Update node-fetch dependency #141
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I will investigate this one and come back to you.
…On Mon, Apr 4, 2022 at 3:29 PM Michael Beckemeyer ***@***.***> wrote:
Hello,
my team noticed that node-expose-sspi is currently (indirectly) affected
by CVE-2022-0235 <https://nvd.nist.gov/vuln/detail/CVE-2022-0235>. The
reason for that is the pinned dependency on an older version of node-fetch
("3.0.0-beta.9").
My guess is that the old version of node-fetch is being used because it
is the last version that can still be imported as a CommonJS module.
Later versions are published as ESM which is problematic for CommonJS
clients.
This PR updates node-fetch and integrates it using the following approach:
1. Use import type where only type declarations are required
2. Using an ugly workaround to asynchronously import the fetch
function (see loadNodeFetch.ts). Essentially, eval is used via new
Function(...) to stop the TypeScript compiler from replacing an
asynchronous import(...) expression.
Unfortunately I am unable to run all tests right now.
My main development setup is running Linux and my Windows VM is not part
of an domain, making testing the server side code rather difficult.
I was able to test the client side SSO flow manually: it appears to work
well.
------------------------------
You can view, comment on, or merge this pull request online at:
#141
Commit Summary
- 4ea175d
<4ea175d>
Update node fetch and load it using a workaround
File Changes
(8 files <https://github.com/jlguenego/node-expose-sspi/pull/141/files>)
- *M* package-lock.json
<https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-053150b640a7ce75eff69d1a22cae7f0f94ad64ce9a855db544dda0929316519>
(74)
- *M* package.json
<https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519>
(3)
- *M* src/sso/client/AbstractHandler.ts
<https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-128296bcece02f590ffd4cb4e2c878c3bcdb3a73c85bcef706f7ec7e97d870ee>
(2)
- *M* src/sso/client/BasicHandler.ts
<https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-69b37a3e40e5bbb3a399b2040ec4cfe63ebbb7a83ed9752d4f0e0555ce675160>
(4)
- *M* src/sso/client/ClientCookie.ts
<https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-b764c4fb31b99578660eb38759bd52b03564126cec5786868007307d11de0490>
(2)
- *M* src/sso/client/DigestHandler.ts
<https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-464677d18972e0b35b1ed518110f5c29c2a5f0e04da1784522071608a3da507d>
(10)
- *M* src/sso/client/NegotiateHandler.ts
<https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-abdeeacb64efe26bf8fbd6c0973e07b7375a9b836795fdf00065306cf9f9f153>
(4)
- *A* src/sso/loadNodeFetch.ts
<https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-7d79a88eab22bdc6e85f50d9677f92b6e416debbeaf1b05656b86209bc9f0ed2>
(29)
Patch Links:
- https://github.com/jlguenego/node-expose-sspi/pull/141.patch
- https://github.com/jlguenego/node-expose-sspi/pull/141.diff
—
Reply to this email directly, view it on GitHub
<#141>, or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAVV6TWHK5U3HLHPHNPD6Z3VDLVE3ANCNFSM5SPRJWKQ>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
--
Jean-Louis GUENEGO
Tel : +33 6 12 19 81 48
mail: ***@***.***
|
|
Hello, When I use sso Client |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello,
my team noticed that
node-expose-sspiis currently (indirectly) affected by CVE-2022-0235. The reason for that is the pinned dependency on an older version ofnode-fetch("3.0.0-beta.9").My guess is that the old version of
node-fetchis being used because it is the last version that can still be imported as a CommonJS module.Later versions are published as ESM which is problematic for CommonJS clients.
This PR updates node-fetch and integrates it using the following approach:
import typewhere only type declarations are requiredfetchfunction (seeloadNodeFetch.ts). Essentially,evalis used vianew Function(...)to stop the TypeScript compiler from replacing an asynchronousimport(...)expression.Unfortunately I am unable to run all tests right now.
My main development setup is running Linux and my Windows VM is not part of an domain, making testing the server side code rather difficult.
I was able to test the client side SSO flow manually: it appears to work well.