search

tubone24 / blog

tubone's Blog made by Gatsby.js and Netlify
https://blog.tubone-project24.xyz/
Other
6 stars 2 forks source link

Update dependency gatsby to v4.25.7 [SECURITY] #1342

Closed renovate[bot] closed 1 year ago

renovate[bot] commented 1 year ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
gatsby (source, changelog) 4.25.1 -> 4.25.7 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-34238

Impact

The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the __file-code-frame and __original-stack-frame paths, exposed when running the Gatsby develop server (gatsby develop).

The following steps can be used to reproduce the vulnerability:


# Create a new Gatsby project
$ npm init gatsby
$ cd my-gatsby-site

# Start the Gatsby develop server
$ gatsby develop

# Execute the Local File Inclusion vulnerability in __file-code-frame
$ curl "http://127.0.0.1:8000/__file-code-frame?filePath=/etc/passwd&lineNumber=1"

# Execute the Local File Inclusion vulnerability in __original-stack-frame
$ curl "http://127.0.0.1:8000/__original-stack-frame?moduleId=/etc/hosts&lineNumber=1&skipSourceMap=1"

It should be noted that by default gatsby develop is only accessible via the localhost 127.0.0.1, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as --host 0.0.0.0, -H 0.0.0.0, or the GATSBY_HOST=0.0.0.0 environment variable.

Patches

A patch has been introduced in gatsby@5.9.1 and gatsby@4.25.7 which mitigates the issue.

Workarounds

As stated above, by default gatsby develop is only exposed to the localhost 127.0.0.1. For those using the develop server in the default configuration no risk is posed. If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.

We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

Credits

We would like to thank Maxwell Garrett of Assetnote for bringing the __file-code-frame issue to our attention.

For more information

Email us at security@gatsbyjs.com.

Release Notes

gatsbyjs/gatsby ### [`v4.25.7`](https://togithub.com/gatsbyjs/gatsby/compare/8889bfe5271985d19c956dff7f567be86ef2f3df...db5eb186008c62acb78cf66ae50fd7e1f0d67626) [Compare Source](https://togithub.com/gatsbyjs/gatsby/compare/8889bfe5271985d19c956dff7f567be86ef2f3df...db5eb186008c62acb78cf66ae50fd7e1f0d67626) ### [`v4.25.6`](https://togithub.com/gatsbyjs/gatsby/compare/3be4a80635ee905e0e1cfcbfdfc7c6b5bcb1af8b...8889bfe5271985d19c956dff7f567be86ef2f3df) [Compare Source](https://togithub.com/gatsbyjs/gatsby/compare/3be4a80635ee905e0e1cfcbfdfc7c6b5bcb1af8b...8889bfe5271985d19c956dff7f567be86ef2f3df) ### [`v4.25.5`](https://togithub.com/gatsbyjs/gatsby/compare/15ab3f895e28ce57d8b1540f602e6c5db1d96009...3be4a80635ee905e0e1cfcbfdfc7c6b5bcb1af8b) [Compare Source](https://togithub.com/gatsbyjs/gatsby/compare/15ab3f895e28ce57d8b1540f602e6c5db1d96009...3be4a80635ee905e0e1cfcbfdfc7c6b5bcb1af8b) ### [`v4.25.4`](https://togithub.com/gatsbyjs/gatsby/compare/d88ed09b2a6d1b23607d153fa704c8f3bc2dbf06...15ab3f895e28ce57d8b1540f602e6c5db1d96009) [Compare Source](https://togithub.com/gatsbyjs/gatsby/compare/d88ed09b2a6d1b23607d153fa704c8f3bc2dbf06...15ab3f895e28ce57d8b1540f602e6c5db1d96009) ### [`v4.25.3`](https://togithub.com/gatsbyjs/gatsby/compare/13bf518f95eed9373da0ae93a13ce774a4a3fc17...d88ed09b2a6d1b23607d153fa704c8f3bc2dbf06) [Compare Source](https://togithub.com/gatsbyjs/gatsby/compare/13bf518f95eed9373da0ae93a13ce774a4a3fc17...d88ed09b2a6d1b23607d153fa704c8f3bc2dbf06) ### [`v4.25.2`](https://togithub.com/gatsbyjs/gatsby/compare/4dcca80d273558368785612ad07f2a8dc9e3bb99...13bf518f95eed9373da0ae93a13ce774a4a3fc17) [Compare Source](https://togithub.com/gatsbyjs/gatsby/compare/4dcca80d273558368785612ad07f2a8dc9e3bb99...13bf518f95eed9373da0ae93a13ce774a4a3fc17)

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.

github-actions[bot] commented 1 year ago

depcheck Result

List up libraries that are defined in dependencies and devDependencies in package.json but not used in your codes.

