chore(deps): update dependency cookiejar to 2.1.4 [security] - autoclosed

travi-org / admin.travi.org

reference client to api.travi.org

MIT License

3 stars 0 forks source link

This PR contains the following updates:

Package	Change
cookiejar	`2.1.2` -> `2.1.4`

GitHub Vulnerability Alerts

CVE-2022-25901

Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function and other aspects of the API, which use an insecure regular expression for parsing cookie values. Applications could be stalled for extended periods of time if untrusted input is passed to cookie values or attempted to parse from request headers.

Proof of concept:

ts\nconst { CookieJar } = require("cookiejar");

const jar = new CookieJar();

const start = performance.now();

const attack = "a" + "t".repeat(50_000);
jar.setCookie(attack);

console.log(`CookieJar.setCookie(): ${performance.now() - start}ms`);

CookieJar.setCookie(): 2963.214399999939ms

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

Codecov Report

Patch coverage has no change and project coverage change: -1.03 :warning:

Comparison is base (306b3d1) 48.73% compared to head (316ebb9) 47.71%.

:exclamation: Current head 316ebb9 differs from pull request most recent head d39bd01. Consider uploading reports for the commit d39bd01 to get more accurate results

Additional details and impacted files

```diff @@ Coverage Diff @@ ## master #3403 +/- ## ========================================== - Coverage 48.73% 47.71% -1.03% ========================================== Files 18 17 -1 Lines 158 153 -5 ========================================== - Hits 77 73 -4 + Misses 81 80 -1 ``` [see 1 file with indirect coverage changes](https://codecov.io/gh/travi-org/admin.travi.org/pull/3403/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=travi-org) Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=travi-org). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=travi-org)

travi-org / admin.travi.org