Codestin Search App

SzymonDrosdzol · 2023-03-16T12:58:27Z

PR Checklist:

[DONE] I have run npm test locally and all tests are passing.
[DONE] I have added/updated tests for any new behavior.
[DONE] If this is a significant change, an issue has already been created where the problem / solution was discussed: [N/A, or add link to issue here]

PR Description

This pull request is a fix to CVE-2023-28155.

It introduces a new configuration option allowInsecureRedirects, turned off by default. The default configuration leaves library users protected from exploiting CVE-2023-28155. When the option gets turned on, the cross-protocol redirects will be allowed if library user decides it's safe and required in their case.

phawxby · 2023-03-16T19:29:27Z

@mikeal @jabrena @mmalecki @eiriksm @reconbot any possibility one of you is available to review and merge this? Our build process is currently broken because of audit failures. Thanks.

GHSA-p8p7-x288-28g6 Ported from request/request#3444

Co-authored-by: legobeat <[email protected]>

Co-authored-by: Kevin van Rijn <[email protected]>

* security: patch request for CVE-2023-28155 GHSA-p8p7-x288-28g6 Ported from request/request#3444 * add iyarc exclusion

tcherel · 2023-03-22T17:32:38Z

Can we expect an updated request release with this fix soon?
If yes, how soon?
Sorry, just trying to figure out how fast we need to move out of request completely.
Thanks.

khitrenovich · 2023-03-22T18:18:51Z

There were no non-doc/tools changes in the repo since 2018 and no commits at all for the last 3 years.
I wouldn't expect any fix coming from here.

Our own dependency on request came from jsforce (which is not gonna get fixed soon, as it looks like), so we migrated to the still-maintained fork from Cypress via Yarn forced resolutions mechanism, and it worked like a charm.

Update: in case somebody missed that, request is deprecated since 2020.

danilogco · 2023-03-22T18:20:55Z

Yeah... It seems like it's not being maintained/updated anymore a long time.

tcherel · 2023-03-22T19:16:21Z

Thanks.
Yes, I understand that request is not maintained any longer but since there was this PR created and it got reviewed and approved, I though that, may be, something was going to be released.

suside · 2023-03-23T08:25:23Z

@khitrenovich CVE-2023-28155 was reported on Mar 16, 2023 and the last commit in fork from Cypress is from Jan 11, 2023. It doesn't look like this has been fixed in their fork 🤨

khitrenovich · 2023-03-23T14:00:33Z

@khitrenovich CVE-2023-28155 was reported on Mar 16, 2023 and the last commit in fork from Cypress is from Jan 11, 2023. It doesn't look like this has been fixed in their fork 🤨

@suside You are right... Just opened an issue there, let's see how they respond.

phawxby · 2023-03-24T14:28:33Z

@SzymonDrosdzol it might be worth you opening the same CVE against the cypress fork too

- Addresses CVE-2023-28155 - Existing behavior allows malicios redirects between protocols - Set default behavior to disable this vector (breaking) - Add new option `allowInsecureRedirect` where `true` reverts to old behavior - Ported from request#3444

legobeat · 2023-03-25T01:21:27Z

I have made two PRs on cypress:

feat: Add allowInsecureRedirect option cypress-io/request#28 : Port of this plus enabling allowRedirects in regressing tests
security: non-breaking: Add option "allowInsecureRedirect" cypress-io/request#30 : Similar but retains default behavior (non-breaking, non-safe-by-default)

It seems they have an extended test suite handling more complex redirects so if anyone feels up for extending my PRs addressing those cases to get them up to standard, feel free.

karanr1990 · 2023-03-27T17:54:06Z

is there any alternate library of sforcejs where we do not have dependency on request library ?

jeremieSTC · 2023-04-23T06:38:08Z

Can we expect an updated request release with this fix soon?

If yes, how soon?

Sorry, just trying to figure out how fast we need to move out of request completely.

Thanks.

