Skip to content

Commit 449ae09

Browse files
joshuarrrrjoshuarrrr
authored
[CVE-2023-26136] [1.3] Resolve tough-cookie to 4.1.3 (#4682)
* [CVE-2023-26136] [1.3] Resolve tough-cookie to 4.1.3 Signed-off-by: Josh Romero <rmerqg@amazon.com> * add changelog Signed-off-by: Josh Romero <rmerqg@amazon.com> * Add tough-cookie as explicit dev dep and update tests Partial backport of #1113 Signed-off-by: Josh Romero <rmerqg@amazon.com> --------- Signed-off-by: Josh Romero <rmerqg@amazon.com>
1 parent 6f8dd76 commit 449ae09

File tree

4 files changed

+29
-22
lines changed

4 files changed

+29
-22
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
99

1010
### 🛡 Security
1111

12+
- [CVE-2023-26136] Resolve `tough-cookie` to `4.1.3` ([#4682](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/4682))
1213
- [CVE-2021-23382] Bump postcss from `8.2.10` to `8.4.24` ([#4403](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/4403))
1314
- [CVE-2022-1537] Bump grunt from `1.5.2` to `1.5.3` ([#4276](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/4276))
1415
- [CVE-2022-25858] Bump terser from `4.8.0` to `4.8.1` ([#3726](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3726))

‎package.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@
125125
"**/tar": "^6.1.11",
126126
"**/trim": "^0.0.3",
127127
"**/trim-newlines": "^3.0.1",
128+
"**/tough-cookie": "^4.1.3",
128129
"**/typescript": "4.0.2",
129130
"**/url-parse": "^1.5.8",
130131
"**/unset-value": "^2.0.1"
@@ -362,6 +363,7 @@
362363
"@types/tar": "^4.0.3",
363364
"@types/testing-library__jest-dom": "^5.9.3",
364365
"@types/testing-library__react-hooks": "^3.4.0",
366+
"@types/tough-cookie": "^4.0.1",
365367
"@types/type-detect": "^4.0.1",
366368
"@types/uuid": "^3.4.4",
367369
"@types/vinyl": "^2.0.4",
@@ -486,6 +488,7 @@
486488
"supertest-as-promised": "^4.0.2",
487489
"tape": "^5.0.1",
488490
"topojson-client": "3.0.0",
491+
"tough-cookie": "^4.1.3",
489492
"tree-kill": "^1.2.2",
490493
"typescript": "4.0.2",
491494
"ui-select": "0.19.8",

‎src/core/server/http/cookie_session_storage.test.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
* Modifications Copyright OpenSearch Contributors. See
3030
* GitHub history for details.
3131
*/
32-
import request from 'request';
32+
import { parse as parseCookie } from 'tough-cookie';
3333
import supertest from 'supertest';
3434
import { REPO_ROOT } from '@osd/dev-utils';
3535
import { ByteSizeValue } from '@osd/config-schema';
@@ -107,7 +107,7 @@ interface Storage {
107107
}
108108

109109
function retrieveSessionCookie(cookies: string) {
110-
const sessionCookie = request.cookie(cookies);
110+
const sessionCookie = parseCookie(cookies);
111111
if (!sessionCookie) {
112112
throw new Error('session cookie expected to be defined');
113113
}
@@ -487,7 +487,7 @@ describe('Cookie based SessionStorage', () => {
487487
expect(cookies).toHaveLength(1);
488488

489489
const sessionCookie = retrieveSessionCookie(cookies[0]);
490-
expect(sessionCookie.extensions).toContain(`SameSite=${sameSite}`);
490+
expect(sessionCookie.sameSite).toEqual(sameSite.toLowerCase());
491491

492492
await supertest(innerServer.listener)
493493
.get('/')

‎yarn.lock‎

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -3435,6 +3435,11 @@
34353435
resolved "https://registry.yarnpkg.com/@types/tough-cookie/-/tough-cookie-2.3.5.tgz#9da44ed75571999b65c37b60c9b2b88db54c585d"
34363436
integrity sha512-SCcK7mvGi3+ZNz833RRjFIxrn4gI1PPR3NtuIS+6vMkvmsGjosqTJwRt5bAEFLRz+wtJMWv8+uOnZf2hi2QXTg==
34373437

3438+
"@types/tough-cookie@^4.0.1":
3439+
version "4.0.2"
3440+
resolved "https://registry.yarnpkg.com/@types/tough-cookie/-/tough-cookie-4.0.2.tgz#6286b4c7228d58ab7866d19716f3696e03a09397"
3441+
integrity sha512-Q5vtl1W5ue16D+nIaW8JWebSSraJVlK+EthKn7e7UcD4KWsaSJ8BqGPXNaPghgtcn/fhvrN17Tv8ksUsQpiplw==
3442+
34383443
"@types/type-detect@^4.0.1":
34393444
version "4.0.1"
34403445
resolved "https://registry.yarnpkg.com/@types/type-detect/-/type-detect-4.0.1.tgz#3b0f5ac82ea630090cbf57c57a1bf5a63a29b9b6"
@@ -16798,10 +16803,10 @@ pseudomap@^1.0.2:
1679816803
resolved "https://registry.yarnpkg.com/pseudomap/-/pseudomap-1.0.2.tgz#f052a28da70e618917ef0a8ac34c1ae5a68286b3"
1679916804
integrity sha1-8FKijacOYYkX7wqKw0wa5aaChrM=
1680016805

