[Snyk] Upgrade jsdom from 9.12.0 to 24.1.1 #2
Conversation
Snyk has created this PR to upgrade jsdom from 9.12.0 to 24.1.1. See this package in npm: jsdom See this project in Snyk: https://app.snyk.io/org/jhaycefrancis/project/ed5a331b-d73e-4b6c-b0a5-cb2f213155dd?utm_source=github&utm_medium=referral&page=upgrade-pr
|
Lack of Resources and Rate Limiting
DescriptionWhilst the internet may often seem as though it were boundless, it is still bound by a finite amount of computing resources and subject to limitations, with only so much bandwidth, CPU processing power, memory allocation, and storage to go around. At the individual level, for example, think of the last time you tried to spin up that third virtual machine while the host browser was feverishly feeding your multiple open tab habit... resource limitations in action! And although this illustration depicts a non-malicious - indeed, self-imposed - consequence of overload for an individual laptop, there are, unfortunately, attacks that leverage resource and rate limitations of web applications and APIs that have not been configured correctly. Application requests are pretty much what make the internet the internet, with some estimates suggesting that API requests alone make up over 83% of all web traffic. Applications perform day-to-day functions adequately when the request parameters governing the numbers of processes, size of payloads, etc., are set at the appropriate minimums and maximums. However, when the aforementioned resources are incorrectly assigned, applications are not only subject to poor or non-existent performance, but they can also be commandeered by malicious actors to disrupt and deny service. According to OWASP's API4:2019 Lack of Resources & Rate Limiting post, APIs, for example, are vulnerable if even just one of the below limits is lacking or incorrectly set:
Bottom line: set one of the above too low or too high, and your application is at risk. Read moreImpactWhatever the type of application, inadequately configured resource allocation, and rate limits are routinely targeted by attackers. Attacks such as these undermine reliability and availability of entire ecosystems, inevitably resulting in financial and reputational loss. ScenariosSuppose an API is tasked with the retrieval of user-profiles and their corresponding details, providing, as most APIs do, access to its resources that take the form of lists of entities. A set limit of returnable items would typically confine a client filtering this list.
An astute observer will have noticed that the request here would return page 1 and the first 9000000 users, which certainly seems like an above-average number of users for just one page! This attack would succeed to overwhelm the API if the size parameter was improperly validated. PreventionAttacks targeting application misconfigurations that allow unbridled resources and limits are common - the exploitation is uncomplicated and requires minimal resources to execute. Fortunately, robust defense is reasonably straightforward to implement so long as attention is paid to limits that dictate finite resources, i.e., the abovementioned CPU processing power, memory allocation, number of processes and file descriptors, etc. Prevention strategies include:
TestingVerify that anti-automation controls are effective at mitigating breached credential testing, brute force, and account lockout attacks. Such controls include blocking the most common breached passwords, soft lockouts, rate limiting, CAPTCHA, ever-increasing delays between attempts, IP address restrictions, or risk-based restrictions such as location, first login on a device, recent attempts to unlock the account, or similar.
ReferencesAkamai - State of Internet Security |
Micro-Learning Topic: Regular expression denial of service (Detected by phrase)Matched on "Regular Expression Denial of Service"Denial of Service (DoS) attacks caused by Regular Expression which causes the system to hang or cause them to work very slowly when attacker sends a well-crafted input(exponentially related to input size).Denial of service attacks significantly degrade the service quality experienced by legitimate users. These attacks introduce large response delays, excessive losses, and service interruptions, resulting in direct impact on availability. Try a challenge in Secure Code WarriorMicro-Learning Topic: Denial of service (Detected by phrase)Matched on "Denial of Service"The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. Source: https://www.owasp.org/index.php/Denial_of_Service Try a challenge in Secure Code WarriorMicro-Learning Topic: Prototype pollution (Detected by phrase)Matched on "Prototype Pollution"By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Try a challenge in Secure Code WarriorMicro-Learning Topic: Server-side request forgery (Detected by phrase)Matched on "Server-side Request Forgery"Server-Side Request Forgery (SSRF) vulnerabilities are caused when an attacker can supply or modify a URL that reads or sends data to the server. The attacker can create a malicious request with a manipulated URL, when this request reaches the server, the server-side code executes the exploit URL causing the attacker to be able to read data from services that shouldn't be exposed. Try a challenge in Secure Code Warrior |
JhayceFrancis
deleted the
snyk-upgrade-969916c8f1ae4c86dcaa37e2c6b14770
branch
Snyk has created this PR to upgrade jsdom from 9.12.0 to 24.1.1.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 67 versions ahead of your current version.
The recommended version was released on 2 months ago.
