Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency @sveltejs/kit to v2.8.3 [security] #150

Merged
merged 1 commit into from
Nov 25, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Nov 25, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@sveltejs/kit (source) 2.5.4 -> 2.8.3 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-53262

Summary

The static error.html template for errors contains placeholders that are replaced without escaping the content first.

Details

From https://kit.svelte.dev/docs/errors:

error.html is the page that is rendered when everything else fails. It can contain the following placeholders:
%sveltekit.status% — the HTTP status
%sveltekit.error.message% — the error message

This leads to possible injection if an app explicitly creates an error with a message that contains user controlled content that ends up being something like this inside a server handle function:

error(500, '<script>alert("boom")</script>');

Uncaught errors cannot be exploited like this, as they always render the message "Internal error".

Escaping the message string in the function that creates the html output can be done to improve safety for applications that are using custom errors on the server.

PoC

None provided

Impact

Only applications where user provided input is used in the Error message will be vulnerable, so the vast majority of applications will not be vulnerable

CVE-2024-53261

Summary

"Unsanitized input from the request URL flows into end, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS)."

Details

Source of potentially tainted data is in packages/kit/src/exports/vite/dev/index.js, line 437. This potentially tainted data is passed through a number of steps (which I could detail if you'd like) all the way down to line 91 in packages/kit/src/exports/vite/utils.js, which performs an operation that Snyk believes an attacker shouldn't be allowed to manipulate.

Another source of potentially tainted data (according to Snyk) comes from ‎packages/kit/src/exports/vite/utils.js, line 30, col 30 (i.e., the url property of req). This potentially tainted data is passed through a number of steps (which I could detail if you'd like) all the way down line 91 in packages/kit/src/exports/vite/utils.js, which performs an operation that Snyk believes an attacker shouldn't be allowed to manipulate.

PoC

Not provided

Impact

Little to none. The Vite development is not exposed to the network by default. And even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data.


Release Notes

sveltejs/kit (@​sveltejs/kit)

v2.8.3

Compare Source

Patch Changes
  • fix: ensure error messages are escaped (#​13050)

  • fix: escape values included in dev 404 page (#​13039)

v2.8.2

Compare Source

Patch Changes
  • fix: prevent duplicate fetch request when using Request with load function's fetch (#​13023)

  • fix: do not override default cookie decoder to allow users to override the cookie library version (#​13037)

v2.8.1

Compare Source

Patch Changes
  • fix: only add nonce to script-src-elem, style-src-attr and style-src-elem CSP directives when unsafe-inline is not present (#​11613)

  • fix: support HTTP/2 in dev and production. Revert the changes from #​12907 to downgrade HTTP/2 to TLS as now being unnecessary (#​12989)

v2.8.0

Compare Source

Minor Changes
  • feat: add helper to identify ActionFailure objects (#​12878)

v2.7.7

Compare Source

Patch Changes

v2.7.6

Compare Source

Patch Changes
  • fix: update broken links in JSDoc (#​12960)

v2.7.5

Compare Source

Patch Changes
  • fix: warn on invalid cookie name characters (#​12806)

  • fix: when using @vitejs/plugin-basic-ssl, set a no-op proxy config to downgrade from HTTP/2 to TLS since undici does not yet enable HTTP/2 by default (#​12907)

v2.7.4

Compare Source

Patch Changes
  • fix: ensure element is focused after subsequent clicks of the same hash link (#​12866)

  • fix: avoid preload if event default was prevented for touchstart and mousedown events (#​12887)

  • fix: avoid reloading behaviour for hash links with data-sveltekit-reload if the hash is on the same page (#​12866)

v2.7.3

Compare Source

Patch Changes
  • fix: include importer in illegal import error message (#​12820)

  • fix: don't try reading assets directly that aren't present (#​12876)

  • fix: decode non-latin characters when previewing prerendered pages (#​12874)

  • fix: better error message when a Result is returned from a form action (#​12829)

  • docs: update URLs for new svelte.dev site (#​12857)

v2.7.2

Compare Source

Patch Changes
  • fix: use absolute links in JSDoc comments (#​12718)

v2.7.1

Compare Source

Patch Changes
  • chore: upgrade to sirv 3.0 (#​12796)

  • fix: warn when form action responses are lost because SSR is off (#​12063)

v2.7.0

Compare Source

Minor Changes
  • feat: update service worker when new version is detected (#​12448)
Patch Changes
  • fix: correctly handle relative paths when fetching assets on the server (#​12113)

  • fix: decode non ASCII anchor hashes when scrolling into view (#​12699)

  • fix: page response missing CSP and Link headers when return promise in load (#​12418)

v2.6.4

Compare Source

Patch Changes
  • fix: only preload links that have a different URL than the current page (#​12773)

  • fix: revert change to replace version in generateBundle (#​12779)

