Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade tough-cookie to 4.3.1 to fix security vulnerability. #484

Closed

Conversation

astegmaier
Copy link

@astegmaier astegmaier commented Jul 5, 2023

This addresses #483. There is a security vulnerability in the tough-cookie package for versions <4.3.1 - see https://nvd.nist.gov/vuln/detail/CVE-2023-26136. Previously @azure/ms-rest-js depended on ^3.0.0, which locked tough-cookie to an unsecure version.

Testing

Build (npmrun build) and tests (npm run test) continue to succeed with this upgrade. In addition I reviewed the [release notes for tough-cookie@4.0.0][https://github.com/salesforce/tough-cookie/releases/tag/v4.0.0] (the breaking change from 3.x). Here they are (annotated with [astegmaier]), with why I believe they will not break @azure/ms-rest-js:

  • Modernized JS Syntax
    • Use ESLint and Prettier to apply consistent, modern formatting (add dependency on universalify, eslint and prettier) - [astegmaier] eslint and prettier are devDependencies of tough-cookie so they shouldn't break consumers. universalify seems to be aimed at backward-compatible usage
  • Upgraded version dependencies for psl and async - [astegmaier] async is a devDependency of tough-cookie, so an upgrade shouldn't break consumers. psl also seems to be a pretty benign dependency
  • Re-order parameters for findCookies() - callback fn has to be last in order to comply with universalify [astegmaier] it doesn't look like @azure/ms-rest-js uses findCookies anywhere`
  • Use Classes instead of function prototypes to define classes
    • Might break people using .call() to do inheritance using function prototypes - [astegmaier] it doesn't look like `@azurems-rest-js uses this pattern anywhere

@astegmaier astegmaier mentioned this pull request Jul 6, 2023
@xirzec
Copy link
Member

xirzec commented Jul 6, 2023

Closing in favor of #485

@xirzec xirzec closed this Jul 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants