chore(deps): update dependency express to v4.20.0 [security] #137
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions bot
pushed a commit
that referenced
this pull request
Sep 22, 2024
[skip ci] ## [4.2.4](v4.2.3...v4.2.4) (2024-09-22) ### Chores * **deps:** update dependency express to v4.20.0 [security] ([#137](#137)) ([5ebd26e](5ebd26e))
|
🎉 This issue has been resolved in version 4.2.4 🎉 The release is available on: Your semantic-release bot 📦🚀 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.x->4.20.04.19.2->4.20.0GitHub Vulnerability Alerts
CVE-2024-43796
Impact
In express <4.20.0, passing untrusted user input - even after sanitizing it - to
response.redirect()may execute untrusted codePatches
this issue is patched in express 4.20.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
Release Notes
expressjs/express (express)
v4.20.0Compare Source
==========
depthoption to customize the depth level in the parserdepthlevel for parsing URL-encoded data is now32(previously wasInfinity)res.redirect\,|, and^to align better with URL specoptions.maxAgeandoptions.expirestores.clearCookiev4.19.2Compare Source
==========
v4.19.1Compare Source
==========
v4.19.0Compare Source
v4.18.3Compare Source
==========
v4.18.2Compare Source
===================
v4.18.1Compare Source
===================
v4.18.0Compare Source
===================
res.downloadoptionswithoutfilenameinres.downloadres.statusnull/undefinedasmaxAgeinres.cookieObject.prototypevalues in settings throughapp.set/app.getdefaultwith same arguments as types inres.formatres.sendhttp-errorsforres.formaterrorstrictpriorityoptionexpiresoption to reject invalid datesevalusage withFunctionconstructorprocessto check for listeners425 Unordered Collectionto standard425 Too Earlyv4.17.3Compare Source
===================
__proto__keysv4.17.2Compare Source
===================
undefinedinres.jsonpundefinedwhen"json escape"is enabledRegExpsres.jsonp(obj, status)deprecation messageres.isJSDocmaxAgeoption to reject invalid valuesreq.socketover deprecatedreq.connectionv4.17.1Compare Source
===================
null/undefinedtores.status"v4.17.0Compare Source
===================
express.rawto parse bodies intoBufferexpress.textto parse bodies into stringres.sendFilenull/undefinedtores.statusX-Forwarded-Hostpb) supportSameSite=NonesupportContent-Security-Policyheaderpath.normalizecall103 Early Hintsthrowon invalid typev4.16.4Compare Source
===================
"Request aborted"may be logged inres.sendfileRouterconstructorv4.16.3Compare Source
===================
%as last characterv4.16.2Compare Source
===================
TypeErrorinres.sendwhen givenBufferandETagheader setX-Forwarded-Protoheaderv4.16.1Compare Source
===================
rootis incorrectly set to a filev4.16.0Compare Source
===================
"json escape"setting forres.jsonandres.jsonpexpress.jsonandexpress.urlencodedto parse bodiesoptionsargument tores.downloadBufferencoding when not generating ETag for small responsesafe-bufferfor improved Buffer APIres.headersSentwhen availableRegExpX-Forwarded-ForX-Forwarded-Forheaderimmutableoption</html>in default error & redirectsimmutableoption.charsetset inres.jsonpv4.15.5Compare Source
===================
If-None-Matchtoken parsingIf-Matchtoken parsingv4.15.4Compare Source
===================
Bufferloadingv4.15.3Compare Source
===================
res.setcannot add charset toContent-TypeDEBUG_MAX_ARRAY_LENGTH</html>in HTML documentv4.15.2Compare Source
===================
[v4.15.1Compare Source
===================
Date.parsedoes not returnNaNon invalid dateDate.parsedoes not returnNaNon invalid datev4.15.0Compare Source
===================
next("router")to exit from routerrouter.useskipped requests routes did notres._headersprivate fieldreq.urlis not set%oin path debug to tell types apartObject.createto setup request & response prototypessetprototypeofmodule to replace__proto__settingstatusesinstead ofhttpmodule for status messagesDEBUG_FDenvironment variable set to3or highererrcannot be converted to a stringContent-Security-Policy: default-src 'self'headerno-cacherequest directiveIf-None-Matchhas both*and ETagsETagmatching to match specIf-None-Matchwhen noETagheaderDate.parseinstead ofnew Dateno-cacherequest directiveIf-None-Matchhas both*and ETagsETagmatching to match specres._headersprivate fieldIf-MatchandIf-Unmodified-Sinceheadersres.getHeaderNames()when availableres.headersSentwhen availableno-cacherequest directiveIf-None-Matchhas both*and ETagsETagmatching to match specres._headersprivate fieldIf-MatchandIf-Unmodified-Sinceheadersres.getHeaderNames()when availableres.headersSentwhen available*routereq.ipsperformancev4.14.1Compare Source
===================
err.headersis not an objectv4.14.0Compare Source
===================
acceptRangesoption tores.sendFile/res.sendfilecacheControloption tores.sendFile/res.sendfileoptionsargument toreq.rangecombineoptionres.location/res.redirectif not already encodedres.sendFile/res.sendfilereq.get()res.json/res.jsonpin most casesRangeheader handling inres.sendFile/res.sendfileAcceptparsingAcceptparameters with quoted equalsAcceptparameters with quoted semicolonssameSiteoptionMax-Ageto never be a floating point numberencodeis not a functionexpiresis not aDateserializeerr.statusCodeiferr.statusis invaliderr.headersobjectstatusesinstead ofhttpmodule for status messagesdecoderoption inparsefunctioncombineoption to combine overlapping rangesacceptRangesoptioncacheControloptionStreamclassContent-Rangeheader in 416 responses when usingstart/endoptionsContent-Rangeheader missing from default 416 responsespathcontains raw non-URL characterspathstarts with multiple forward slashesRangeheadersacceptRangesoptioncacheControloptionreq.urlcontains raw non-URL charactersRangeheadersfieldargumentv4.13.4Compare Source
===================
serializev4.13.3Compare Source
===================
mergeParams: truereq.paramsv4.13.2Compare Source
===================
v4.13.1Compare Source
===================
hasOwnPropertyv4.13.0Compare Source
===================
res.formaterror when onlydefaultprovidednext('route')inapp.paramwould incorrectly skip valuesdecodeURIComponentURIErrors are a 400*before params in routesres.cookieto callres.appendarray-flattenmodule for flattening arraysstatusCodeproperty onErrorobjectsunpipemodule for unpiping requestsETagmatching supportCONNECTrequestsUpgraderequestsDateresponse headerContent-Locationon 304 responsehttp-errorsfor standard emitted errorsstatusesinstead ofhttpmodule for status messagesfallthroughoptionnext()instead of 400app.rendertry blockViewhttp.STATUS_CODESv4.12.4Compare Source
===================
fsisFinished(req)when data bufferedconstructorv4.12.3Compare Source
===================
hasOwnPropertyis presentextensionsorindexoptionsv4.12.2Compare Source
===================
"Request aborted"is logged usingres.sendFilev4.12.1Compare Source
===================
ECONNRESETerrors fromres.sendFileusagereq.hostwhen using "trust proxy" hops countreq.protocol/req.securewhen using "trust proxy" hops countcodeon aborted connections fromres.sendFilev4.12.0Compare Source
===================
"trust proxy"setting to inherit when app is mountedETags for all request responsesGETandHEADrequestscontent-typeto parseContent-TypeheadersoptionshasBodyTransfer-Encodingcheck*/*)v4.11.2Compare Source
===================
res.redirectdouble-callingres.endforHEADrequestsv4.11.1Compare Source
===================
v4.11.0Compare Source
===================
res.append(field, val)to append headers:innameforapp.param(name, fn)req.param()-- usereq.params,req.body, orreq.queryinsteadapp.param(fn)OPTIONSresponses to include theHEADmethod properlyres.sendFilenot always detecting aborted connectionv4.10.8Compare Source
===================
OPTIONSresponse handlerv4.10.7Compare Source
===================
Allowheader forOPTIONSto not contain duplicate methodsres.sendFilewhenHEADor 304v4.10.6Compare Source
===================
req.fresh/req.stalewithout response headersv4.10.5Compare Source
===================
res.senddouble-callingres.endforHEADrequestsv4.10.4Compare Source
===================
res.sendfilelogging standard write errorsv4.10.3Compare Source
===================
res.sendFilelogging standard write errorsarrayLimitbehaviorv4.10.2Compare Source
===================
v4.10.1Compare Source
===================
://in the pathv4.10.0Compare Source
===================
app.set('views', array)res.send(status)to mentionres.sendStatus(status)content-dispositionmodule forres.attachment/res.downloadContent-Dispositionheaderpath.resolvein view lookupDEBUG_FDenv variable supporton-finishedto determine request statusv4.9.8Compare Source
==================
res.redirectbody when redirect status specifiedv4.9.7Compare Source
==================
v4.9.6Compare Source
==================
v4.9.5Compare Source
==================
forwardednpm modulev4.9.4Compare Source
==================
v4.9.3Compare Source
==================
v4.9.2Compare Source
==================
pathinapp.userouter.useto accept array of middleware without pathapp.useargumentsv4.9.1Compare Source
==================
app.useto accept array of middleware without pathv4.9.0Compare Source
==================
res.sendStatusres.sendFile,res.sendfile, andres.downloaderrwill be populated with request aborted errorreq.subdomainsetagto generateETagheadersmime-typesX-Content-Type-Options: nosniffheaderlastModifiedoptionetagto generateETagheaderlastModifiedoptionhasbodyto be true forcontent-length: 0Varyheader string asfieldv4.8.8Compare Source
==================
rootv4.8.7Compare Source
==================
v4.8.6Compare Source
==================
v4.8.5Compare Source
==================
v4.8.4Compare Source
==================
fdleak in Node.js 0.10 forfs.ReadStreamv4.8.3Compare Source
==================
req.originalUrlvaluesv4.8.2Compare Source
==================
v4.8.1Compare Source
==================
res.downloadv4.8.0Compare Source
==================
res.sendFilerootoption specifiedres.sendfile-- useres.sendFileinsteadapp.use()extensionsoptionextensionsoptionv4.7.4Compare Source
==================
res.sendfileregression for serving directory index filesv4.7.3Compare Source
==================
v4.7.2Compare Source
==================
v4.7.1Compare Source
==================
Error.stackTraceLimitis too lowv4.7.0Compare Source
==================
req.protocolfor proxy-direct connectionsapp.set('query parser', parser)app.set('query parser', 'extended')parse with "qs" moduleapp.set('query parser', 'simple')parse with "querystring" core moduleapp.set('query parser', false)disable query string parsingapp.set('query parser', true)enable simple parsingres.json(status, obj)-- useres.status(status).json(obj)insteadres.jsonp(status, obj)-- useres.status(status).jsonp(obj)insteadres.send(status, body)-- useres.status(status).send(body)insteadTRACE_DEPRECATIONenvironment variable--no-deprecationargument--trace-deprecationargumentRegExpdotfilesoptionmaxAgevalue to 1 yearBuffercreation inres.sendv4.6.1Compare Source
==================
subapp.mountpathregression forapp.use(subapp)v4.6.0Compare Source
==================
app.use()req.param(name, fn)handlersres.redirect(url, status)-- useres.redirect(status, url)insteadres.send(status, num)to sendnumas json (not error)res.jsonpreturns JSON responsepathinapp.use(path, fn)RegExptryblocksapp.use(fn)CONNECTresmethodsv4.5.1Compare Source
==================
req.methodv4.5.0Compare Source
==================
req.accepts*res.send(body, status)res.vary()headersoption tores.sendfilemergeParamsoption toRouterreq.paramsfrom parent routesreq.hostname-- correct name for whatreq.hostreturnsdepdmodulereq.host-- usereq.hostnameinsteadroute.allis only routerouter.param()only when route matchesreq.paramsafter invoking routerfinalhandlerfor final response handlingmedia-typerto alter content-type charsetmaxage(converted byms)maxAge(converted byms)setHeadersoptionv4.4.5Compare Source
==================
v4.4.4Compare Source
==================
res.attachmentUnicode filenames in Safariexpress:routerv4.4.3Compare Source
==================
req.params[name]fromapp.param()escape-htmlfor HTML escapingv4.4.2Compare Source
==================
Configuration
📅 Schedule: Branch creation - "" in timezone America/Toronto, Automerge - "before 4am on the first day of the month" in timezone America/Toronto.
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.