[PR #19] [MERGED] Security/202506.003 fixes #41

New issue

Closed

opened 2026-10-15 13:01:51 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 13:01:51 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/wolfmanager/pull/19
Author: @salty2011
Created: 6/9/2025
Status: ✅ Merged
Merged: 6/9/2025
Merged by: @salty2011

Base: release/202506.003 ← Head: security/202506.003-fixes

📝 Commits (6)

7ba0d8c security: fix tar-fs directory traversal vulnerability (CVE)
1eea14f security: fix Babel RegExp complexity vulnerability (CVE)
240a624 security: fix PrismJS DOM Clobbering vulnerability (CVE)
df4a4b0 security: fix undici Denial of Service vulnerability (CVE)
1002f16 security: fix cookie out-of-bounds characters vulnerability (CVE)
ecbf5eb security: fix Next.js middleware header leak vulnerability (CVE)

📊 Changes

2 files changed (+201 additions, -155 deletions)

View changed files

📝 package.json (+12 -4)
📝 pnpm-lock.yaml (+189 -151)

📄 Description

Security Vulnerability Remediation

Summary

This PR addresses 6 critical security vulnerabilities identified in the project dependencies. All fixes have been applied without breaking changes and verified through successful builds.

🔐 Security Fixes Applied

1. tar-fs Directory Traversal Vulnerability (CVE #21)

Issue: tar-fs can extract outside the specified directory with a specific tarball
Fixed: tar-fs@2.1.2 → tar-fs@3.0.9
Method: pnpm override + dockerode update (4.0.5 → 4.0.7)
Impact: Prevents malicious tarball extraction outside intended directories

2. Babel RegExp Complexity Vulnerability (CVE #16)

Issue: Inefficient RegExp complexity in generated code with named capturing groups
Fixed: @babel/runtime@7.26.9 → @babel/runtime@7.27.6
Method: pnpm override for transitive dependency
Impact: Prevents ReDoS (Regular Expression Denial of Service) attacks

3. PrismJS DOM Clobbering Vulnerability (CVE #15)

Issue: DOM Clobbering vulnerability allowing potential DOM manipulation
Fixed: prismjs@1.27.0 & prismjs@1.29.0 → prismjs@1.30.0
Method: pnpm override affecting react-syntax-highlighter dependencies
Impact: Prevents malicious DOM property manipulation

4. undici Denial of Service Vulnerability (CVE #19)

Issue: DoS attack via bad certificate data
Fixed: undici@7.3.0 → undici@7.10.0
Method: Direct dependency version bump
Impact: Prevents application crashes from malformed SSL certificates

Issue: Accepts cookie name, path, and domain with out-of-bounds characters
Fixed: cookie@0.6.0 → cookie@0.7.2
Method: pnpm override for @auth/core transitive dependency
Impact: Prevents HTTP response splitting and cookie injection attacks

6. Next.js Middleware Header Leak Vulnerability (CVE #23)

Issue: May leak x-middleware-subrequest-id to external hosts
Fixed: next@14.2.25 → next@14.2.26
Method: Direct dependency update + eslint-config-next consistency
Impact: Prevents information disclosure to external services

🛠️ Implementation Strategy

pnpm Overrides Added

"pnpm": {
  "overrides": {
    "tar-fs": ">=2.1.3",
    "@babel/runtime": ">=7.26.10", 
    "prismjs": ">=1.30.0",
    "cookie": ">=0.7.0"
  }
}

Direct Dependencies Updated

dockerode: ^4.0.5 → ^4.0.7
undici: ^7.3.0 → ^7.5.0 (resolved to 7.10.0)
next: 14.2.25 → 14.2.26
eslint-config-next: 14.2.25 → 14.2.26

✅ Verification

Build Status: ✅ All builds successful (pnpm run build)
Breaking Changes: ❌ None identified
Functionality: ✅ All features working (auth, syntax highlighting, Docker integration)
Dependencies: ✅ All transitive dependencies properly resolved

📋 Testing Performed

Build Verification: Successful Next.js production builds
Dependency Resolution: All package conflicts resolved
Functionality Tests: Authentication, logging, Docker operations working
Security Validation: All vulnerable versions eliminated from dependency tree

🎯 Branch Information

Source Branch: security/202506.003-fixes
Target Branch: release/202506.003
Commits: 6 individual security fix commits
Files Modified: package.json, pnpm-lock.yaml

🚀 Ready for Deployment

This comprehensive security patch resolves all identified vulnerabilities while maintaining full application functionality. The fixes use conservative version constraints to ensure automatic future security updates while preventing breaking changes.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/wolfmanager/pull/19 **Author:** [@salty2011](https://github.com/salty2011) **Created:** 6/9/2025 **Status:** ✅ Merged **Merged:** 6/9/2025 **Merged by:** [@salty2011](https://github.com/salty2011) **Base:** `release/202506.003` ← **Head:** `security/202506.003-fixes` --- ### 📝 Commits (6) - [`7ba0d8c`](https://github.com/games-on-whales/wolfmanager/commit/7ba0d8ce011e4b80ee2c579960dcd693dccf945c) security: fix tar-fs directory traversal vulnerability (CVE) - [`1eea14f`](https://github.com/games-on-whales/wolfmanager/commit/1eea14f3732fb979bc91aff683ac09d134f237cf) security: fix Babel RegExp complexity vulnerability (CVE) - [`240a624`](https://github.com/games-on-whales/wolfmanager/commit/240a62454ac0233c39071ad137db763e662662ba) security: fix PrismJS DOM Clobbering vulnerability (CVE) - [`df4a4b0`](https://github.com/games-on-whales/wolfmanager/commit/df4a4b04adf20d822e1a27a47fd3de9743426d1f) security: fix undici Denial of Service vulnerability (CVE) - [`1002f16`](https://github.com/games-on-whales/wolfmanager/commit/1002f168485797fca41c58cd54d442efe1d03853) security: fix cookie out-of-bounds characters vulnerability (CVE) - [`ecbf5eb`](https://github.com/games-on-whales/wolfmanager/commit/ecbf5ebdce3712d1be043327aeeaedd2a9ef5d80) security: fix Next.js middleware header leak vulnerability (CVE) ### 📊 Changes **2 files changed** (+201 additions, -155 deletions) <details> <summary>View changed files</summary> 📝 `package.json` (+12 -4) 📝 `pnpm-lock.yaml` (+189 -151) </details> ### 📄 Description # Security Vulnerability Remediation ## Summary This PR addresses **6 critical security vulnerabilities** identified in the project dependencies. All fixes have been applied without breaking changes and verified through successful builds. ## 🔐 Security Fixes Applied ### 1. **tar-fs Directory Traversal Vulnerability** (CVE #21) - **Issue**: tar-fs can extract outside the specified directory with a specific tarball - **Fixed**: `tar-fs@2.1.2` → `tar-fs@3.0.9` - **Method**: pnpm override + dockerode update (`4.0.5` → `4.0.7`) - **Impact**: Prevents malicious tarball extraction outside intended directories ### 2. **Babel RegExp Complexity Vulnerability** (CVE #16) - **Issue**: Inefficient RegExp complexity in generated code with named capturing groups - **Fixed**: `@babel/runtime@7.26.9` → `@babel/runtime@7.27.6` - **Method**: pnpm override for transitive dependency - **Impact**: Prevents ReDoS (Regular Expression Denial of Service) attacks ### 3. **PrismJS DOM Clobbering Vulnerability** (CVE #15) - **Issue**: DOM Clobbering vulnerability allowing potential DOM manipulation - **Fixed**: `prismjs@1.27.0` & `prismjs@1.29.0` → `prismjs@1.30.0` - **Method**: pnpm override affecting react-syntax-highlighter dependencies - **Impact**: Prevents malicious DOM property manipulation ### 4. **undici Denial of Service Vulnerability** (CVE #19) - **Issue**: DoS attack via bad certificate data - **Fixed**: `undici@7.3.0` → `undici@7.10.0` - **Method**: Direct dependency version bump - **Impact**: Prevents application crashes from malformed SSL certificates ### 5. **Cookie Out-of-Bounds Characters Vulnerability** (CVE #11) - **Issue**: Accepts cookie name, path, and domain with out-of-bounds characters - **Fixed**: `cookie@0.6.0` → `cookie@0.7.2` - **Method**: pnpm override for @auth/core transitive dependency - **Impact**: Prevents HTTP response splitting and cookie injection attacks ### 6. **Next.js Middleware Header Leak Vulnerability** (CVE #23) - **Issue**: May leak x-middleware-subrequest-id to external hosts - **Fixed**: `next@14.2.25` → `next@14.2.26` - **Method**: Direct dependency update + eslint-config-next consistency - **Impact**: Prevents information disclosure to external services ## 🛠️ Implementation Strategy ### pnpm Overrides Added ```json "pnpm": { "overrides": { "tar-fs": ">=2.1.3", "@babel/runtime": ">=7.26.10", "prismjs": ">=1.30.0", "cookie": ">=0.7.0" } } ``` ### Direct Dependencies Updated dockerode: ^4.0.5 → ^4.0.7 undici: ^7.3.0 → ^7.5.0 (resolved to 7.10.0) next: 14.2.25 → 14.2.26 eslint-config-next: 14.2.25 → 14.2.26 ## ✅ Verification **Build Status:** ✅ All builds successful (pnpm run build) **Breaking Changes:** ❌ None identified **Functionality:** ✅ All features working (auth, syntax highlighting, Docker integration) **Dependencies:** ✅ All transitive dependencies properly resolved ## 📋 Testing Performed **Build Verification:** Successful Next.js production builds **Dependency Resolution:** All package conflicts resolved **Functionality Tests:** Authentication, logging, Docker operations working **Security Validation:** All vulnerable versions eliminated from dependency tree ## 🎯 Branch Information Source Branch: security/202506.003-fixes Target Branch: release/202506.003 Commits: 6 individual security fix commits Files Modified: package.json, pnpm-lock.yaml ## 🚀 Ready for Deployment This comprehensive security patch resolves all identified vulnerabilities while maintaining full application functionality. The fixes use conservative version constraints to ensure automatic future security updates while preventing breaking changes. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 13:01:51 +00:00