16801-
psl@^1.1.28:
16802-
version "1.4.0"
16803-
resolved "https://registry.yarnpkg.com/psl/-/psl-1.4.0.tgz#5dd26156cdb69fa1fdb8ab1991667d3f80ced7c2"
16804-
integrity sha512-HZzqCGPecFLyoRj5HLfuDSKYTJkAfB5thKBIkRHtGjWwY7p1dAyveIbXIq4tO0KYfDF2tHqPUgY9SDnGm00uFw==
16806+
psl@^1.1.33:
16807+
version "1.9.0"
16808+
resolved "https://registry.yarnpkg.com/psl/-/psl-1.9.0.tgz#d0df2a137f00794565fcaf3b2c00cd09f8d5a5a7"
16809+
integrity sha512-E/ZsdU4HLs/68gYzgGTkMicWTLPdAftJLfJFlLUAAKZGkStNU72sZjT66SnMDVOfOWY/YAoiD7Jxa9iHvngcag==
1680516810

1680616811
public-encrypt@^4.0.0:
1680716812
version "4.0.0"
@@ -20310,22 +20315,15 @@ topojson-client@^3.1.0:
2031020315
dependencies:
2031120316
commander "2"
2031220317

20313-
tough-cookie@^2.0.0, tough-cookie@^2.3.3, tough-cookie@^2.5.0, tough-cookie@~2.5.0:
20314-
version "2.5.0"
20315-
resolved "https://registry.yarnpkg.com/tough-cookie/-/tough-cookie-2.5.0.tgz#cd9fb2a0aa1d5a12b473bd9fb96fa3dcff65ade2"
20316-
integrity sha512-nlLsUzgm1kfLXSXfRZMc1KLAugd4hqJHDTvc2hDIwS3mZAfMEuMbc03SujMF+GEcpaX/qboeycw6iO8JwVv2+g==
20317-
dependencies:
20318-
psl "^1.1.28"
20319-
punycode "^2.1.1"
20320-
20321-
tough-cookie@^3.0.1:
20322-
version "3.0.1"
20323-
resolved "https://registry.yarnpkg.com/tough-cookie/-/tough-cookie-3.0.1.tgz#9df4f57e739c26930a018184887f4adb7dca73b2"
20324-
integrity sha512-yQyJ0u4pZsv9D4clxO69OEjLWYw+jbgspjTue4lTQZLfV0c5l1VmK2y1JK8E9ahdpltPOaAThPcp5nKPUgSnsg==
20318+
tough-cookie@^2.0.0, tough-cookie@^2.3.3, tough-cookie@^2.5.0, tough-cookie@^3.0.1, tough-cookie@^4.1.3, tough-cookie@~2.5.0:
20319+
version "4.1.3"
20320+
resolved "https://registry.yarnpkg.com/tough-cookie/-/tough-cookie-4.1.3.tgz#97b9adb0728b42280aa3d814b6b999b2ff0318bf"
20321+
integrity sha512-aX/y5pVRkfRnfmuX+OdbSdXvPe6ieKX/G2s7e98f4poJHnqH3281gDPm/metm6E/WRamfx7WC4HUqkWHfQHprw==
2032520322
dependencies:
20326-
ip-regex "^2.1.0"
20327-
psl "^1.1.28"
20323+
psl "^1.1.33"
2032820324
punycode "^2.1.1"
20325+
universalify "^0.2.0"
20326+
url-parse "^1.5.3"
2032920327

2033020328
tr46@^1.0.1:
2033120329
version "1.0.1"
@@ -20816,6 +20814,11 @@ universalify@^0.1.0:
2081620814
resolved "https://registry.yarnpkg.com/universalify/-/universalify-0.1.2.tgz#b646f69be3942dabcecc9d6639c80dc105efaa66"
2081720815
integrity sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==
2081820816

20817+
universalify@^0.2.0:
20818+
version "0.2.0"
20819+
resolved "https://registry.yarnpkg.com/universalify/-/universalify-0.2.0.tgz#6451760566fa857534745ab1dde952d1b1761be0"
20820+
integrity sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg==
20821+
2081920822
universalify@^1.0.0:
2082020823
version "1.0.0"
2082120824
resolved "https://registry.yarnpkg.com/universalify/-/universalify-1.0.0.tgz#b61a1da173e8435b2fe3c67d29b9adf8594bd16d"
@@ -20949,7 +20952,7 @@ url-parse-lax@^3.0.0:
2094920952
dependencies:
2095020953
prepend-http "^2.0.0"
2095120954

20952-
url-parse@^1.4.3, url-parse@^1.4.7, url-parse@^1.5.1, url-parse@^1.5.8:
20955+
url-parse@^1.4.3, url-parse@^1.4.7, url-parse@^1.5.1, url-parse@^1.5.3, url-parse@^1.5.8:
2095320956
version "1.5.10"
2095420957
resolved "https://registry.yarnpkg.com/url-parse/-/url-parse-1.5.10.tgz#9d3c2f736c1d75dd3bd2be507dcc111f1e2ea9c1"
2095520958
integrity sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==

0 commit comments

Comments
 (0)