chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] - autoclosed #1185
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.5.0
->1.15.2
GitHub Vulnerability Alerts
CVE-2023-29003
Summary
The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a
+server.js
file, containing endpoint handlers for different HTTP methods.SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to it’s users. The protection is implemented at
kit/src/runtime/server/respond.js#L52
. While the implementation does a sufficient job in mitigating common CSRF attacks, the protection can be bypassed by simply specifying a differentContent-Type
header value.Details
The CSRF protection is implemented using the code shown below.
If the incoming request specifies a POST method (1), the protection will compare the server’s origin with the value of the HTTP
Origin
header (2). A mismatch between these values signals that a potential attack has been detected. The final check is performed on the request’sContent-Type
header (3) whether the value is eitherapplication/x-www-form-urlencoded
ormultipart/form-data
(kit/src/utils/http.js#L71
). If all the previous checks pass, the request will be rejected with an 403 error response (4).The
is_form_content_type
validation is not sufficient to mitigate all possible variations of this type of attack. If a CSRF attack is performed with theContent-Type
header set totext/plain
, the protection will be circumvented and the request will be processed by the endpoint handler.Impact
If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts.
Remediation
SvelteKit 1.15.1 updates the
is_form_content_type
function call in the CSRF protection logic to includetext/plain
.As additional hardening of the CSRF protection mechanism against potential method overrides, SvelteKit 1.15.1 is now performing validation on PUT, PATCH and DELETE methods as well. This latter hardening is only needed to protect users who have put in some sort of
?_method=
override feature themselves in theirhandle
hook, so that the request thatresolve
sees could bePUT
/PATCH
/DELETE
when the browser issues aPOST
request.CVE-2023-29008
Summary
The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a
+server.js
file, containing endpoint handlers for different HTTP methods.SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. The protection is implemented at
kit/src/runtime/server/respond.js
. While the implementation does a sufficient job of mitigating common CSRF attacks, the protection can be bypassed by simply specifying an upper-casedContent-Type
header value. The browser will not send uppercase characters on form submission, but this check does not block all expected cross-site requests: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requestsDetails
The CSRF protection is implemented using the code shown below.
If the incoming request specifies a POST/PUT/PATCH/DELETE method, the protection will compare the server’s origin with the value of the HTTP Origin header. A mismatch between these values signals that a potential attack has been detected. The final check is performed on the request’s
Content-Type
header whether the value is eitherapplication/x-www-form-urlencoded
,multipart/form-data
ortext/plain
. If all the previous checks pass, the request will be rejected with an 403 error response.However,
is_form_content_type
, which is responsible for checking the value of theContent-Type
header, is not sufficient to mitigate all possible variations of this type of attack. Since this function is checkingContent-Type
with lower-cased values, and the browser accepts upper-casedContent-Type
header to be sent, a CSRF attack performed with theContent-Type
header that contains an upper-cased character (e.g.,text/plaiN
) can circumvent the protection and the request will be processed by the endpoint handler.Impact
If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts. This may lead to all POST operations requiring authentication being allowed in the following cases:
SameSite=None
on its auth cookie and the user visits a malicious site in a Chromium-based browserSameSite
attribute explicitly and the user visits a malicious site with Firefox/Safari with tracking protections turned off.Remediations
It is preferred to update to SvelteKit 1.15.2. It is also recommended to explicitly set
SameSite
to a value other thanNone
on authentication cookies especially if the upgrade cannot be done in a timely manner.Release Notes
sveltejs/kit
v1.15.2
Compare Source
Patch Changes
ba436c66
)v1.15.1
Compare Source
Patch Changes
fix: pin undici to 5.20.0 (#9591)
fix: address security advisory CVE-2023-29003 by including
text/plain
andPUT
/PATCH
/DELETE
