[Snyk] Upgrade @nextcloud/files from 3.2.1 to 3.5.1

[JhayceFrancis]

Snyk has created this PR to upgrade @nextcloud/files from 3.2.1 to 3.5.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 6 versions ahead of your current version.

• The recommended version was released on 2 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-FASTXMLPARSER-7573289	49	No Known Exploit

Release notes

Package name: @nextcloud/files

• 3.5.1 - 2024-06-20
  

  3.5.1 - 2024-06-20

  Full Changelog: v3.5.0...v3.5.1

  Fixed

  • fix davResultToNode on public shares (#993)
  • fix: make davRootPath and davRemoteURL support public shares (#996)
  • fix(dav): Add displayname and creationdate to default props (#991)
  • fix(sorting): The display name attribute is called displayname not displayName for DAV (#992)

  Changed

  • chore(deps-dev): Bump ws from 8.17.0 to 8.17.1
  • chore: Update development dependencies
• 3.5.0 - 2024-06-17
  

  3.5.0 - 2024-06-17

  Full Changelog: v3.4.1...v3.5.0

  Added

  • feat: Add filename util getUniqueName to generate a unique name (#986)
  • feat: Export public interfaces of Node, File and Folder (#976)
  • feat(navigation): Allow to listen for active navigation changes (#987)

  Fixed

  • fix(dav): Set status in davResultToNode when fileid is negative (#985)
  • fix: When sorting by filename the extension should only be considered if the basename is equal (#984)

  Changed

  • Add SPDX headers (#980)
  • Updated development dependencies
• 3.4.1 - 2024-06-07
  

  3.4.1 - 2024-06-05

  Full Changelog: v3.4.0...v3.4.1

  Fixed

  • fix(node): remove auto mtime update on attributes change and allow mtime set by @ skjnldsv in #974

  Changed

  • chore(deps-dev): Bump vite from 5.2.11 to 5.2.12 by @ dependabot in #971
  • chore(deps-dev): Bump @ types/node from 20.12.12 to 20.13.0 by @ dependabot in #970
  • chore(deps-dev): Bump jsdom from 24.0.0 to 24.1.0 by @ dependabot in #972
• 3.4.0 - 2024-05-30
  

  3.4.0 - 2024-05-29

  Full Changelog: v3.3.1...v3.4.0

  Added

  • feat: Add sortNodes and generic orderBy by @ susnux in #961

  Fixed

  • fix(Node): Do not drop readonly attributes but only forbid updating them by @ susnux in #967

  Changed

  • chore(deps-dev): Bump @ codecov/vite-plugin from 0.0.1-beta.6 to 0.0.1-beta.8 by @ dependabot in #965
  • chore(deps-dev): Bump fast-xml-parser from 4.3.6 to 4.4.0 by @ dependabot in #966
• 3.3.1 - 2024-05-22
  

  What's Changed

  • fix: Export NewMenuEntryCategory from package by @ susnux in #960
  • chore: Prepare 3.3.1 by @ susnux in #962

  Full Changelog: v3.3.0...v3.3.1

• 3.3.0 - 2024-05-22
  

  3.3.0 - 2024-05-21

  Changed

  • feat: Add and export isFilenameValid function by @ susnux in #951
  • feat(ci): add codecov bundler by @ skjnldsv in #948
  • feat(files): allow updating attributes by @ skjnldsv in #947
  • feat(new-menu): Allow to set the category for entries by @ susnux in #952

  Fixed

  • fix: Update workflows from organization by @ susnux in #932
  • fix(fileAction): cover parent getter in tests by @ skjnldsv in #950
  • fix(navigation): files import by @ skjnldsv in #949
  • fix(dav): Add fallback for owner of dav nodes on public shares by @ susnux in #959

  Dependencies

  • chore(deps): Bump @ nextcloud/auth from 2.2.1 to 2.3.0 by @ dependabot
  • chore(deps): Bump @ nextcloud/l10n from 2.2.0 to 3.1.0 by @ dependabot
  • chore(deps): Bump @ nextcloud/logger from 2.7.0 to 3.0.2 by @ dependabot
  • chore(deps): Bump @ nextcloud/router from 3.0.0 to 3.0.1 by @ dependabot
  • chore(deps): Bump is-svg from 5.0.0 to 5.0.1 by @ dependabot
  • chore(deps): Bump webdav from 5.5.0 to 5.6.0 by @ dependabot

  Full Changelog: v3.2.1...v3.3.0

• 3.2.1 - 2024-04-22
  

  3.2.1 - 2024-04-22

  Changed

  • fix: Update NPM version to LTS version 10
  • Updated development dependencies

from @nextcloud/files GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[secureflag-knowledge-base]

Lack of Resources and Rate Limiting

Play Labs on this vulnerability with SecureFlag!