It would be great if a new version could be released including the fix. I see there was a new version a couple of days ago with the new version of xml2js so I have hope.

legobeat · 2023-04-23T12:24:39Z

@jeremieSTC A couple of years, you mean? See above for alternatives - request itself is unmaintained and I wouldn't be hoping to see further updates.

reconbot · 2023-04-23T16:05:31Z

Per the readme and npm deprecation warning.

As of Feb 11th 2020, request is fully deprecated. No new changes are expected to land. In fact, none have landed for some time.

Please use alternative libraries.

- Addresses CVE-2023-28155 - Existing behavior allows malicios redirects between protocols - Set default behavior to disable this vector (breaking) - Add new option `allowInsecureRedirect` where `true` reverts to old behavior - Ported from request#3444

SzymonDrosdzol added 2 commits March 12, 2023 19:47

Added option "allowInsecureRedirect"

d423321

Documented allowInsecureRedirect in Readme

9d69d75

legobeat reviewed Mar 16, 2023

View reviewed changes

Comment thread lib/redirect.js Outdated

legobeat mentioned this pull request Mar 17, 2023

security: patch request for CVE-2023-28155 MetaMask/metamask-extension#18208

Merged

legobeat added a commit to legobeat/metamask-extension that referenced this pull request Mar 17, 2023

security: patch request for CVE-2023-28155

8d8ab81

GHSA-p8p7-x288-28g6 Ported from request/request#3444

kevinvanrijn reviewed Mar 17, 2023

View reviewed changes

Comment thread tests/test-httpModule.js Outdated

kevinvanrijn reviewed Mar 17, 2023

View reviewed changes

Comment thread tests/test-redirect.js Outdated

SzymonDrosdzol and others added 3 commits March 17, 2023 10:09

Removed semicolon

8a15249

Co-authored-by: legobeat <[email protected]>

Code style fix

8535868

Co-authored-by: Kevin van Rijn <[email protected]>

Removed leftover declaration

43647c4

kevinvanrijn approved these changes Mar 17, 2023

View reviewed changes

Gudahtt pushed a commit to MetaMask/metamask-extension that referenced this pull request Mar 17, 2023

security: patch request for CVE-2023-28155 (#18208)

c21c2bd

* security: patch request for CVE-2023-28155 GHSA-p8p7-x288-28g6 Ported from request/request#3444 * add iyarc exclusion

phawxby mentioned this pull request Mar 17, 2023

Replace the deprecated and vulnerable dependency package request loggly/node-loggly-bulk#47

Open

danjm pushed a commit to MetaMask/metamask-extension that referenced this pull request Mar 17, 2023

security: patch request for CVE-2023-28155 (#18208)

dacdaf0

* security: patch request for CVE-2023-28155 GHSA-p8p7-x288-28g6 Ported from request/request#3444 * add iyarc exclusion

phawxby mentioned this pull request Mar 20, 2023

Vulnerabilities found on latest version of request #3445

Open

WassimBenzarti approved these changes Mar 22, 2023

View reviewed changes

nrbarry approved these changes Mar 22, 2023

View reviewed changes

khitrenovich mentioned this pull request Mar 23, 2023

CVE-2023-28155 cypress-io/request#27

Closed

abbyhu2000 mentioned this pull request Mar 23, 2023

jest-cli-24.9.0.tgz: 2 vulnerabilities (highest severity is: 6.1) - autoclosed opensearch-project/oui#630

Closed

legobeat mentioned this pull request Mar 25, 2023

security: non-breaking: Add option "allowInsecureRedirect" cypress-io/request#30

Closed

3 tasks

azu mentioned this pull request Mar 26, 2023

fix(deps): remove "request" package honkit/honkit#329

Merged

justin-wilxite mentioned this pull request Mar 26, 2023

Remove "request" dependency due to security vulnerability? CVE-2023-28155 ory/integrations#51

