Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update eventsource due to CVE-2022-1650 #590

Merged
merged 1 commit into from May 28, 2022
Merged

Update eventsource due to CVE-2022-1650 #590

merged 1 commit into from May 28, 2022

Conversation

brammitch
Copy link
Contributor

@brammitch brammitch commented May 25, 2022 •
edited

All tests passing with npm run test:browser_local

@nathanmillar16 nathanmillar16 mentioned this pull request May 26, 2022
Closed
@brycekahle
Copy link
Contributor

brycekahle commented May 27, 2022 •
edited

@brammitch AFAICT sockjs is not affected by the vulnerability because we do not use cookies or Authorization headers.

When fetching an url with a link to an external site (Redirect), the users Cookies & Autorisation headers are leaked to the third party application. According to the same-origin-policy, the header should be "sanitized."

@brycekahle
Copy link
Contributor

I'll publish an update this evening

@brycekahle brycekahle mentioned this pull request May 27, 2022
Closed
@brycekahle brycekahle merged commit f19946b into sockjs:main May 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@brammitch @brycekahle