chore(deps): update dependency astro to v5.0.8 [security] #87
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
Deploying astrobook with
|
| Latest commit: |
98a9537
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://4fc0b1e7.astrobook.pages.dev |
| Branch Preview URL: | https://renovate-npm-astro-vulnerabi.astrobook.pages.dev |
|
Open in Stackblitz • example-playground commit: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.0.5->5.0.8GitHub Vulnerability Alerts
CVE-2024-56159
Summary
A bug in the build process allows any unauthenticated user to read parts of the server source code.
Details
During build, along with client assets such as css and font files, the sourcemap files for the server code are moved to a publicly-accessible folder.
https://github.com/withastro/astro/blob/176fe9f113fd912f9b61e848b00bbcfecd6d5c2c/packages/astro/src/core/build/static-build.ts#L139
Any outside party can read them with an unauthorized HTTP GET request to the same server hosting the rest of the website.
While some server files are hashed, making their access obscure, the files corresponding to the file system router (those in
src/pages) are predictably named. For example. the sourcemap file forsrc/pages/index.astrogets nameddist/client/pages/index.astro.mjs.map.PoC
Here is one example of an affected open-source website:
https://creatorsgarten.org/pages/index.astro.mjs.map
The file can be saved and opened using https://evanw.github.io/source-map-visualization/ to reconstruct the source code.
The above accurately mirrors the source code as seen in the repository: https://github.com/creatorsgarten/creatorsgarten.org/blob/main/src/pages/index.astro
The above was found as the 4th result (and the first one on Astro 5.0+) when making the following search query on GitHub.com (search results link):
This vulnerability is the root cause of https://github.com/withastro/astro/issues/12703, which links to a simple stackblitz project demonstrating the vulnerability. Upon build, notice the contents of the
dist/client(referred to asconfig.build.clientin astro code) folder. All astro servers make the folder in question accessible to the public internet without any authentication. It contains.mapfiles corresponding to the code that runs on the server.Impact
All server-output (SSR) projects on Astro 5 versions v5.0.3 through v5.0.6 (inclusive), that have sourcemaps enabled, either directly or through an add-on such as sentry, are affected. The fix for server-output projects was released in [email protected].
Additionally, all static-output (SSG) projects built using Astro 4 versions 4.16.17 or older, or Astro 5 versions 5.0.7 or older, that have sourcemaps enabled are also affected. The fix for static-output projects was released in [email protected], and backported to Astro v4 in [email protected].
The immediate impact is limited to source code. Any secrets or environment variables are not exposed unless they are present verbatim in the source code.
There is no immediate loss of integrity within the the vulnerable server. However, it is possible to subsequently discover another vulnerability via the revealed source code .
There is no immediate impact to availability of the vulnerable server. However, the presence of an unsafe regular expression, for example, can quickly be exploited to subsequently compromise the availability.
Remediation
The fix for server-output projects was released in [email protected], and the fix for static-output projects was released in [email protected] and backported to Astro v4 in [email protected]. Users are advised to update immediately if they are using sourcemaps or an integration that enables sourcemaps.
Release Notes
withastro/astro (astro)
v5.0.8Compare Source
Patch Changes
039d022Thanks @matthewp! - Clean server sourcemaps from static outputv5.0.7Compare Source
Patch Changes
c879f50Thanks @matthewp! - Remove all assets created from the server buildv5.0.6Compare Source
Patch Changes
#12597
564ac6cThanks @florian-lefebvre! - Fixes an issue where image and server islands routes would not be passed to theastro:routes:resolvedhook during builds#12718
ccc5ad1Thanks @ematipico! - Fixes an issue where Astro couldn't correctly handle i18n fallback when using the i18n middleware#12728
ee66a45Thanks @argyleink! - Adds type support for theclosedbyattribute for<dialog>elements#12709
e3bfd93Thanks @mtwilliams-code! - Fixes a bug where Astro couldn't correctly parseparamsandpropswhen receiving i18n fallback URLs#12657
14dffccThanks @darkmaga! - Trailing slash support for actions#12715
029661dThanks @ascorbic! - Fixes a bug that caused errors in dev when editing sites with large numbers of MDX pages#12729
8b1cecdThanks @JoeMorgan! - "Addedinertto htmlBooleanAttributes"#12726
7c7398cThanks @florian-lefebvre! - Fixes a case where failing content entries inastro checkwould not be surfacedConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.