chore(deps): update dependency connect to v2 [security]

[sc-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
connect	=1.8.6 → =2.14.0

GitHub Vulnerability Alerts

CVE-2013-7370

Connect is a stack of middleware that is executed in order in each request.

The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".

Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot [method] [url]" content. The method was not properly encoded for output in the browser.

###Example:

~ curl "localhost:3000" -d "_method=<script src=http://nodesecurity.io/xss.js></script>"
Cannot <SCRIPT SRC=HTTP://NODESECURITY.IO/XSS.JS></SCRIPT> /

Recommendation

Update to the newest version of Connect or disable methodOverride. It is not possible to avoid the vulnerability if you have enabled this middleware in the top of your stack.

Severity

Low

CVE-2018-3717

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVE-2013-7371

node-connect before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)

Overview

Connect is a stack of middleware that is executed in order in each request.

The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".

Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot [method] [url]" content. The method was not properly encoded for output in the browser.

Example:

~ curl "localhost:3000" -d "_method=<script src=http://nodesecurity.io/xss.js></script>"
Cannot <SCRIPT SRC=HTTP://NODESECURITY.IO/XSS.JS></SCRIPT> /

Recommendation

Update to the newest version of Connect or disable methodOverride. It is not possible to avoid the vulnerability if you have enabled this middleware in the top of your stack.

Credit:

Sergio Arcos

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

---

Release Notes

senchalabs/connect (connect)

v2.14.0

Compare Source

===================

• basicAuth: use basic-auth-connect
• cookieParser: use cookie-parser
• compress: use compression
• csrf: use csurf
• dep: cookie-signature@​1.0.3
• directory: use serve-index
• errorHandler: use errorhandler
• favicon: use static-favicon
• logger: use morgan
• methodOverride: use method-override
• responseTime: use response-time
• session: use express-session
• static: use serve-static
• timeout: use connect-timeout
• vhost: use vhost

v2.13.1

Compare Source

===================

• cookieSession: compare full value rather than crc32
• deps: raw-body@​1.1.3

v2.13.0

Compare Source

===================

• fix typo in memory store warning #​974 @​rvagg
• compress: use compressible
• directory: add template option #​990 @​gottaloveit @​Earl-Brown
• csrf: prevent deprecated warning with old sessions

v2.12.0

Compare Source

===================

• bump qs
• directory: sort folders before files
• directory: add folder icons
• directory: de-duplicate icons, details/mobile views #​968 @​simov
• errorHandler: end default 404 handler with a newline #​972 @​rlidwka
• session: remove long cookie expire check #​870 @​undoZen

v2.11.2

Compare Source

===================

• bump raw-body

v2.11.1

Compare Source

===================

• bump raw-body
• errorHandler: use res.setHeader() instead of res.writeHead() #​949 @​lo1tuma

v2.11.0

Compare Source

===================

• update bytes
• update uid2
• update negotiator
• sessions: add rolling session option #​944 @​ilmeo
• sessions: property set cookies when given FQDN
• cookieSessions: properly set cookies when given FQDN #​948 @​bmancini55
• proto: fix FQDN mounting when multiple handlers #​945 @​bmancini55

v2.10.1

Compare Source

===================

• fixed; fixed a bug with static middleware at root and trailing slashes #​942 (@​dougwilson)

v2.10.0

Compare Source

===================

• fixed: set headers written by writeHead before emitting 'header'
• fixed: mounted path should ignore querystrings on FQDNs #​940 (@​dougwilson)
• fixed: parsing protocol-relative URLs with @​ as pathnames #​938 (@​dougwilson)
• fixed: fix static directory redirect for mount's root #​937 (@​dougwilson)
• fixed: setting set-cookie header when mixing arrays and strings #​893 (@​anuj123)
• bodyParser: optional verify function for urlencoded and json parsers for signing request bodies
• compress: compress checks content-length to check threshold
• compress: expose res.flush() for flushing responses
• cookieParser: pass options into node-cookie #​803 (@​cauldrath)
• errorHandler: replace \ns with <br/>s in error handler