Description

Whilst the internet may often seem as though it were boundless, it is still bound by a finite amount of computing resources and subject to limitations, with only so much bandwidth, CPU processing power, memory allocation, and storage to go around. At the individual level, for example, think of the last time you tried to spin up that third virtual machine while the host browser was feverishly feeding your multiple open tab habit... resource limitations in action! And although this illustration depicts a non-malicious - indeed, self-imposed - consequence of overload for an individual laptop, there are, unfortunately, attacks that leverage resource and rate limitations of web applications and APIs that have not been configured correctly.

Application requests are pretty much what make the internet the internet, with some estimates suggesting that API requests alone make up over 83% of all web traffic. Applications perform day-to-day functions adequately when the request parameters governing the numbers of processes, size of payloads, etc., are set at the appropriate minimums and maximums. However, when the aforementioned resources are incorrectly assigned, applications are not only subject to poor or non-existent performance, but they can also be commandeered by malicious actors to disrupt and deny service.

According to OWASP's API4:2019 Lack of Resources & Rate Limiting post, APIs, for example, are vulnerable if even just one of the below limits is lacking or incorrectly set:

• Execution timeouts: the API gateway will wait a certain number of seconds for the endpoint to return a response... this value can be anywhere from 1 second to many years' worth of seconds, so it is important to define correctly.
• Max allocable memory: the maximum amount of memory allocated to the API.
• Number of file descriptors: the more files opened for your process, the more labor-intensive.
• Number of processes: the more processes, the more labor-intensive.
• Request payload size (e.g., uploads): the larger the upload, the greater the consumption.
• Number of requests per client/resource: this could be 100 requests per 100 seconds per user but also 1000 requests per 100 seconds per user - 10X the load.
• Number of records per page to return in a single request-response: stuffing more records into a single response will naturally degrade performance.

Bottom line: set one of the above too low or too high, and your application is at risk.

Read more

Impact

Whatever the type of application, inadequately configured resource allocation, and rate limits are routinely targeted by attackers. Attacks such as these undermine reliability and availability of entire ecosystems, inevitably resulting in financial and reputational loss.

Scenarios

Suppose an API is tasked with the retrieval of user-profiles and their corresponding details, providing, as most APIs do, access to its resources that take the form of lists of entities. A set limit of returnable items would typically confine a client filtering this list.

www.vulnerableapp.com/api/v1/get_user_list?page=1&size=9000000

An astute observer will have noticed that the request here would return page 1 and the first 9000000 users, which certainly seems like an above-average number of users for just one page! This attack would succeed to overwhelm the API if the size parameter was improperly validated.

Prevention

Attacks targeting application misconfigurations that allow unbridled resources and limits are common - the exploitation is uncomplicated and requires minimal resources to execute. Fortunately, robust defense is reasonably straightforward to implement so long as attention is paid to limits that dictate finite resources, i.e., the abovementioned CPU processing power, memory allocation, number of processes and file descriptors, etc.

Prevention strategies include:

• Limiting the number of times a client can call an application within a given timeframe.
• Setting limit numbers and reset times and communicating them with the client.
• Ensuring query strings and request body parameters are properly validated by the server.
• Place a limit on the data size of incoming parameters and payloads.
• For any application, adhere to best practices laid out in the configuration guidelines. For example, APIs moored in the overwhelmingly popular Docker need only review and adequately implement appropriate configurations for memory resources, CPU, restart policies, and container ulimits (limits for file descriptors and processes).

Testing

Verify that anti-automation controls are effective at mitigating breached credential testing, brute force, and account lockout attacks. Such controls include blocking the most common breached passwords, soft lockouts, rate limiting, CAPTCHA, ever-increasing delays between attempts, IP address restrictions, or risk-based restrictions such as location, first login on a device, recent attempts to unlock the account, or similar.

• OWASP ASVS: 2.2.1
• OWASP Testing Guide: Testing for Weak Lock Out Mechanism

References

Akamai - State of Internet Security

OWASP - API-Security

CloudVector - OWASP API Security

View this in the SecureFlag Knowledge Base

[secure-code-warrior-for-github]

Micro-Learning Topic: Regular expression denial of service (Detected by phrase)

Matched on "Regular Expression Denial of Service"

What is this? (2min video)

Denial of Service (DoS) attacks caused by Regular Expression which causes the system to hang or cause them to work very slowly when attacker sends a well-crafted input(exponentially related to input size).Denial of service attacks significantly degrade the service quality experienced by legitimate users. These attacks introduce large response delays, excessive losses, and service interruptions, resulting in direct impact on availability.

Try a challenge in Secure Code Warrior

Micro-Learning Topic: Denial of service (Detected by phrase)

Matched on "Denial of Service"

The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. Source: https://www.owasp.org/index.php/Denial_of_Service

Try a challenge in Secure Code Warrior