Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: fix cookie vulnerability #1485

Merged
merged 1 commit into from
Nov 15, 2024
Merged

fix: fix cookie vulnerability #1485

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions packages/manager/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@
"@prismicio/types-internal": "^2.8.0",
"@segment/analytics-node": "^2.1.2",
"@slicemachine/plugin-kit": "workspace:*",
"cookie": "^0.5.0",
"cookie": "^1.0.1",
"cors": "^2.8.5",
"execa": "^7.1.1",
"file-type": "^18.2.1",
Expand All @@ -95,7 +95,6 @@
"@amplitude/experiment-node-server": "1.8.1",
"@prismicio/mock": "0.2.0",
"@size-limit/preset-small-lib": "8.2.4",
"@types/cookie": "0.5.1",
"@types/express": "4.17.17",
"@types/semver": "7.3.13",
"@typescript-eslint/eslint-plugin": "5.55.0",
Expand Down
19 changes: 12 additions & 7 deletions packages/manager/src/lib/serializeCookies.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ const COOKIE_SEPARATOR = "; ";

type Cookies = string | string[] | Record<string, string>;

const castParsedCookies = (cookies: Cookies): Record<string, string> => {
const castParsedCookies = (
cookies: Cookies,
): Record<string, string | undefined> => {
if (Array.isArray(cookies)) {
return cookie.parse(cookies.join(COOKIE_SEPARATOR));
} else if (typeof cookies === "string") {
Expand Down Expand Up @@ -33,12 +35,15 @@ export const serializeCookies = (
const items: string[] = [];

for (const name in cookiesToSerialize) {
items.push(
cookie.serialize(name, cookiesToSerialize[name], {
// Cookies need be stored raw (not encoded or escaped), so that consumers can format them the way they want them to be formatted.
encode: (cookie) => cookie,
}),
);
const cookieValue = cookiesToSerialize[name];
if (cookieValue) {
items.push(
cookie.serialize(name, cookieValue, {
// Cookies need be stored raw (not encoded or escaped), so that consumers can format them the way they want them to be formatted.
encode: (cookie) => cookie,
}),
);
}
}

return items.join(COOKIE_SEPARATOR);
Expand Down
2 changes: 1 addition & 1 deletion packages/manager/test/PrismicAuthManager-getAuthenticationCookies.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ it("returns parsed cookies from the auth state file", async (ctx) => {
const authenticationCookies =
await prismicAuthManager.getAuthenticationCookies();

expect(authenticationCookies).toStrictEqual({
expect(authenticationCookies).toEqual({
"prismic-auth": "token",
SESSION: "session",
});
Expand Down
2 changes: 1 addition & 1 deletion packages/manager/test/SliceMachineManager-user-getAuthenticationCookies.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ it("returns parsed cookies from the auth state file", async (ctx) => {

const authenticationCookies = await manager.user.getAuthenticationCookies();

expect(authenticationCookies).toStrictEqual({
expect(authenticationCookies).toEqual({
"prismic-auth": "token",
SESSION: "session",
});
Expand Down
18 changes: 5 additions & 13 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9235,13 +9235,12 @@ __metadata:
"@segment/analytics-node": ^2.1.2
"@size-limit/preset-small-lib": 8.2.4
"@slicemachine/plugin-kit": "workspace:*"
"@types/cookie": 0.5.1
"@types/express": 4.17.17
"@types/semver": 7.3.13
"@typescript-eslint/eslint-plugin": 5.55.0
"@typescript-eslint/parser": 5.55.0
"@vitest/coverage-v8": 0.32.0
cookie: ^0.5.0
cookie: ^1.0.1
cors: ^2.8.5
depcheck: 1.4.3
eslint: 8.37.0
Expand Down Expand Up @@ -11082,13 +11081,6 @@ __metadata:
languageName: node
linkType: hard

"@types/cookie@npm:0.5.1":
version: 0.5.1
resolution: "@types/cookie@npm:0.5.1"
checksum: 9a8d60fc84797122bc399d6bd330fe5780dc7aab032321de705049ea925339f74658bfa418de483a625d51858770efef58df633ff2e20f1bdf7fbd74a52847e2
languageName: node
linkType: hard

"@types/cookie@npm:^0.4.1":
version: 0.4.1
resolution: "@types/cookie@npm:0.4.1"
Expand Down Expand Up @@ -15880,10 +15872,10 @@ __metadata:
languageName: node
linkType: hard

"cookie@npm:^0.5.0":
version: 0.5.0
resolution: "cookie@npm:0.5.0"
checksum: 1f4bd2ca5765f8c9689a7e8954183f5332139eb72b6ff783d8947032ec1fdf43109852c178e21a953a30c0dd42257828185be01b49d1eb1a67fd054ca588a180
"cookie@npm:^1.0.1":
version: 1.0.1
resolution: "cookie@npm:1.0.1"
checksum: e2ff4879d816ea27dab69651c06d328b1f4214ccefa1023b6ebf85787bc23b3cad777ed51b4e54c01d161c374a05fc86e45e51ee3d9fafb48a836439c56b2458
languageName: node
linkType: hard

Expand Down
Loading