v2.9.2

Compare Source

==================

• warn about multiparty and limit middleware deprecation for v3
• fix fully qualified domain name mounting. #​920 (@​dougwilson)
• directory: Fix potential security issue with serving files outside the root. #​929 (@​dougwilson)
• logger: store IP at beginning in case socket prematurely closes #​930 (@​dougwilson)

v2.9.1

Compare Source

==================

• update multiparty
• compress: Set vary header only if Content-Type passes filter #​904
• directory: Fix directory middleware URI escaping #​917 (@​dougwilson)
• directory: Fix directory seperators for Windows #​914 (@​dougwilson)
• directory: Keep query string intact during directory redirect #​913 (@​dougwilson)
• directory: Fix paths in links #​730 (@​JacksonTian)
• errorHandler: Don't escape text/plain as HTML #​875 (@​johan)
• logger: Write '0' instead of '-' when response time is zero #​910 (@​dougwilson)
• logger: Log even when connections are aborted #​760 (@​dylanahsmith)
• methodOverride: Check req.body is an object #​907 (@​kbjr)
• multipart: Add .type back to file parts for backwards compatibility #​912 (@​dougwilson)
• multipart: Allow passing options to the Multiparty constructor #​902 (@​niftylettuce)

v2.9.0

Compare Source

==================

• multipart: add docs regarding tmpfiles
• multipart: add .name back to file parts
• multipart: use multiparty instead of formidable

v2.8.8

Compare Source

==================

• csrf: change to math.random() salt and remove csrfToken() callback

v2.8.7

==================

• csrf: prevent salt generation on every request, and add async req.csrfToken(fn)

v2.8.6

==================

• csrf: refactor to use HMAC tokens (BREACH attack)
• compress: add compression of SVG and common font files by default.

v2.8.5

Compare Source

==================

• add: compress Dart source files by default
• update fresh

v2.8.4

Compare Source

==================

• update send

v2.8.3

Compare Source

==================

• add a name back to static middleware ("staticMiddleware")
• fix .hasBody() utility to require transfer-encoding or content-length

v2.8.2

Compare Source

==================

• update send
• update cookie dep.
• add better debug() for middleware
• add whitelisting of supported methods to methodOverride()

v2.8.1

Compare Source

==================

• fix: escape req.method in 404 response

v2.8.0

Compare Source

==================

• add threshold option to compress() to prevent compression of small responses
• add support for vendor JSON mime types in json()
• add X-Forwarded-Proto initial https proxy support
• change static redirect to 303
• change octal escape sequences for strict mode
• change: replace utils.uid() with uid2 lib
• remove other "static" function name. Fixes #​794
• fix: hasBody() should return false if Content-Length: 0

v2.7.11

Compare Source

==================

• update send

v2.7.10

Compare Source

==================

• update qs
• update formidable
• fix: write/end to noop() when request aborted

v2.7.9

Compare Source

==================

• update qs
• drop support for node < v0.8

v2.7.8

Compare Source

==================

• update qs

v2.7.7

Compare Source

==================

• update qs dependency
• remove "static" function name. Closes #​794
• update node-formidable
• update buffer-crc32

v2.7.6

Compare Source

==================

• revert cookie signature which was creating session race conditions

v2.7.5

Compare Source

==================

• update cookie-signature
• limit: do not consume request in node 0.10.x

v2.7.4

Compare Source

==================

• session: add long expires check and prevent excess set-cookie
• session: add console.error() of session#save() errors

v2.7.3

Compare Source

==================

• add name to compress middleware
• add appending Accept-Encoding to Vary when set but missing
• add tests for csrf middleware
• add 'next' support for connect() server handler
• change utils.uid() to return url-safe chars. Closes #​753
• fix treating '.' as a regexp in vhost()
• fix duplicate bytes dep in package.json. Closes #​743
• fix #​733 - parse x-forwarded-proto in a more generally compatibly way
• revert "add support for next(status[, msg])"; makes composition hard

v2.7.2

Compare Source

==================

• add support for next(status[, msg]) back
• add utf-8 meta tag to support foreign characters in filenames/directories
• change timeout() 408 to 503
• replace 'node-crc' with 'buffer-crc32', fixes licensing
• fix directory.html IE support

v2.7.1

Compare Source

==================

• update send

v2.7.0

Compare Source

==================

• add support for leading JSON whitespace
• add logging of req.ip when present
• add basicAuth support for :-delimited string
• update cookie module. Closes #​688

v2.6.2

==================

• add debug() for disconnected session store
• fix session regeneration bug. Closes #​681

v2.6.1

==================

• add passing of connect.timeout() errors to next()
• replace signature utils with cookie-signature module

v2.6.0

==================

• add defer option to multipart() [Blake Miner]
• fix mount path case sensitivity. Closes #​663
• fix default of ascii encoding from logger(), now utf8. Closes #​293

v2.5.0

==================

• add err.status = 400 to multipart() errors
• add double-encoding protection to compress(). Closes #​659
• add graceful handling cookie parsing errors [shtylman]
• fix typo X-Response-time to X-Response-Time

v2.4.6

==================

• update qs

v2.4.5

Compare Source

==================

• add session store "connect" / "disconnect" support [louischatriot]
• fix :url log token

v2.4.4

Compare Source

==================

• fix static() pause regression from "send" integration

v2.4.3

Compare Source

==================

• fix .write() encoding for zlib inconstancy. Closes #​561

v2.4.2

Compare Source

==================

• remove limit default from urlencoded()
• remove limit default from json()
• remove limit default from multipart()
• fix cookieSession() clear cookie path / domain bug. Closes #​636

v2.4.1

Compare Source

==================

• fix options mutation in static()

v2.4.0

Compare Source

==================

• add connect.timeout()
• add GET / HEAD check to directory(). Closes #​634
• add "pause" util dep
• update send dep for normalization bug

v2.3.9

Compare Source

==================

• add more descriptive invalid json error message
• update send dep for root normalization regression
• fix staticCache fresh dep

v2.3.8

Compare Source

==================

• fix connect.static() 404 regression, pass next(). Closes #​629

v2.3.7

Compare Source

==================

• add json() utf-8 illustration test. Closes #​621
• add "send" dependency
• change connect.static() internals to use "send"
• fix session() req.session generation with pathname mismatch
• fix cookieSession() req.session generation with pathname mismatch
• fix mime export. Closes #​618

v2.3.6

Compare Source

==================

• Fixed cookieSession() with cookieParser() secret regression. Closes #​602
• Fixed set-cookie header fields on cookie.path mismatch. Closes #​615

v2.3.5

Compare Source

==================

• Remove logger() mount check
• Fixed staticCache() dont cache responses with set-cookie. Closes #​607
• Fixed staticCache() when Cookie is present

v2.3.4

Compare Source

==================

• Added err.buf to urlencoded() and json()
• Update cookie to 0.0.4. Closes #​604
• Fixed: only send 304 if original response in 2xx or 304 [timkuijsten]

v2.3.3

Compare Source

==================

• Added ETags back to static() [timkuijsten]
• Replaced utils.parseRange() with range-parser module
• Replaced utils.parseBytes() with bytes module
• Replaced utils.modified() with fresh module
• Fixed cookieSession() regression with invalid cookie signing [shtylman]

v2.3.2

Compare Source

==================

• expose mime module
• Update crc dep (which bundled nodeunit)

v2.3.1

Compare Source

==================

• Added secret option to cookieSession middleware [shtylman]
• Added secret option to session middleware [shtylman]
• Added req.remoteUser back to basicAuth() as alias of req.user
• Performance: improve signed cookie parsing
• Update cookie dependency [shtylman]

