Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency hono to v4.5.8 [security] #6248

Merged
merged 1 commit into from
Sep 24, 2024
Merged

chore(deps): update dependency hono to v4.5.8 [security] #6248

merged 1 commit into from
Sep 24, 2024
+451 −1,310

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Sep 24, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
hono (source) ^3.12.2 -> ^4.0.0 age adoption passing confidence
hono (source) 4.5.1 -> 4.5.8 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-32869

Summary

When using serveStatic with deno, it is possible to directory traverse where main.ts is located.

My environment is configured as per this tutorial
https://hono.dev/getting-started/deno

PoC

$ tree
.
├── deno.json
├── deno.lock
├── main.ts
├── README.md
└── static
    └── a.txt

source

import { Hono } from 'https://deno.land/x/[email protected]/mod.ts'
import { serveStatic } from 'https://deno.land/x/[email protected]/middleware.ts'

const app = new Hono()
app.use('/static/*', serveStatic({ root: './' }))

Deno.serve(app.fetch)

request

curl localhost:8000/static/%2e%2e/main.ts

response is content of main.ts

Impact

Unexpected files are retrieved.

CVE-2024-43787

Summary

Hono CSRF middleware can be bypassed using crafted Content-Type header.

Details

MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case.

https://github.com/honojs/hono/blob/b0af71fbcc6dbe44140ea76f16d68dfdb32a99a0/src/middleware/csrf/index.ts#L16-L17

As a result, attacker can bypass csrf middleware using upper-case form-like MIME type, such as "Application/x-www-form-urlencoded".

PoC

<html>
  <head>
    <title>CSRF Test</title>
    <script defer>
      document.addEventListener("DOMContentLoaded", () => {
        document.getElementById("btn").addEventListener("click", async () => {
          const res = await fetch("http://victim.example.com/test", {
            method: "POST",
            credentials: "include",
            headers: {
              "Content-Type": "Application/x-www-form-urlencoded",
            },
          });
        });
      });
    </script>
  </head>
  <body>
    <h1>CSRF Test</h1>
    <button id="btn">Click me!</button>
  </body>
</html>

Impact

Bypass csrf protection implemented with hono csrf middleware.

Discussion

I'm not sure that omitting csrf checks for Simple POST request is a good idea.
CSRF prevention and CORS are different concepts even though CORS can prevent CSRF in some cases.

Release Notes

honojs/hono (hono)

v4.5.8

Compare Source

Security Fix for CSRF Protection Middleware

Before this release, in versions 4.5.7 and below, the CSRF Protection Middleware did not treat requests including Content-Types with uppercase letters (e.g., Application/x-www-form-urlencoded) as potential attacks, allowing them to pass.

This could cause unexpected behavior, leading to a vulnerability. If you are using the CSRF Protection Middleware, please upgrade to version 4.5.8 or higher immediately.

For more details, see the report here: GHSA-rpfr-3m35-5vx5

v4.5.7

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.5.6...v4.5.7

v4.5.6

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.5.5...v4.5.6

v4.5.5

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.5.4...v4.5.5

v4.5.4

Compare Source

What's Changed
New Contributors

Full Changelog: honojs/hono@v4.5.3...v4.5.4

v4.5.3

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.5.2...v4.5.3

v4.5.2

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.5.1...v4.5.2

v4.5.1

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.5.0...v4.5.1

v4.5.0

Compare Source

v4.4.13

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.4.12...v4.4.13

v4.4.12

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.11...v4.4.12

v4.4.11

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.10...v4.4.11

v4.4.10

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.9...v4.4.10

v4.4.9

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.4.8...v4.4.9

v4.4.8

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.4.7...v4.4.8

v4.4.7

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.6...v4.4.7

v4.4.6

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.4.5...v4.4.6

v4.4.5

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.4.4...v4.4.5

v4.4.4

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.3...v4.4.4

v4.4.3

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.2...v4.4.3

v4.4.2

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.4.1...v4.4.2

v4.4.1

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.4.0...v4.4.1

v4.4.0

Compare Source

Hono v4.4.0 is now available! Let's take a look at the new features.

Support JSR

Now, Hono is available on JSR - a new JavaScript/TypeScript registry! You can install the Hono package from JSR right now. If you want to run your Hono app on Deno, you can install it with the following command:

deno add @&#8203;hono/hono

Then, use it in your code!

