Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency hono to v4 [security] #53

Merged
merged 1 commit into from
Sep 6, 2024
Merged

fix(deps): update dependency hono to v4 [security] #53

merged 1 commit into from
Sep 6, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Sep 3, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
hono (source) ^3.11.7 -> ^4.0.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-32869

Summary

When using serveStatic with deno, it is possible to directory traverse where main.ts is located.

My environment is configured as per this tutorial
https://hono.dev/getting-started/deno

PoC

$ tree
.
├── deno.json
├── deno.lock
├── main.ts
├── README.md
└── static
    └── a.txt

source

import { Hono } from 'https://deno.land/x/[email protected]/mod.ts'
import { serveStatic } from 'https://deno.land/x/[email protected]/middleware.ts'

const app = new Hono()
app.use('/static/*', serveStatic({ root: './' }))

Deno.serve(app.fetch)

request

curl localhost:8000/static/%2e%2e/main.ts

response is content of main.ts

Impact

Unexpected files are retrieved.

CVE-2024-43787

Summary

Hono CSRF middleware can be bypassed using crafted Content-Type header.

Details

MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case.

https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.ts#L16-L17

As a result, attacker can bypass csrf middleware using upper-case form-like MIME type, such as "Application/x-www-form-urlencoded".

PoC

<html>
  <head>
    <title>CSRF Test</title>
    <script defer>
      document.addEventListener("DOMContentLoaded", () => {
        document.getElementById("btn").addEventListener("click", async () => {
          const res = await fetch("http://victim.example.com/test", {
            method: "POST",
            credentials: "include",
            headers: {
              "Content-Type": "Application/x-www-form-urlencoded",
            },
          });
        });
      });
    </script>
  </head>
  <body>
    <h1>CSRF Test</h1>
    <button id="btn">Click me!</button>
  </body>
</html>

Impact

Bypass csrf protection implemented with hono csrf middleware.

Discussion

I'm not sure that omitting csrf checks for Simple POST request is a good idea.
CSRF prevention and CORS are different concepts even though CORS can prevent CSRF in some cases.

Release Notes

honojs/hono (hono)

v4.5.8

Compare Source

Security Fix for CSRF Protection Middleware

Before this release, in versions 4.5.7 and below, the CSRF Protection Middleware did not treat requests including Content-Types with uppercase letters (e.g., Application/x-www-form-urlencoded) as potential attacks, allowing them to pass.

This could cause unexpected behavior, leading to a vulnerability. If you are using the CSRF Protection Middleware, please upgrade to version 4.5.8 or higher immediately.

For more details, see the report here: GHSA-rpfr-3m35-5vx5

v4.5.7

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.5.6...v4.5.7

v4.5.6

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.5.5...v4.5.6

v4.5.5

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.5.4...v4.5.5

v4.5.4

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.5.3...v4.5.4

v4.5.3

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.5.2...v4.5.3

v4.5.2

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.5.1...v4.5.2

v4.5.1

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.5.0...v4.5.1

v4.5.0

Compare Source

v4.4.13

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.4.12...v4.4.13

v4.4.12

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.11...v4.4.12

v4.4.11

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.10...v4.4.11

v4.4.10

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.9...v4.4.10

v4.4.9

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.4.8...v4.4.9

v4.4.8

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.4.7...v4.4.8

v4.4.7

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.6...v4.4.7

v4.4.6

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.4.5...v4.4.6

v4.4.5

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.4.4...v4.4.5

v4.4.4

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.3...v4.4.4

v4.4.3

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.2...v4.4.3

v4.4.2

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.4.1...v4.4.2

v4.4.1

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.0...v4.4.1

v4.4.0

Compare Source

Hono v4.4.0 is now available! Let's take a look at the new features.

Support JSR

Now, Hono is available on JSR - a new JavaScript/TypeScript registry! You can install the Hono package from JSR right now. If you want to run your Hono app on Deno, you can install it with the following command:

deno add @&#8203;hono/hono

Then, use it in your code!

// main.ts
import { Hono } from '@&#8203;hono/hono'

const app = new Hono()

app.get('/', (c) => c.text('Hello JSR!'))

export default app

And run it:

deno serve main.ts

If you edit the deno.json and set the paths appropriately, the exact same code that you are familiar with will work in Deno, Cloudflare Workers, and Bun.

deno.json:

{
  "imports": {
    "hono": "jsr:@&#8203;hono/hono@^4.4.0"
  }
}
Area.mp4

JSR is not exclusive to Deno. You can use it with npm and Bun.

### npm
npx jsr add @&#8203;hono/hono

### bun
bunx jsr add @&#8203;hono/hono

And, removing "slow types" has improved the performance of TypeScript type inference.

With the introduction of JSR, the previous package publishing from deno.land/x will be obsolete.

Introduce ConnInfo Helper

The ConnInfo Helper is a helper helps you to get the connection information. For example, you can get the client's remote address easily.

import { Hono } from 'hono'
import { getConnInfo } from 'hono/deno' // For Deno

const app = new Hono()

app.get('/', (c) => {
  const info = getConnInfo(c) // info is `ConnInfo`
  return c.text(`Your remote address is ${info.remote.address}`)
})

export default app

Thank you for creating the feature, @​nakasyou!

Introduce Timeout Middleware

The Timeout Middleware is a middleware enables you to easily manage request timeouts in your application.

Here is a simple example:

import { Hono } from 'hono'
import { timeout } from 'hono/timeout'

const app = new Hono()

// Applying a 5-second timeout
app.use('/api', timeout(5000))

// Handling a route
app.get('/api/data', async (c) => {
  // Your route handler logic
  return c.json({ data: 'Your data here' })
})

Thank you for creating the feature, @​watany-dev!

Improving JSDoc

We are now trying to improve the JSDocs. In the PR, we've added the JSDocs for all middleware. Thank you, @​goisaki!

Other features

All Updates

New Contributors

Full Changelog: honojs/hono@v4.3.9...v4.4.0

v4.3.11

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.3.10...v4.3.11

v4.3.10

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.3.9...v4.3.10

v4.3.9

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.3.8...v4.3.9

v4.3.8

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.3.7...v4.3.8

v4.3.7

Compare Source

What's Changed

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-hono-vulnerability branch from 5a2810f to d25235f Compare September 4, 2024 16:20
@renovate renovate bot force-pushed the renovate/npm-hono-vulnerability branch from d25235f to 6c8b437 Compare September 4, 2024 17:02
@dtmeadows dtmeadows merged commit 3808677 into main Sep 6, 2024
1 check failed
@renovate renovate bot deleted the renovate/npm-hono-vulnerability branch September 6, 2024 17:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@dtmeadows