requests in set of blocked cross-origin requests for CSRF protection (bb2253d5
)v1.15.0
Compare Source
Minor Changes
SubmitFunction
through./$types
(#9201)Patch Changes
fix: throw error when file can't be found in Vite manifest (#9558)
fix: make
error.message
enumerable when sendingssrLoadModule
error to client (#9440)fix: pass
publicDir
Vite config in SSR (#9565)fix: balance parentheses in error about wrong content type for action (#9513)
v1.14.0
Compare Source
Minor Changes
Patch Changes
submitter
type toSumbitFunction
(#9484)v1.13.0
Compare Source
Minor Changes
Patch Changes
v1.12.0
Compare Source
Minor Changes
feat: expose submitter in use:enhance SubmitFunction (#9425)
feat: add data-sveltekit-keepfocus and data-sveltekit-replacestate options to links (requires Svelte version 3.56 for type-checking with
svelte-check
) (#9019)Patch Changes
fix: don't start debugger on 404s (#9424)
fix: handle srcset attributes with newline after comma (#9388)
fix: allow tsconfig to extend multiple other tsconfigs (#9413)
chore: update Undici to 5.21.0 (#9417)
v1.11.0
Compare Source
Minor Changes
feat: pause on debugger when falling back to full page reload during development (#9305)
feat: expose
base
via$service-worker
, make paths relative (#9250)Patch Changes
fix: don't automatically prerender non-SSR'd pages (#9352)
fix: use 308 responses for trailing slash redirects, instead of 301s (#9351)
fix: remove buggy cookie path detection (#9298)
fix: don't prevent
beforeNavigate
callbacks from running following a cancelled unloading navigation (#9347)fix: persist DOM state on beforeunload (#9345)
fix: redirect to path with/without trailing slash when previewing prerendered pages (#9353)
fix: avoid FOUC when using CSS modules in dev (#9323)
fix: don't skip required parameters after missing optional parameters (#9331)
fix: account for server-emitted assets when prerenering (#9349)
fix: deal with fast consecutive promise resolutions when streaming (#9332)
chore: replace deprecated property access in preparation for TS 5.0 (#9361)
v1.10.0
Compare Source
Minor Changes
cookies.getAll
(#9287)Patch Changes
fix: always include
<link rel="stylesheet">
, even for stylesheets excluded from Link headers (#9255)fix: preserve form state when submitting a second time (#9267)
v1.9.3
Compare Source
Patch Changes
v1.9.2
Compare Source
Patch Changes
v1.9.1
Compare Source
Patch Changes
v1.9.0
Compare Source
Minor Changes
paths.relative
option to control interpretation ofpaths.assets
andpaths.base
(#9220)v1.8.8
Compare Source
Patch Changes
@sveltejs/kit
tonoExternal
for ssr build (#9242)api.methods
andpage.methods
tobuilder.routes
(#9145)v1.8.7
Compare Source
Patch Changes
paths.base
(#9232)v1.8.6
Compare Source
Patch Changes
v1.8.5
Compare Source
Patch Changes
handle
(#9198)v1.8.4
Compare Source
Patch Changes
fix: include .mjs files in precompression (#9179)
fix: revert mjs extension usage by default, make it an option (#9179)
chore: dummy changeset to force a release (#9207)
v1.8.3
Compare Source
Patch Changes
v1.8.2
Compare Source
Patch Changes
v1.8.1
Compare Source
Patch Changes
v1.8.0
Compare Source
Minor Changes
Patch Changes
fix: set public env before starting app (#8957)
fix: preload modules on Safari (#8957)
fix: make
assets
work in client when app is served from a subfolder (#8957)v1.7.2
Compare Source
Patch Changes
builder.writeClient()
(#9095)v1.7.1
Compare Source
Patch Changes
v1.7.0
Minor Changes
Patch Changes
v1.6.0
Minor Changes
OPTIONS
server method (#8731)Patch Changes
missing "./paths" specifier in "@​sveltejs/kit" package
error occurring in all projects (#9050)v1.5.7
Patch Changes
v1.5.6
Patch Changes
fix: ssr defaults preventing minification for client build (#9012)
fix: client-side trailing slash redirect when preloading data (#8982)
v1.5.5
Compare Source
Patch Changes
v1.5.3
Compare Source
Patch Changes
docs: clarify that
version.name
should be deterministic (#8956)fix: correctly include exported http methods in allow header (#8968)
chore: polyfill File from node:buffer (#8925)
fix: provide helpful error/warning when calling
fetch
during render (#8551)fix: print useful error when subscribing to SvelteKit's stores at the wrong time during SSR (#8960)
fix: ignore external links when automatically preloading (#8961)
chore: refactor fallback generation (#8972)
v1.5.2
Compare Source
Patch Changes
paths.assets
topaths.base
(#8928)v1.5.1
Compare Source
Patch Changes
fix: pick up config from endpoints (#8933)
fix: don't reuse previous server load cache when there's no server load function (#8893)
fix: deduplicate paths in tsconfig (#8880)
docs: clarify version management feature (#8941)
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.