Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(kitsu): update dependency axios to v0.28.1 to address CVE-2023-45857 #964

Merged
merged 1 commit into from
Mar 30, 2024

Conversation

justin-tay
Copy link
Contributor

@justin-tay justin-tay commented Feb 21, 2024

Closes #978

This bumps axios to 0.28.1 due to Axios Cross-Site Request Forgery Vulnerability.
The size-limit needed to be adjusted from 13 kb to 14 kb
The paramsSerializer configuration needs to be an object with serialize set to the function.

@justin-tay justin-tay marked this pull request as draft February 27, 2024 03:11
@justin-tay justin-tay force-pushed the axios028_master branch 4 times, most recently from 2485367 to bf41b9e Compare February 27, 2024 07:49
@justin-tay justin-tay marked this pull request as ready for review February 27, 2024 07:51
@justin-tay justin-tay marked this pull request as draft February 27, 2024 10:35
@wopian
Copy link
Owner

wopian commented Feb 27, 2024

We might be able to remove this duplication by setting it in the axios.create object definition and avoid adding a utility function to the constructor

@wopian wopian self-requested a review February 27, 2024 22:32
@wopian wopian changed the title build(kitsu)(deps): update dependency axios to v0.28.0 security(kitsu)(deps): update dependency axios to v0.28.0 Feb 27, 2024
@wopian wopian self-assigned this Feb 27, 2024
@wopian wopian added dependencies security fix Security fix generated by WhiteSource labels Feb 27, 2024
@justin-tay
Copy link
Contributor Author

After looking at it more closely it looks like axios 0.28.0 has a regression and isn't respecting config if paramsSerializer is a function.

@wopian
Copy link
Owner

wopian commented Feb 28, 2024

I've subscribed to that issue, will likely leave this PR open until that backporting issue is resolved to avoid a potentially breaking change in serialisation when upgrading to the 0.28 major.

@wopian
Copy link
Owner

wopian commented Mar 14, 2024

Unfortunately doesn't seem like there's been any progress on that upstream issue yet :(

Copy link

codeclimate bot commented Mar 29, 2024

Code Climate has analyzed commit 9b72793 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (100% is the threshold).

This pull request will bring the total coverage in the repository to 100.0% (0.0% change).

View more on Code Climate.

@justin-tay justin-tay changed the title security(kitsu)(deps): update dependency axios to v0.28.0 security(kitsu)(deps): update dependency axios to v0.28.1 Mar 29, 2024
@wopian
Copy link
Owner

wopian commented Mar 29, 2024

Is this ready for review @justin-tay?

@justin-tay justin-tay marked this pull request as ready for review March 30, 2024 00:47
@justin-tay
Copy link
Contributor Author

Is this ready for review @justin-tay?

This is now ready for review. Thanks!

@wopian wopian changed the title security(kitsu)(deps): update dependency axios to v0.28.1 fix(kitsu): update dependency axios to v0.28.1 to address CVE-2023-45857 Mar 30, 2024
@wopian wopian merged commit ac23118 into wopian:master Mar 30, 2024
11 of 12 checks passed
@wopian
Copy link
Owner

wopian commented Mar 30, 2024

Released as 10.1.5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies security fix Security fix generated by WhiteSource
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants