🚨 [security] [spec] Update send 0.16.2 → 0.19.0 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ send (0.16.2 → 0.19.0) · Repo · Changelog

Security Advisories 🚨

🚨 send vulnerable to template injection that can lead to XSS

Impact

passing untrusted user input - even after sanitizing it - to SendStream.redirect() may execute untrusted code

Patches

this issue is patched in send 0.19.0

Workarounds

users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist

Details

successful exploitation of this vector requires the following:

1. The attacker MUST control the input to response.redirect()
2. express MUST NOT redirect before the template appears
3. the browser MUST NOT complete redirection before:
4. the user MUST click on the link in the template

Release Notes

0.19.0

What's Changed

• Remove link renderization in html while redirecting (#235)

New Contributors

• @UlisesGascon made their first contribution in #235

Full Changelog: 0.18.0...0.19.0

0.18.0 (from changelog)

• Fix emitted 416 error missing headers property
• Limit the headers removed for 304 response
• deps: depd@2.0.0
  • Replace internal eval usage with Function constructor
  • Use instance methods on process to check for listeners
• deps: destroy@1.2.0
• deps: http-errors@2.0.0
  • deps: depd@2.0.0
  • deps: statuses@2.0.1
• deps: on-finished@2.4.1
• deps: statuses@2.0.1

0.17.2 (from changelog)

• pref: ignore empty http tokens
• deps: http-errors@1.8.1
  • deps: inherits@2.0.4
  • deps: toidentifier@1.0.1
  • deps: setprototypeof@1.2.0
• deps: ms@2.1.3

0.17.1 (from changelog)

• Set stricter CSP header in redirect & error responses
• deps: range-parser@~1.2.1

0.17.0 (from changelog)

• deps: http-errors@~1.7.2
  • Set constructor name when possible
  • Use toidentifier module to make class names
  • deps: depd@~1.1.2
  • deps: setprototypeof@1.1.1
  • deps: statuses@'>= 1.5.0 < 2'
• deps: mime@1.6.0
  • Add extensions for JPEG-2000 images
  • Add new font/* types from IANA
  • Add WASM mapping
  • Update .bdoc to application/bdoc
  • Update .bmp to image/bmp
  • Update .m4a to audio/mp4
  • Update .rtf to application/rtf
  • Update .wav to audio/wav
  • Update .xml to application/xml
  • Update generic extensions to application/octet-stream: .deb, .dll, .dmg, .exe, .iso, .msi
  • Use mime-score module to resolve extension conflicts
• deps: ms@2.1.1
  • Add week/w support
  • Fix negative number handling
• deps: statuses@~1.5.0
• perf: remove redundant path.normalize call

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)