// main.ts
import { Hono } from '@&#8203;hono/hono'

const app = new Hono()

app.get('/', (c) => c.text('Hello JSR!'))

export default app

And run it:

deno serve main.ts

If you edit the deno.json and set the paths appropriately, the exact same code that you are familiar with will work in Deno, Cloudflare Workers, and Bun.

deno.json:

{
  "imports": {
    "hono": "jsr:@&#8203;hono/hono@^4.4.0"
  }
}
Area.mp4

JSR is not exclusive to Deno. You can use it with npm and Bun.

### npm
npx jsr add @&#8203;hono/hono

### bun
bunx jsr add @&#8203;hono/hono

And, removing "slow types" has improved the performance of TypeScript type inference.

With the introduction of JSR, the previous package publishing from deno.land/x will be obsolete.

Introduce ConnInfo Helper

The ConnInfo Helper is a helper helps you to get the connection information. For example, you can get the client's remote address easily.

import { Hono } from 'hono'
import { getConnInfo } from 'hono/deno' // For Deno

const app = new Hono()

app.get('/', (c) => {
  const info = getConnInfo(c) // info is `ConnInfo`
  return c.text(`Your remote address is ${info.remote.address}`)
})

export default app

Thank you for creating the feature, @​nakasyou!

Introduce Timeout Middleware

The Timeout Middleware is a middleware enables you to easily manage request timeouts in your application.

Here is a simple example:

import { Hono } from 'hono'
import { timeout } from 'hono/timeout'

const app = new Hono()

// Applying a 5-second timeout
app.use('/api', timeout(5000))

// Handling a route
app.get('/api/data', async (c) => {
  // Your route handler logic
  return c.json({ data: 'Your data here' })
})

Thank you for creating the feature, @​watany-dev!

Improving JSDoc

We are now trying to improve the JSDocs. In the PR, we've added the JSDocs for all middleware. Thank you, @​goisaki!

Other features

All Updates

New Contributors

Full Changelog: honojs/hono@v4.3.9...v4.4.0

v4.3.11

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.3.10...v4.3.11

v4.3.10

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.3.9...v4.3.10

v4.3.9

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.3.8...v4.3.9

v4.3.8

Compare Source

What's Changed

New Contributors

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot changeset-bot
Copy link

changeset-bot bot commented Sep 24, 2024 •
edited
Loading

⚠️ No Changeset found

Latest commit: e7ae1a3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@netlify Netlify
Copy link

netlify bot commented Sep 24, 2024 •
edited
Loading

✅ Deploy Preview for modernjs-byted ready!

Name Link
🔨 Latest commit e7ae1a3
🔍 Latest deploy log https://app.netlify.com/sites/modernjs-byted/deploys/66f27e7a0b99730008fdfaaa
😎 Deploy Preview https://deploy-preview-6248--modernjs-byted.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse		 1 paths audited
Performance: 81 (🔴 down 2 from production)
Accessibility: 90 (no change from production)
Best Practices: 100 (no change from production)
SEO: 83 (no change from production)
PWA: -
View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify site configuration.

@renovate renovate bot force-pushed the renovate/npm-hono-vulnerability branch 5 times, most recently from 3449fcf to d545c0d Compare September 24, 2024 08:48
@caohuilin caohuilin closed this Sep 24, 2024
@caohuilin caohuilin force-pushed the renovate/npm-hono-vulnerability branch from d545c0d to edfe85d Compare September 24, 2024 08:53
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Sep 24, 2024

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 4.x releases. But if you manually upgrade to 4.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate bot deleted the renovate/npm-hono-vulnerability branch September 24, 2024 08:54
@caohuilin caohuilin reopened this Sep 24, 2024
@renovate renovate bot closed this Sep 24, 2024
@caohuilin caohuilin restored the renovate/npm-hono-vulnerability branch September 24, 2024 08:57
@caohuilin caohuilin reopened this Sep 24, 2024
@caohuilin caohuilin enabled auto-merge (squash) September 24, 2024 08:58
@renovate Renovate
Copy link
Contributor Author

renovate bot commented Sep 24, 2024

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@caohuilin caohuilin merged commit bb70e46 into main Sep 24, 2024
15 of 21 checks passed
@caohuilin caohuilin deleted the renovate/npm-hono-vulnerability branch September 24, 2024 09:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@caohuilin caohuilin caohuilin approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@caohuilin