From dffefafcbde30a4054d4ca2c525bd0b0eb302047 Mon Sep 17 00:00:00 2001 From: "fengzhihao.infeng" Date: Wed, 9 Sep 2026 21:01:20 +0800 Subject: [PATCH] fix(deps): secure legacy request multipart boundaries --- .github/workflows/ci.yml | 3 ++ AGENTS.md | 7 +++ package-lock.json | 78 ++++++++++++++++----------------- package.json | 8 +++- scripts/check-multipart.js | 90 ++++++++++++++++++++++++++++++++++++++ 5 files changed, 146 insertions(+), 40 deletions(-) create mode 100644 scripts/check-multipart.js diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 35a5a2bc..23fb34aa 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -48,6 +48,9 @@ jobs: - name: Test run: npm test -- --runInBand + - name: Check multipart dependency + run: npm run check:multipart + - name: Lint run: npm run lint diff --git a/AGENTS.md b/AGENTS.md index 48e2ceee..e195ce7e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -71,6 +71,13 @@ Pages. After each release, wait for the Pages workflow and verify ## Change discipline +- The legacy development-only `request` dependency pins vulnerable `form-data` + 2.3.x. The scoped npm override selects 2.5.6 to fix predictable multipart + boundaries (GHSA-fjxv-7rqg-78g4) and the follow-up boundary advisory + GHSA-hmw2-7cc7-3qxx. `npm run check:multipart` verifies boundary generation + and a real local text/binary upload through `request`; it runs in `verify` + and CI. Keep the override until the parent dependency is retired or accepts + a patched version itself. - Add a regression test for every bug fix when practical. - Keep unrelated dependency upgrades and behavior changes in separate pull requests. - Preserve the public API unless the change is intentionally versioned as breaking. diff --git a/package-lock.json b/package-lock.json index bb4dd7d5..f19fd4ec 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3585,9 +3585,9 @@ "dev": true }, "combined-stream": { - "version": "1.0.6", - "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.6.tgz", - "integrity": "sha1-cj599ugBrFYTETp+RFqbactjKBg=", + "version": "1.0.8", + "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz", + "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==", "dev": true, "requires": { "delayed-stream": "~1.0.0" @@ -3633,14 +3633,6 @@ "dev": true, "requires": { "mime-db": ">= 1.40.0 < 2" - }, - "dependencies": { - "mime-db": { - "version": "1.42.0", - "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.42.0.tgz", - "integrity": "sha512-UbfJCR4UAVRNgMpfImz05smAXK7+c+ZntjaA26ANtkXLlOe947Aag5zdIcKQULAiF9Cq4WxBi9jUs5zkA84bYQ==", - "dev": true - } } }, "compression": { @@ -4791,6 +4783,18 @@ "es-errors": "^1.3.0" } }, + "es-set-tostringtag": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz", + "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==", + "dev": true, + "requires": { + "es-errors": "^1.3.0", + "get-intrinsic": "^1.2.6", + "has-tostringtag": "^1.0.2", + "hasown": "^2.0.2" + } + }, "es-to-primitive": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/es-to-primitive/-/es-to-primitive-1.1.1.tgz", @@ -5260,21 +5264,6 @@ "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==", "dev": true }, - "mime-db": { - "version": "1.52.0", - "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz", - "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==", - "dev": true - }, - "mime-types": { - "version": "2.1.35", - "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz", - "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==", - "dev": true, - "requires": { - "mime-db": "1.52.0" - } - }, "negotiator": { "version": "0.6.3", "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz", @@ -5744,14 +5733,25 @@ "dev": true }, "form-data": { - "version": "2.3.3", - "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.3.3.tgz", - "integrity": "sha512-1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==", + "version": "2.5.6", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.6.tgz", + "integrity": "sha512-Ogz/E85h9tlfJzpI6TuFpGcHZFhLrb9Gw8wq9v40CxSCPnv7ahKr6Xgtkn0KYCDQJ8DNn5VoMO8EXr9V5PadyA==", "dev": true, "requires": { "asynckit": "^0.4.0", - "combined-stream": "^1.0.6", - "mime-types": "^2.1.12" + "combined-stream": "^1.0.8", + "es-set-tostringtag": "^2.1.0", + "hasown": "^2.0.4", + "mime-types": "^2.1.35", + "safe-buffer": "^5.2.1" + }, + "dependencies": { + "safe-buffer": { + "version": "5.2.1", + "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz", + "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==", + "dev": true + } } }, "fragment-cache": { @@ -8440,18 +8440,18 @@ "dev": true }, "mime-db": { - "version": "1.35.0", - "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.35.0.tgz", - "integrity": "sha512-JWT/IcCTsB0Io3AhWUMjRqucrHSPsSf2xKLaRldJVULioggvkJvggZ3VXNNSRkCddE6D+BUI4HEIZIA2OjwIvg==", + "version": "1.52.0", + "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz", + "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==", "dev": true }, "mime-types": { - "version": "2.1.19", - "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.19.tgz", - "integrity": "sha512-P1tKYHVSZ6uFo26mtnve4HQFE3koh1UWVkp8YUC+ESBHe945xWSoXuHHiGarDqcEZ+whpCDnlNw5LON0kLo+sw==", + "version": "2.1.35", + "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz", + "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==", "dev": true, "requires": { - "mime-db": "~1.35.0" + "mime-db": "1.52.0" } }, "mini-css-extract-plugin": { @@ -11003,7 +11003,7 @@ "combined-stream": "~1.0.6", "extend": "~3.0.2", "forever-agent": "~0.6.1", - "form-data": "~2.3.2", + "form-data": "2.5.6", "har-validator": "~5.1.0", "http-signature": "~1.2.0", "is-typedarray": "~1.0.0", diff --git a/package.json b/package.json index a8581eb1..e84c47fb 100644 --- a/package.json +++ b/package.json @@ -12,9 +12,10 @@ "build:ssr": "npm --prefix ssr-test ci --ignore-scripts && npm --prefix ssr-test run build", "check:ssr-hydration": "node scripts/check-ssr-hydration.js", "check:package-export": "node scripts/check-package-export.js", + "check:multipart": "node scripts/check-multipart.js", "build:analyze": "ANALYZE=true webpack --config webpack.config.prop.js", "doc": "webpack --config webpack.config.doc.js", - "verify": "npm test -- --runInBand && npm run lint && npm run build && npm run check:package-export && npm run doc && npm run build:ssr && npm run check:ssr-hydration && npm pack --dry-run", + "verify": "npm test -- --runInBand && npm run lint && npm run build && npm run check:package-export && npm run doc && npm run build:ssr && npm run check:ssr-hydration && npm run check:multipart && npm pack --dry-run", "pub": "npm publish", "prepublishOnly": "npm run build" }, @@ -91,6 +92,11 @@ "webpack-dev-server": "^3.8.2", "wolfy87-eventemitter": "^5.2.5" }, + "overrides": { + "request": { + "form-data": "2.5.6" + } + }, "dependencies": { "classnames": "^2.2.5" }, diff --git a/scripts/check-multipart.js b/scripts/check-multipart.js new file mode 100644 index 00000000..db8ede25 --- /dev/null +++ b/scripts/check-multipart.js @@ -0,0 +1,90 @@ +const assert = require('assert'); +const http = require('http'); +const { createRequire } = require('module'); +const request = require('request'); +const requireFromRequest = createRequire(require.resolve('request')); +const FormData = requireFromRequest('form-data'); + +async function verifyMultipart() { + // The retired request package pins an older form-data minor. Check that its + // security override uses independent boundaries even with predictable PRNG. + const random = Math.random; + try { + Math.random = () => 0.5; + assert.notStrictEqual( + new FormData().getBoundary(), + new FormData().getBoundary(), + 'Multipart boundaries must not depend on Math.random' + ); + } finally { + Math.random = random; + } + + const payload = Buffer.from([0, 1, 2, 255]); + let uploadError; + let received = false; + const server = http.createServer((req, res) => { + const chunks = []; + req.on('data', chunk => chunks.push(chunk)); + req.on('end', () => { + try { + const body = Buffer.concat(chunks); + const contentType = req.headers['content-type']; + assert(contentType.startsWith('multipart/form-data; boundary=')); + const boundary = contentType.slice(contentType.indexOf('boundary=') + 9); + assert(body.includes(Buffer.from('--' + boundary + '\r\n'))); + assert(body.includes(Buffer.from('name="caption"\r\n\r\nreact-viewer\r\n'))); + assert(body.includes(Buffer.from('name="image"; filename="sample.bin"'))); + assert(body.includes(Buffer.from('Content-Type: application/octet-stream'))); + assert(body.includes(payload)); + assert(body.toString('latin1').endsWith('--' + boundary + '--\r\n')); + assert.strictEqual(Number(req.headers['content-length']), body.length); + received = true; + res.end('ok'); + } catch (error) { + uploadError = error; + res.statusCode = 400; + res.end('invalid multipart upload'); + } + }); + }); + + try { + await new Promise((resolve, reject) => { + server.once('error', reject); + server.listen(0, '127.0.0.1', resolve); + }); + await new Promise((resolve, reject) => { + request.post({ + url: 'http://127.0.0.1:' + server.address().port, + timeout: 5000, + formData: { + caption: 'react-viewer', + image: { + value: payload, + options: { filename: 'sample.bin', contentType: 'application/octet-stream' }, + }, + }, + }, (error, response, body) => { + if (error || uploadError) return reject(error || uploadError); + try { + assert.strictEqual(response.statusCode, 200); + assert.strictEqual(body, 'ok'); + assert(received, 'The local server must receive the upload'); + resolve(); + } catch (assertionError) { + reject(assertionError); + } + }); + }); + console.log('Request multipart boundaries and text/binary upload passed.'); + } finally { + server.closeAllConnections(); + await new Promise(resolve => server.close(resolve)); + } +} + +verifyMultipart().catch(error => { + console.error(error); + process.exitCode = 1; +});