/hono/compare/v4.5.4...v4.5.5 ### [`v4.5.4`](https://togithub.com/honojs/hono/releases/tag/v4.5.4) [Compare Source](https://togithub.com/honojs/hono/compare/v4.5.3...v4.5.4) ##### What's Changed - fix(jsx): corrects the type of 'draggable' attribute in intrinsic-elements.ts by [@yasuaki640](https://togithub.com/yasuaki640) in [https://github.com/honojs/hono/pull/3224](https://togithub.com/honojs/hono/pull/3224) - feat(jsx): allow to merge CSSProperties declaration by [@jonasnobile](https://togithub.com/jonasnobile) in [https://github.com/honojs/hono/pull/3228](https://togithub.com/honojs/hono/pull/3228) - feat(client): Add WebSocket Provider Integration Tests and Enhance WebSocket Initialization by [@naporin0624](https://togithub.com/naporin0624) in [https://github.com/honojs/hono/pull/3213](https://togithub.com/honojs/hono/pull/3213) - fix(types): `param` in `ValidationTargets` supports optional param by [@yusukebe](https://togithub.com/yusukebe) in [https://github.com/honojs/hono/pull/3229](https://togithub.com/honojs/hono/pull/3229) ##### New Contributors - [@jonasnobile](https://togithub.com/jonasnobile) made their first contribution in [https://github.com/honojs/hono/pull/3228](https://togithub.com/honojs/hono/pull/3228) **Full Changelog**: https://github.com/honojs/hono/compare/v4.5.3...v4.5.4 ### [`v4.5.3`](https://togithub.com/honojs/hono/releases/tag/v4.5.3) [Compare Source](https://togithub.com/honojs/hono/compare/v4.5.2...v4.5.3) #### What's Changed - fix(validator): Add double quotation marks to multipart checker regex by [@CPlusPatch](https://togithub.com/CPlusPatch) in [https://github.com/honojs/hono/pull/3195](https://togithub.com/honojs/hono/pull/3195) - fix(validator): support `application/json` with a charset as JSON by [@yusukebe](https://togithub.com/yusukebe) in [https://github.com/honojs/hono/pull/3199](https://togithub.com/honojs/hono/pull/3199) - fix(jsx): fix handling of SVG elements in JSX. by [@usualoma](https://togithub.com/usualoma) in [https://github.com/honojs/hono/pull/3204](https://togithub.com/honojs/hono/pull/3204) - fix(jsx/dom): fix performance issue with adding many new node listings by [@usualoma](https://togithub.com/usualoma) in [https://github.com/honojs/hono/pull/3205](https://togithub.com/honojs/hono/pull/3205) - fix(service-worker): refer to `self.fetch` correctly by [@yusukebe](https://togithub.com/yusukebe) in [https://github.com/honojs/hono/pull/3200](https://togithub.com/honojs/hono/pull/3200) #### New Contributors - [@CPlusPatch](https://togithub.com/CPlusPatch) made their first contribution in [https://github.com/honojs/hono/pull/3195](https://togithub.com/honojs/hono/pull/3195) **Full Changelog**: https://github.com/honojs/hono/compare/v4.5.2...v4.5.3 ### [`v4.5.2`](https://togithub.com/honojs/hono/releases/tag/v4.5.2) [Compare Source](https://togithub.com/honojs/hono/compare/v4.5.1...v4.5.2) #### What's Changed - fix(helper/adapter): don't check `navigator` is `undefined` by [@yusukebe](https://togithub.com/yusukebe) in [https://github.com/honojs/hono/pull/3171](https://togithub.com/honojs/hono/pull/3171) - fix(types): handle readonly array correctly by [@m-shaka](https://togithub.com/m-shaka) in [https://github.com/honojs/hono/pull/3172](https://togithub.com/honojs/hono/pull/3172) - Revert "fix(helper/adapter): don't check `navigator` is `undefined` by [@yusukebe](https://togithub.com/yusukebe) in [https://github.com/honojs/hono/pull/3173](https://togithub.com/honojs/hono/pull/3173) - fix(type): degradation of generic type handling by [@m-shaka](https://togithub.com/m-shaka) in [https://github.com/honojs/hono/pull/3138](https://togithub.com/honojs/hono/pull/3138) - fix:(csrf) fix typo of csrf middleware by [@yasuaki640](https://togithub.com/yasuaki640) in [https://github.com/honojs/hono/pull/3178](https://togithub.com/honojs/hono/pull/3178) - feat(secure-headers): remove "X-Powered-By" should be an option by [@EdamAme-x](https://togithub.com/EdamAme-x) in [https://github.com/honojs/hono/pull/3177](https://togithub.com/honojs/hono/pull/3177) **Full Changelog**: https://github.com/honojs/hono/compare/v4.5.1...v4.5.2 ### [`v4.5.1`](https://togithub.com/honojs/hono/releases/tag/v4.5.1) [Compare Source](https://togithub.com/honojs/hono/compare/v4.5.0...v4.5.1) #### What's Changed - chore: remove rimraf and use bun shell by [@nakasyou](https://togithub.com/nakasyou) in [https://github.com/honojs/hono/pull/3146](https://togithub.com/honojs/hono/pull/3146) - chore: moving the setup file of vitest by [@EdamAme-x](https://togithub.com/EdamAme-x) in [https://github.com/honojs/hono/pull/3157](https://togithub.com/honojs/hono/pull/3157) - fix(middleware/jwt): Changed the jwt-secret type to SignatureKey by [@JulesVerner](https://togithub.com/JulesVerner) in [https://github.com/honojs/hono/pull/3167](https://togithub.com/honojs/hono/pull/3167) - feat(bearer-auth): Allow empty bearer-auth middleware prefixes by [@prevostc](https://togithub.com/prevostc) in [https://github.com/honojs/hono/pull/3161](https://togithub.com/honojs/hono/pull/3161) - chore(factory): remove `@experimental` from `createApp` by [@yusukebe](https://togithub.com/yusukebe) in [https://github.com/honojs/hono/pull/3164](https://togithub.com/honojs/hono/pull/3164) - fix(client): support array values for `query` in `ws` by [@yusukebe](https://togithub.com/yusukebe) in [https://github.com/honojs/hono/pull/3169](https://togithub.com/honojs/hono/pull/3169) - fix(validator): ignore content-type mismatches by [@yusukebe](https://togithub.com/yusukebe) in [https://github.com/honojs/hono/pull/3165](https://togithub.com/honojs/hono/pull/3165) #### New Contributors - [@JulesVerner](https://togithub.com/JulesVerner) made their first contribution in [https://github.com/honojs/hono/pull/3167](https://togithub.com/honojs/hono/pull/3167) - [@prevostc](https://togithub.com/prevostc) made their first contribution in [https://github.com/honojs/hono/pull/3161](https://togithub.com/honojs/hono/pull/3161) **Full Changelog**: https://github.com/honojs/hono/compare/v4.5.0...v4.5.1 ### [`v4.5.0`](https://togithub.com/honojs/hono/compare/v4.4.13...v4.5.0) [Compare Source](https://togithub.com/honojs/hono/compare/v4.4.13...v4.5.0)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

beeequeue / arm-server