v2.3.0

Compare Source

==================

• Added limit option to json()
• Added limit option to urlencoded()
• Added limit option to multipart()
• Fixed: remove socket error event listener on callback
• Fixed ENOTDIR error on static middleware

v2.2.2

Compare Source

==================

• Added support to csrf middle for pre-flight CORS requests
• Updated engines to allow newer version of node
• Removed duplicate repo prop. Closes #​560

v2.2.1

Compare Source

==================

• Fixed static() redirect when mounted. Closes #​554

v2.2.0

Compare Source

==================

• Added make benchmark
• Perf: memoize url parsing (~20% increase)
• Fixed connect(fn, fn2, ...). Closes #​549

v2.1.3

Compare Source

==================

• Added optional json() reviver function to be passed to JSON.parse [jed]
• Fixed: emit drain in compress middleware [nsabovic]

v2.1.2

Compare Source

==================

• Fixed cookieParser() req.cookies regression

v2.1.1

Compare Source

==================

• Fixed session() browser-session length cookies & examples
• Fixed: make query() "self-aware" [jed]

v2.1.0

Compare Source

==================

• Added debug() calls to .use() (DEBUG=connect:displatcher)
• Added urlencoded() support for GET
• Added json() support for GET. Closes #​497
• Added strict option to json()
• Changed: session() only set-cookie when modified
• Removed Session#lastAccess property. Closes #​399

v2.0.3

Compare Source

==================

• Added: cookieSession() only sets cookie on change. Closes #​442
• Added connect:dispatcher debug() probes

v2.0.2

Compare Source

==================

• Added test for ENAMETOOLONG now that node is fixed
• Fixed static() index "/" check on windows. Closes #​498
• Fixed Content-Range behaviour to match RFC2616 [matthiasdg / visionmedia]

v2.0.1

Compare Source

==================

• Added test coverage for vhost() middleware
• Changed cookieParser() signed cookie support to use SHA-2 [senotrusov]
• Fixed static() Range: respond with 416 when unsatisfiable
• Fixed vhost() middleware. Closes #​494

v2.0.0

Compare Source

==================

• Added cookieSession() middleware for cookie-only sessions
• Added compress() middleware for gzip / deflate support
• Added session() "proxy" setting to trust X-Forwarded-Proto
• Added json() middleware to parse "application/json"
• Added urlencoded() middleware to parse "application/x-www-form-urlencoded"
• Added multipart() middleware to parse "multipart/form-data"
• Added cookieParser(secret) support so anything using this middleware may access signed cookies
• Added signed cookie support to cookieParser()
• Added support for JSON-serialized cookies to cookieParser()
• Added err.status support in Connect's default end-point
• Added X-Cache MISS / HIT to staticCache()
• Added public res.headerSent checking nodes res._headerSent until node does
• Changed basicAuth() req.remoteUser to req.user
• Changed: default session() to a browser-session cookie. Closes #​475
• Changed: no longer lowercase cookie names
• Changed bodyParser() to use json(), urlencoded(), and multipart()
• Changed: errorHandler() is now a development-only middleware
• Changed middleware to next() errors when possible so applications can unify logging / handling
• Removed http[s].Server inheritance, now just a function, making it easy to have an app providing both http and https
• Removed .createServer() (use connect())
• Removed secret option from session(), use cookieParser(secret)
• Removed connect.session.ignore array support
• Removed router() middleware. Closes #​262
• Fixed: set-cookie only once for browser-session cookies
• Fixed FQDN support. dont add leading "/"
• Fixed 404 XSS attack vector. Closes #​473
• Fixed HEAD support for 404s and 500s generated by Connect's end-point

v1.9.2

Compare Source

v1.9.1

Compare Source

v1.9.0

Compare Source

v1.8.7

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.