Issues fixed by the recommended upgrade:
SNYK-JS-REQUEST-3361831
SNYK-JS-TOUGHCOOKIE-5672873
npm:content-type-parser:20170905
Release notes
Package name: jsdom
-
24.1.1 - 2024-07-21
- Fixed selection methods to trigger the
-
24.1.0 - 2024-05-26
- Added the
- Fixed the creation and parsing of elements with names from
- Updated
-
24.0.0 - 2024-01-21
- Small fixes to edge-case behavior of the following properties:
-
23.2.0 - 2024-01-07
-
23.1.0 - 2024-01-05
- Added an initial implementation of
- Added the string-valued ARIA attribute-reflecting properties to
- Fixed
- Fixed the
- Updated various dependencies, including
-
23.0.1 - 2023-11-30
- Fixed the incorrect
-
23.0.0 - 2023-11-26
- Node.js v18 is now the minimum supported version.
- Updated various dependencies, including
-
22.1.0 - 2023-05-27
-
22.0.0 - 2023-05-02
-
21.1.2 - 2023-05-01
-
21.1.1 - 2023-03-12
-
21.1.0 - 2023-01-22
-
21.0.0 - 2023-01-07
-
20.0.3 - 2022-11-20
-
20.0.2 - 2022-10-30
-
20.0.1 - 2022-10-02
-
20.0.0 - 2022-06-19
-
19.0.0 - 2021-12-02
-
18.1.1 - 2021-11-21
-
18.1.0 - 2021-11-12
-
18.0.1 - 2021-11-01
-
18.0.0 - 2021-10-08
-
17.0.0 - 2021-08-13
-
16.7.0 - 2021-08-01
-
16.6.0 - 2021-05-23
-
16.5.3 - 2021-04-11
-
16.5.2 - 2021-03-28
-
16.5.1 - 2021-03-13
-
16.5.0 - 2021-03-07
-
16.4.0 - 2020-08-08
-
16.3.0 - 2020-07-10
-
16.2.2 - 2020-03-30
-
16.2.1 - 2020-03-09
-
16.2.0 - 2020-02-16
-
16.1.0 - 2020-02-01
-
16.0.1 - 2020-01-20
-
16.0.0 - 2020-01-13
-
15.2.1 - 2019-11-04
-
15.2.0 - 2019-10-14
-
15.1.1 - 2019-05-28
-
15.1.0 - 2019-05-12
-
15.0.0 - 2019-04-21
-
14.1.0 - 2019-04-21
-
14.0.0 - 2019-03-10
-
13.2.0 - 2019-01-24
-
13.1.0 - 2018-12-15
-
13.0.0 - 2018-10-29
-
12.2.0 - 2018-10-08
-
12.1.0 - 2018-09-30
-
12.0.0 - 2018-08-19
-
11.12.0 - 2018-07-27
-
11.11.0 - 2018-05-23
-
11.10.0 - 2018-04-30
-
11.9.0 - 2018-04-23
-
11.8.0 - 2018-04-16
-
11.7.0 - 2018-04-01
-
11.6.2 - 2018-01-30
-
11.6.1 - 2018-01-25
-
11.6.0 - 2018-01-22
-
11.5.1 - 2017-11-26
-
11.4.0 - 2017-11-19
-
11.3.0 - 2017-09-30
-
11.2.0 - 2017-08-21
-
11.1.0 - 2017-07-03
-
11.0.0 - 2017-05-21
-
10.1.0 - 2017-05-01
-
10.0.0 - 2017-04-24
-
9.12.0 - 2017-03-12
from jsdom GitHub release notesselectionchangeevent on theDocumentobject. (piotr-oles)getSetCookie()method to theHeadersclass. (ushiboy)Object.prototype, like"constructor"or"toString".rweb-cssom, which can now parse additional CSS constructs.This release reverts our selector engine back to
nwsapi. As discussed in #3659, the performance regressions from@ asamuzakjp/dom-selectorturned out to be higher than anticipated. In the future, we can revisit@ asamuzakjp/dom-selectorafter it reachesnwsapi's performance on the two real-world benchmarks provided by the community.Since reverting to
nwsapicauses several functionality regressions, e.g. removing:has()support, we've decided to make this a major version.Additionally:
input.maxLength,input.minLength,input.size,progress.max,tableCell.colSpan,tableCell.rowSpan,tableCol.span,textArea.cols,textArea.maxLength,textArea.minLength,textArea.rows.This release switches our CSS selector engine from
nwsapito@ asamuzakjp/dom-selector. The new engine is more actively maintained, and supports many new selectors: see the package's documentation for the full list. It also works better with shadow trees.There is a potential of a performance regression due to this change. In our stress test benchmark, which runs most of these 273 selectors against this 128 KiB document, the new engine completes the benchmark only 0.25x as fast. However, we're hopeful that in more moderate usage this will not be a significant issue. Any help speeding up
@ asamuzakjp/dom-selectoris appreciated, and feel free to open an issue if this has had a significant impact on your project.ElementInternals, including theshadowRootgetter and the string-valued ARIA properties. (zjffun)Element.history.pushState()andhistory.replaceState()to follow the latest specification, notably with regards to how they handle empty string inputs and what new URLs are possible.input.valueAsANumbersetter to handleNaNcorrectly. (alexandertrefz)cssstylewhich contains several bug fixes.canvaspeer dependency introduced in v23.0.0.whatwg-urlwhich integrates various additions to theURLandURLSearchParamsobjects.Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: