Skip to content

Commit e6e8c1a

Browse files
hectormmgCopilot
hectormmg
and
Copilot
committed
fix: upgrade @rollup/plugin-terser to v1 to address serialize-javascript CVE
Upgrade @rollup/plugin-terser from ^0.4.0 to ^1.0.0 in msal-browser. v1.0.0 uses serialize-javascript@^7.0.3 (fixed version for RCE via RegExp.flags/Date.toISOString injection, GHSA-5c6j-r48x-rmvq). Note: serialize-javascript@6.0.2 remains for copy-webpack-plugin@12.0.2, which is pinned by @angular-devkit/build-angular. Exploitation is infeasible there as no user input flows through serialize() in that path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent df1e102 commit e6e8c1a

3 files changed

Lines changed: 187 additions & 142 deletions

File tree

‎lib/msal-browser/package.json‎

Lines changed: 128 additions & 128 deletions
Original file line numberDiff line numberDiff line change
@@ -1,133 +1,133 @@
11
{
2-
"name": "@azure/msal-browser",
3-
"author": {
4-
"name": "Microsoft",
5-
"email": "nugetaad@microsoft.com",
6-
"url": "https://www.microsoft.com"
7-
},
8-
"license": "MIT",
9-
"repository": {
10-
"type": "git",
11-
"url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
12-
},
13-
"version": "5.7.0",
14-
"description": "Microsoft Authentication Library for js",
15-
"keywords": [
16-
"implicit",
17-
"authorization code",
18-
"PKCE",
19-
"js",
20-
"AAD",
21-
"msal",
22-
"oauth"
23-
],
24-
"type": "module",
25-
"sideEffects": false,
26-
"main": "./lib/msal-browser.cjs",
27-
"module": "./dist/index.mjs",
28-
"types": "./dist/index.d.ts",
29-
"exports": {
30-
"./custom-auth": {
31-
"import": {
32-
"types": "./dist/custom-auth-path/custom_auth/index.d.ts",
33-
"default": "./dist/custom-auth-path/custom_auth/index.mjs"
34-
},
35-
"require": {
36-
"types": "./lib/custom-auth-path/types/custom_auth/index.d.ts",
37-
"default": "./lib/custom-auth-path/msal-custom-auth.cjs"
38-
}
2+
"name": "@azure/msal-browser",
3+
"author": {
4+
"name": "Microsoft",
5+
"email": "nugetaad@microsoft.com",
6+
"url": "https://www.microsoft.com"
397
},
40-
"./redirect-bridge": {
41-
"import": {
42-
"types": "./dist/redirect-bridge/redirect_bridge/index.d.ts",
43-
"default": "./dist/redirect-bridge/redirect_bridge/index.mjs"
44-
},
45-
"require": {
46-
"types": "./lib/redirect-bridge/types/redirect_bridge/index.d.ts",
47-
"default": "./lib/redirect-bridge/msal-redirect-bridge.cjs"
48-
}
8+
"license": "MIT",
9+
"repository": {
10+
"type": "git",
11+
"url": "https://github.com/AzureAD/microsoft-authentication-library-for-js.git"
4912
},
50-
".": {
51-
"import": {
52-
"types": "./dist/index.d.ts",
53-
"default": "./dist/index.mjs"
54-
},
55-
"require": {
56-
"types": "./lib/types/index.d.ts",
57-
"default": "./lib/msal-browser.cjs"
58-
}
13+
"version": "5.6.3",
14+
"description": "Microsoft Authentication Library for js",
15+
"keywords": [
16+
"implicit",
17+
"authorization code",
18+
"PKCE",
19+
"js",
20+
"AAD",
21+
"msal",
22+
"oauth"
23+
],
24+
"type": "module",
25+
"sideEffects": false,
26+
"main": "./lib/msal-browser.cjs",
27+
"module": "./dist/index.mjs",
28+
"types": "./dist/index.d.ts",
29+
"exports": {
30+
"./custom-auth": {
31+
"import": {
32+
"types": "./dist/custom-auth-path/custom_auth/index.d.ts",
33+
"default": "./dist/custom-auth-path/custom_auth/index.mjs"
34+
},
35+
"require": {
36+
"types": "./lib/custom-auth-path/types/custom_auth/index.d.ts",
37+
"default": "./lib/custom-auth-path/msal-custom-auth.cjs"
38+
}
39+
},
40+
"./redirect-bridge": {
41+
"import": {
42+
"types": "./dist/redirect-bridge/redirect_bridge/index.d.ts",
43+
"default": "./dist/redirect-bridge/redirect_bridge/index.mjs"
44+
},
45+
"require": {
46+
"types": "./lib/redirect-bridge/types/redirect_bridge/index.d.ts",
47+
"default": "./lib/redirect-bridge/msal-redirect-bridge.js"
48+
}
49+
},
50+
".": {
51+
"import": {
52+
"types": "./dist/index.d.ts",
53+
"default": "./dist/index.mjs"
54+
},
55+
"require": {
56+
"types": "./lib/types/index.d.ts",
57+
"default": "./lib/msal-browser.cjs"
58+
}
59+
},
60+
"./package.json": "./package.json"
5961
},
60-
"./package.json": "./package.json"
61-
},
62-
"engines": {
63-
"node": ">=0.8.0"
64-
},
65-
"beachball": {
66-
"disallowedChangeTypes": [
67-
"major"
68-
]
69-
},
70-
"directories": {
71-
"test": "test"
72-
},
73-
"files": [
74-
"dist",
75-
"lib",
76-
"src"
77-
],
78-
"scripts": {
79-
"clean": "shx rm -rf dist lib",
80-
"clean:coverage": "rimraf ../../.nyc_output/*",
81-
"lint": "eslint src --ext .ts",
82-
"lint:fix": "npm run lint -- --fix",
83-
"test": "jest",
84-
"test:coverage": "jest --coverage",
85-
"test:coverage:only": "npm run clean:coverage && npm run test:coverage",
86-
"build:all": "cd ../.. && npm run build --workspace=@azure/msal-common --workspace=@azure/msal-browser",
87-
"build:all:debug": "cd ../.. && cross-env MSAL_MINIFY_LOGS=false npm run build --workspace=@azure/msal-common --workspace=@azure/msal-browser",
88-
"build:modules": "rollup -c --strictDeprecations --bundleConfigAsCjs",
89-
"build:modules:watch": "rollup -cw --bundleConfigAsCjs",
90-
"build": "npm run clean && npm run build:modules",
91-
"build:debug": "npm run clean && cross-env MSAL_MINIFY_LOGS=false npm run build:modules",
92-
"decode-logs": "node scripts/decode-logs.cjs",
93-
"prepack": "npm run build:all",
94-
"format:check": "prettier --ignore-path .gitignore --check src test",
95-
"format:fix": "prettier --ignore-path .gitignore --write src test",
96-
"apiExtractor": "api-extractor run"
97-
},
98-
"devDependencies": {
99-
"@azure/storage-blob": "^12.2.1",
100-
"@babel/core": "^7.7.2",
101-
"@babel/plugin-proposal-class-properties": "^7.7.0",
102-
"@babel/plugin-proposal-object-rest-spread": "^7.6.2",
103-
"@babel/preset-env": "^7.7.1",
104-
"@babel/preset-typescript": "^7.7.2",
105-
"@microsoft/api-extractor": "^7.43.4",
106-
"@rollup/plugin-node-resolve": "^15.0.1",
107-
"@rollup/plugin-terser": "^0.4.0",
108-
"@rollup/plugin-typescript": "^11.0.0",
109-
"@types/jest": "^29.5.0",
110-
"@types/node": "^20.3.1",
111-
"cross-env": "^10.1.0",
112-
"dotenv": "^8.2.0",
113-
"eslint-config-msal": "file:../../shared-configs/eslint-config-msal",
114-
"fake-indexeddb": "^3.1.3",
115-
"jest": "^29.5.0",
116-
"jest-environment-jsdom": "^29.5.0",
117-
"jest-junit": "^16.0.0",
118-
"msal-test-utils": "file:../../shared-test-utils",
119-
"prettier": "^2.8.7",
120-
"rimraf": "^3.0.0",
121-
"rollup": "^4.22.4",
122-
"rollup-msal": "file:../../shared-configs/rollup-msal",
123-
"shx": "^0.3.2",
124-
"ssri": "^8.0.1",
125-
"ts-jest": "^29.2.5",
126-
"ts-jest-resolver": "^2.0.1",
127-
"tslib": "^1.10.0",
128-
"typescript": "^4.9.5"
129-
},
130-
"dependencies": {
131-
"@azure/msal-common": "16.5.0"
132-
}
62+
"engines": {
63+
"node": ">=0.8.0"
64+
},
65+
"beachball": {
66+
"disallowedChangeTypes": [
67+
"major"
68+
]
69+
},
70+
"directories": {
71+
"test": "test"
72+
},
73+
"files": [
74+
"dist",
75+
"lib",
76+
"src"
77+
],
78+
"scripts": {
79+
"clean": "shx rm -rf dist lib",
80+
"clean:coverage": "rimraf ../../.nyc_output/*",
81+
"lint": "eslint src --ext .ts",
82+
"lint:fix": "npm run lint -- --fix",
83+
"test": "jest",
84+
"test:coverage": "jest --coverage",
85+
"test:coverage:only": "npm run clean:coverage && npm run test:coverage",
86+
"build:all": "cd ../.. && npm run build --workspace=@azure/msal-common --workspace=@azure/msal-browser",
87+
"build:all:debug": "cd ../.. && cross-env MSAL_MINIFY_LOGS=false npm run build --workspace=@azure/msal-common --workspace=@azure/msal-browser",
88+
"build:modules": "rollup -c --strictDeprecations --bundleConfigAsCjs",
89+
"build:modules:watch": "rollup -cw --bundleConfigAsCjs",
90+
"build": "npm run clean && npm run build:modules",
91+
"build:debug": "npm run clean && cross-env MSAL_MINIFY_LOGS=false npm run build:modules",
92+
"decode-logs": "node scripts/decode-logs.cjs",
93+
"prepack": "npm run build:all",
94+
"format:check": "prettier --ignore-path .gitignore --check src test",
95+
"format:fix": "prettier --ignore-path .gitignore --write src test",
96+
"apiExtractor": "api-extractor run"
97+
},
98+
"devDependencies": {
99+
"@azure/storage-blob": "^12.2.1",
100+
"@babel/core": "^7.7.2",
101+
"@babel/plugin-proposal-class-properties": "^7.7.0",
102+
"@babel/plugin-proposal-object-rest-spread": "^7.6.2",
103+
"@babel/preset-env": "^7.7.1",
104+
"@babel/preset-typescript": "^7.7.2",
105+
"@microsoft/api-extractor": "^7.43.4",
106+
"@rollup/plugin-node-resolve": "^15.0.1",
107+
"@rollup/plugin-terser": "^1.0.0",
108+
"@rollup/plugin-typescript": "^11.0.0",
109+
"@types/jest": "^29.5.0",
110+
"@types/node": "^20.3.1",
111+
"cross-env": "^10.1.0",
112+
"dotenv": "^8.2.0",
113+
"eslint-config-msal": "file:../../shared-configs/eslint-config-msal",
114+
"fake-indexeddb": "^3.1.3",
115+
"jest": "^29.5.0",
116+
"jest-environment-jsdom": "^29.5.0",
117+
"jest-junit": "^16.0.0",
118+
"msal-test-utils": "file:../../shared-test-utils",
119+
"prettier": "^2.8.7",
120+
"rimraf": "^3.0.0",
121+
"rollup": "^4.22.4",
122+
"rollup-msal": "file:../../shared-configs/rollup-msal",
123+
"shx": "^0.3.2",
124+
"ssri": "^8.0.1",
125+
"ts-jest": "^29.2.5",
126+
"ts-jest-resolver": "^2.0.1",
127+
"tslib": "^1.10.0",
128+
"typescript": "^4.9.5"
129+
},
130+
"dependencies": {
131+
"@azure/msal-common": "16.4.1"
132+
}
133133
}

‎package-lock.json‎

Lines changed: 58 additions & 13 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)