Closed

WassimBenzarti mentioned this pull request Mar 29, 2023

Remove deprecated npm request dependency kubernetes-client/javascript#1031

Closed

vamsimanohar mentioned this pull request Mar 30, 2023

CVE-2023-28155 (Medium) detected in request-2.88.2.tgz - autoclosed opensearch-project/dashboards-reporting#82

Closed

dboreham mentioned this pull request Mar 31, 2023

Address dependabot alerts cerc-io/laconic-console#37

Closed

github-actions Bot mentioned this pull request Apr 4, 2023

Medium severity - Server-side Request Forgery (SSRF) vulnerability in request (package.json) jordaniac89/juice-shop#101

Open

gclendinning02 mentioned this pull request Apr 12, 2023

[CVE-2023-28155] request package dependency has known vulnerability elasticsearch-dump/elasticsearch-dump#963

Closed

ssathishan approved these changes Apr 13, 2023

View reviewed changes

andyren0110 approved these changes Apr 17, 2023

View reviewed changes

RyanHipkiss mentioned this pull request Apr 18, 2023

Package upgrades to fix vulnerabilities Multiplied-By-One/MBO-App#42

Merged

reconbot closed this Apr 23, 2023

Scomodev mentioned this pull request Apr 28, 2023

Smartsheet Javascript SDK Includes Vulnerable Node.js Version 2.88.1 (CVE-2023-28155) smartsheet/smartsheet-javascript-sdk#30

Closed

This was referenced May 23, 2023

Tobiasb/CVE 2023 28155 reaper microsoft/azurelinux#5560

Closed

Fix tobiasb/CVE-2023-28155 by patch request module in reaper microsoft/azurelinux#5574

Merged

Fix CVE-2023-28155 by patching request module in nodejs microsoft/azurelinux#5562

Merged

github-actions Bot mentioned this pull request Jun 2, 2023

Snyk vulnerability [SNYK-JS-REQUEST-3361831] backstage/backstage#18081

Closed

westonphillips mentioned this pull request Jun 27, 2023

CVE-2023-28155 @ Npm-request-2.88.2 westonphillips/CheckmarxOnePOV#68

Open

darakian mentioned this pull request Jul 13, 2023

[GHSA-p8p7-x288-28g6] Server-Side Request Forgery in Request github/advisory-database#2495

Merged

github-actions Bot mentioned this pull request Dec 12, 2023

Security Report: Project Vulnerabilities egdmrsy/TruBudget-SvKit#71

Closed

pratheeshrussell-qb mentioned this pull request Feb 20, 2025

Test pratheeshrussell-qb/docker_vuln_scan#8

Closed

pratheeshrussell-qb mentioned this pull request Apr 7, 2025

Test pratheeshrussell-qb/docker_vuln_scan#9

Closed

github-actions Bot mentioned this pull request Apr 7, 2025

Test2 pratheeshrussell-qb/docker_vuln_scan#10

Closed

Conversation

SzymonDrosdzol commented Mar 16, 2023

PR Checklist:

PR Description

Uh oh!

phawxby commented Mar 16, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tcherel commented Mar 22, 2023

Uh oh!

khitrenovich commented Mar 22, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

danilogco commented Mar 22, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tcherel commented Mar 22, 2023

Uh oh!

suside commented Mar 23, 2023

Uh oh!

khitrenovich commented Mar 23, 2023

Uh oh!

phawxby commented Mar 24, 2023

Uh oh!

legobeat commented Mar 25, 2023

Uh oh!

karanr1990 commented Mar 27, 2023

Uh oh!

jeremieSTC commented Apr 23, 2023

Uh oh!

legobeat commented Apr 23, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

reconbot commented Apr 23, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

15 participants

khitrenovich commented Mar 22, 2023 •

edited

Loading

danilogco commented Mar 22, 2023 •

edited

Loading

legobeat commented Apr 23, 2023 •

edited

Loading

reconbot commented Apr 23, 2023 •

edited

Loading