  • fix: catch stack trace fixing errors thrown in web containers (#​12775)

  • fix: use absolute links in JSDoc comments (#​12772)

v2.6.3

Compare Source

Patch Changes
  • fix: ensure a changing version doesn't affect the hashes for chunks without any actual code changes (#​12700)

  • fix: prevent crash when logging URL search params in a server load function (#​12763)

  • chore: revert update dependency cookie to ^0.7.0 (#​12767)

v2.6.2

Compare Source

Patch Changes
  • chore(deps): update dependency cookie to ^0.7.0 (#​12746)

v2.6.1

Compare Source

Patch Changes
  • fix: better error message when calling push/replaceState before router is initialized (#​11968)

v2.6.0

Compare Source

Minor Changes
  • feat: support typed arrays in load functions (#​12716)
Patch Changes
  • fix: open a new tab for <form target="_blank"> and ` submissions (#​11936)

v2.5.28

Compare Source

Patch Changes
  • fix: import node:process instead of using globals (#​12641)

v2.5.27

Compare Source

Patch Changes
  • fix: asynchronously instantiate components when using Svelte 5 (#​12613)

  • fix: use {@&#8203;render ...} tag when generating default fallback page for svelte 5 apps (#​12653)

  • fix: emulate event.platform even when the route does not exist (#​12513)

v2.5.26

Compare Source

Patch Changes
  • fix: exclude service worker directory from tsconfig (#​12196)

v2.5.25

Compare Source

Patch Changes

v2.5.24

Compare Source

Patch Changes

v2.5.23

Compare Source

Patch Changes
  • fix: use dynamic components in root.svelte instead of svelte:component for svelte 5 (#​12584)

v2.5.22

Compare Source

Patch Changes
  • chore: configure provenance in a simpler manner (#​12570)

v2.5.21

Compare Source

Patch Changes

v2.5.20

Compare Source

Patch Changes
  • fix: set revalidate cache header on 404'd static assets (#​12530)

v2.5.19

Compare Source

Patch Changes
  • fix: Svelte 5 - ignore binding_non_reactive warning in generated root component (you also need to update to [email protected]) (#​12524)

v2.5.18

Compare Source

Patch Changes
  • fix: respect HTML attributes enctype and formenctype for forms with use:enhance (#​12198)

  • fix: prevent client import error when a hooks.server file imports a private environment variable (#​12195)

  • fix: set default Content-Type header to application/x-www-form-urlencoded for POST form submissions with use:enhance to align with native form behaviour (#​12198)

v2.5.17

Compare Source

Patch Changes
  • chore: update package description (#​11846)

v2.5.16

Compare Source

Patch Changes
  • fix: determine local Svelte version more reliably (#​12350)

v2.5.15

Compare Source

Patch Changes

v2.5.14

Compare Source

Patch Changes
  • fix: read non-encoded data URIs (#​12347)

v2.5.13

Compare Source

Patch Changes
  • fix: decode asset URLs in dev when reading them, but for real this time (#​12344)

v2.5.12

Compare Source

Patch Changes
  • fix: decode asset URLs in dev when reading them (#​12341)

v2.5.11

Compare Source

Patch Changes
  • fix: hrefs that start with config.prerender.origin are now crawled (#​12277)

  • chore: add keywords for discovery in npm search (#​12330)

  • fix: handle whitespace in HTTP Accept header (#​12292)

v2.5.10

Compare Source

Patch Changes
  • fix: exclude server files from optimizeDeps.entries (#​12242)

  • fix: bump import-meta-resolve to remove deprecation warnings (#​12240)

v2.5.9

Compare Source

Patch Changes
  • fix: yield main thread before navigating (#​12225)

  • fix: correctly handle aliases to files in the .svelte-kit directory (#​12220)

v2.5.8

Compare Source

Patch Changes
  • fix: prevent excessive Vite dependency optimizations on navigation (#​12182)

v2.5.7

Compare Source

Patch Changes
  • chore(deps): update devalue to v5 ignore non-enumerable symbols during serialization (#​12141)

v2.5.6

Compare Source

Patch Changes
  • fix: avoid incorrectly un- and re-escaping cookies collected during a server-side fetch (#​11904)

v2.5.5

Compare Source

Patch Changes
  • fix: only hydrate when page is server-rendered (#​12050)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

netlify bot commented Nov 25, 2024

Deploy Preview for demo-watergis ready!

Name Link
🔨 Latest commit a540710
🔍 Latest deploy log https://app.netlify.com/sites/demo-watergis/deploys/6744b68c8e22a00008b95e7b
😎 Deploy Preview https://deploy-preview-150--demo-watergis.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@renovate renovate bot merged commit 70cb231 into main Nov 25, 2024
5 checks passed
@renovate renovate bot deleted the renovate/npm-sveltejs-kit-vulnerability branch November 25, 2024 18:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants