UI5 / webcomponents-react / 43404166563

86%

push

github

chore(deps): bump @hono/node-server from 2.1.5 to 2.1.6 (#9148)

Bumps [@hono/node-server](https://github.com/honojs/node-server) from
2.1.5 to 2.1.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases">@​hono/node-server's
releases</a>.</em></p>
<blockquote>
<h2>v2.1.6</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3>Backslash in the request path is parsed as a path separator,
bypassing path-based access control at a reverse proxy</h3>
<p>Affects: all requests. The raw request-target was passed to the
WHATWG URL parser, which treats a backslash in the path as
<code>/</code> and resolves <code>..</code> segments, so
<code>/admin\secret</code> reached the application as
<code>/admin/secret</code>. A reverse proxy that forwards the backslash
unchanged applied its path-based rules to the original path. <a
href="https://github.com/honojs/node-server/security/advisories/GHSA-jpvv-r467-5p4w">GHSA-jpvv-r467-5p4w</a></p>
<p>A request whose path contains a raw backslash is now rejected with
<code>400 Bad Request</code>, for HTTP/1.1, HTTP/2 and WebSocket
upgrades. A percent-encoded backslash (<code>%5C</code>) and a backslash
in the query string are still accepted.</p>
<h3>WebSocket upgrade request-target starting with <code>//</code>
replaces the host in <code>c.req.url</code>, bypassing
<code>Origin</code> checks</h3>
<p>Affects: <code>upgradeWebSocket</code>. The URL of an upgrade request
was built by resolving the request-target against the <code>Host</code>
header, so a request-target such as <code>//attacker.example/ws</code>
set the host of <code>c.req.url</code> to a client-chosen value while
routing still saw <code>/ws</code>. An application that compared
<code>Origin</code> with the origin of <code>c.req.url</code> could be
bypassed by a page on another site. <a
href="https://github.com/honojs/node-server/security/advisories/GHSA-... (continued)

4156 of 5204 branches covered (79.86%)

Branch coverage included in aggregate %.

7276 of 8129 relevant lines covered (89.51%)

557680.0 hits per line