Unused dependencies - @popperjs/core - @sentry/react - @typescript-eslint/eslint-plugin - babel-loader - babel-polyfill - classnames - flexboxgrid - gatsby-legacy-polyfills - gatsby-plugin-flexsearch - gatsby-plugin-twitter - gatsby-react-router-scroll - html-minifier - intersection-observer - md5 - preact - preact-render-to-string - react-body-classname - react-dom - rimraf - sass - typescript
Unused devdependencies - @babel/core - @babel/preset-typescript - @storybook/addon-a11y - @storybook/addon-controls - @storybook/addon-essentials - @storybook/addon-info - @storybook/addon-interactions - @storybook/addon-knobs - @storybook/addon-links - @storybook/addon-storysource - @storybook/addon-viewport - @storybook/builder-webpack5 - @storybook/manager-webpack5 - @textlint-rule/textlint-rule-no-duplicate-abbr - @types/jest - @types/react-test-renderer - @types/responselike - axe-core - @babel/eslint-parser - babel-plugin-transform-runtime - core-js - cross-env - css-loader - eslint - eslint-config-airbnb - eslint-import-resolver-webpack - eslint-plugin-import - eslint-plugin-jsx-a11y - eslint-plugin-react - gh-pages - husky - identity-obj-proxy - jest - jest-environment-jsdom - markdownlint-cli2 - memlab - netlify-cli - netlify-lambda - nyc - prettier - react-test-renderer - sass-loader - start-server-and-test - stylelint - stylelint-config-recess-order - stylelint-config-recommended-scss - stylelint-config-standard - stylelint-scss - textlint - textlint-filter-rule-allowlist - textlint-filter-rule-comments - textlint-rule-aws-spellcheck - textlint-rule-ja-no-inappropriate-words - textlint-rule-no-hoso-kinshi-yogo - textlint-rule-no-mixed-zenkaku-and-hankaku-alphabet - textlint-rule-no-start-duplicated-conjunction - textlint-rule-preset-smarthr - textlint-rule-prh - textlint-rule-terminology - ts-jest - yaml-lint
Missing - colors - /github/workspace/src/styles/_hover.scss - @algolia/transporter - /github/workspace/src/components/SearchBox/index.tsx - @algolia/client-search - /github/workspace/src/components/SearchBox/index.tsx - qs - /github/workspace/scripts/benchmark.js - https - /github/workspace/scripts/uploadScreenShot.ts
coveralls commented 1 year ago

Pull Request Test Coverage Report for Build 5226927317

Totals Coverage Status
Change from base Build 5002246871: 0.0%
Covered Lines: 250
Relevant Lines: 280
💛 - Coveralls
github-actions[bot] commented 1 year ago

Memlab leaks report

``` page-load [7.7MB] (baseline) [s1] > action-on-page [9.2MB] (target) [s2] > revert [9.4MB] (final) [s3] ------3 clusters------ --Similar leaks in this run: 976-- --Retained size of leaked objects: 156.2KB-- [] (synthetic) @1 [10.3MB] --6 (shortcut)---> [Window / https://blog.tubone-project24.xyz] (object) @9845 [58.9KB] --setTimeout (property)---> [] (closure) @47735 [72 bytes] --context (internal)---> [] (object) @47745 [20 bytes] --previous (internal)---> [] (object) @44211 [44KB] --n (variable)---> [t] (closure) @44691 [1.2KB] --context (internal)---> [] (object) @67103 [54.5KB] --n (variable)---> [Object] (object) @189229 [54.5KB] --449 (element)---> [Object] (object) @84677 [24 bytes] --exports (property)---> [r] (closure) @84683 [2.6KB] --hasData (property)---> [] (closure) @92731 [68 bytes] --context (internal)---> [] (object) @86057 [1.3KB] --e (variable)---> [Object] (object) @86059 [1KB] --1 (element)---> [Object] (object) @128905 [76 bytes] --aaAutocomplete (property)---> [f] (object) @309091 [348 bytes] --$node (property)---> [q] (object) @308723 [188 bytes] --0 (element)---> [Detached HTMLSpanElement] (native) @42409 [816 bytes] --7 (element)---> [Detached HTMLDivElement] (native) @41941 [304 bytes] --8 (element)---> [Detached HTMLDivElement] (native) @41943 [400 bytes] --6 (element)---> [Detached HTMLHRElement] (native) @41849 [304 bytes] --6 (element)---> [Detached HTMLDivElement] (native) @41851 [400 bytes] --8 (element)---> [Detached HTMLHRElement] (native) @41853 [304 bytes] --6 (element)---> [Detached HTMLDivElement] (native) @41855 [496 bytes] --6 (element)---> [Detached HTMLAnchorElement] (native) @42813 [1.7KB] --11 (element)---> [Detached HTMLAnchorElement] (native) @42815 [1.7KB] --11 (element)---> [Detached HTMLAnchorElement] (native) @42817 [1.7KB] --8 (element)---> [Detached Text] (native) @42725 [176 bytes] --6 (element)---> [Detached InternalNode] (native) @326208480 [32 bytes] --1 (element)---> [Detached InternalNode] (native) @326416608 [32 bytes] --1 (element)---> [Detached NodeList] (native) @365732608 [32 bytes] --Similar leaks in this run: 258-- --Retained size of leaked objects: 54.3KB-- [] (synthetic) @1 [10.3MB] --6 (shortcut)---> [Window / https://blog.tubone-project24.xyz] (object) @9845 [58.9KB] --___navigate (property)---> [] (closure) @149721 [68 bytes] --context (internal)---> [] (object) @66201 [496 bytes] --a (variable)---> [Module] (object) @60209 [5.8KB] --get version (property)---> [version] (closure) @66091 [68 bytes] --context (internal)---> [] (object) @59511 [16.4KB] --Qn (variable)---> [y] (object) @456205 [368 bytes] --props (property)---> [Object] (object) @496569 [28 bytes] --children (property)---> [Object] (object) @496555 [296 bytes] --props (property)---> [Object] (object) @496557 [56 bytes] --children (property)---> [Object] (object) @496567 [1.2KB] --__ (property)---> [Object] (object) @504177 [1.1KB] --__ (property)---> [Object] (object) @504181 [940 bytes] --__ (property)---> [Object] (object) @497585 [736 bytes] --__d (property)---> [Detached HTMLDivElement] (native) @345753 [504 bytes] --5 (element)---> [Detached HTMLDivElement] (native) @345751 [428 bytes] --5 (element)---> [Detached HTMLDivElement] (native) @345749 [428 bytes] --6 (element)---> [Detached HTMLDivElement] (native) @345331 [14.6KB] --6 (element)---> [Detached HTMLAnchorElement] (native) @345299 [2.1KB] --12 (element)---> [Detached InternalNode] (native) @326041152 [556 bytes] --3 (element)---> [Detached InternalNode] (native) @134174272 [384 bytes] --1 (element)---> [Detached InternalNode] (native) @365986752 [384 bytes] --4 (element)---> [Detached Attr] (native) @365730528 [96 bytes] --Similar leaks in this run: 4-- --Retained size of leaked objects: 248 bytes-- [] (synthetic) @1 [10.3MB] --6 (shortcut)---> [Window / https://blog.tubone-project24.xyz] (object) @9845 [58.9KB] --__twttrll (property)---> [Array] (object) @51663 [184 bytes] --push (property)---> [e] (closure) @51665 [68 bytes] --context (internal)---> [] (object) @51649 [240 bytes] --n (variable)---> [Object] (object) @51653 [13.2KB] --151 (element)---> [Object] (object) @194281 [1KB] --exports (property)---> [] (closure) @194857 [984 bytes] --context (internal)---> [] (object) @45201 [916 bytes] --d (variable)---> [Detached HTMLAnchorElement] (native) @43307 [228 bytes] --3 (element)---> [Detached DOMTokenList] (native) @366147264 [56 bytes] ```
github-actions[bot] commented 1 year ago

Storybook Preview

Deploy path: /home/runner/work/blog/blog/storybook-static Functions path: /home/runner/work/blog/blog/functions/src Configuration path: /home/runner/work/blog/blog/netlify.toml Deploying to draft URL...

Logs: https://app.netlify.com/sites/blog-storybook/deploys/6483bb7309e5ab00c4779419 Website Draft URL: https://6483bb7309e5ab00c4779419--blog-storybook.netlify.app

If everything looks good on your draft URL, deploy it to your main site URL with the --prod flag. netlify deploy --prod

github-actions[bot] commented 1 year ago

Deploy Preview

Deploy path: /home/runner/work/blog/blog/public Functions path: /home/runner/work/blog/blog/functions/src Configuration path: /home/runner/work/blog/blog/netlify.toml Deploying to draft URL...

Logs: https://app.netlify.com/sites/pensive-lamport-5822d2/deploys/6483bb5742bbea007c3c9b0b Website Draft URL: https://6483bb5742bbea007c3c9b0b--pensive-lamport-5822d2.netlify.app

If everything looks good on your draft URL, deploy it to your main site URL with the --prod flag. netlify deploy --prod

github-actions[bot] commented 1 year ago

Bundle Analyzer URL

https://6483bb5742bbea007c3c9b0b--pensive-lamport-5822d2.netlify.app/webpack-bundle-analyser

github-actions[bot] commented 1 year ago

Lighthouse Score

Desktop

performance: 97 accessibility: 100 best-practices: 92 seo: 92 pwa: 100

Mobile

performance: 66 accessibility: 100 best-practices: 83 seo: 93 pwa: 100