Updating tough-cookie due to security fix.

[karlnorling]

This addresses:

The tough-cookie module is vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds.

Unless node was compiled using the -DHTTPMAXHEADER_SIZE= option the default header max length is 80kb so the impact of the ReDoS is limited to around 7.3 seconds of blocking.

At the time of writing all version <=2.3.2 are vulnerable

• See: https://www.versioneye.com/Node.JS/tough-cookie/2.3.2
  • Also tough-cookie:
    • Constrain spaces before = to 256 salesforce/tough-cookie#97
    • Vulnerable Regular Expression salesforce/tough-cookie#92

[crc442]

Nice!

[kartikm]

When will be this included in the release?

[Sebmaster]

When will be this included in the release?

There is no action necessary from our side. Just run npm update.

[karlnorling]

@Sebmaster can you clarify?
I'm running npm update on project that has jsDom: 11.2.0 as a dependency and I'm getting tough-cookie: 2.3.2

[Sebmaster]

I'm running npm update on project that has jsDom: 11.2.0 as a dependency and I'm getting tough-cookie: 2.3.2

Ugh, yeah. I can repro that.

If you remove the jsdom version increase from the PR I can merge this.

[karlnorling]

@Sebmaster pushed!

[domenic]

And now the package-lock.json is not updated, so nobody will actually see this update... I'll just do the update myself.

[domenic]

Oh, I see, tough-cookie was already updated in package-lock.json. So this was not a necessary pull request after all. Still, might as well.