Skip to content

Commit 35d24db

Browse files
julio-rocketchatjulio-rocketchat
committed
chore(deps): bump xmldom and related deps (#40270)
1 parent ee667a6 commit 35d24db

5 files changed

Lines changed: 81 additions & 19 deletions

File tree

‎.github/actions/update-version-durability/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,6 @@
1616
"colors": "^1.4.0",
1717
"diff": "^5.1.0",
1818
"semver": "^7.5.4",
19-
"@xmldom/xmldom": "^0.8.10"
19+
"@xmldom/xmldom": "^0.8.13"
2020
}
2121
}

‎apps/meteor/app/meteor-accounts-saml/server/lib/parsers/Response.ts‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,9 @@ export class ResponseParser {
208208
let newXml = null;
209209

210210
if (typeof encAssertion !== 'undefined') {
211-
const options = { key: this.serviceProviderOptions.privateKey };
211+
// disallowDecryptionWithInsecureAlgorithm defaults to true in xml-encryption v4, but AES-CBC/3DES
212+
// are still widely used by SAML IdPs in practice, so we keep the pre-v4 behaviour here.
213+
const options = { key: this.serviceProviderOptions.privateKey, disallowDecryptionWithInsecureAlgorithm: false };
212214
const encData = encAssertion.getElementsByTagNameNS('*', 'EncryptedData')[0];
213215
xmlenc.decrypt(encData, options, (err, result) => {
214216
if (err) {
@@ -350,7 +352,7 @@ export class ResponseParser {
350352
const encSubject = assertion.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'EncryptedID')[0];
351353

352354
if (typeof encSubject !== 'undefined') {
353-
const options = { key: this.serviceProviderOptions.privateKey };
355+
const options = { key: this.serviceProviderOptions.privateKey, disallowDecryptionWithInsecureAlgorithm: false };
354356
xmlenc.decrypt(encSubject.getElementsByTagNameNS('*', 'EncryptedData')[0], options, (err, result) => {
355357
if (err) {
356358
SAMLUtils.error({ err });

‎apps/meteor/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -306,7 +306,7 @@
306306
"universal-perf-hooks": "^1.0.1",
307307
"webdav": "^4.11.5",
308308
"xml-crypto": "~3.2.1",
309-
"xml-encryption": "~3.1.0",
309+
"xml-encryption": "~4.0.0",
310310
"xml2js": "~0.6.2",
311311
"yaqrcode": "^0.2.1",
312312
"yoga-layout": "patch:yoga-layout@npm%3A3.2.1#~/.yarn/patches/yoga-layout-npm-3.2.1-51ec934670.patch",

‎package.json‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,10 @@
7474
"zod@npm:^3.25.0 || ^4.0.0": "patch:zod@npm%3A4.3.6#~/.yarn/patches/zod-npm-4.3.6-a096e305e6.patch",
7575
"zod@npm:~4.3.6": "patch:zod@npm%3A4.3.6#~/.yarn/patches/zod-npm-4.3.6-a096e305e6.patch",
7676
"@react-aria/i18n@npm:^3.0.0-nightly-fb28ab3b4-241024": "patch:@react-aria/i18n@npm%3A3.12.5#~/.yarn/patches/@react-aria-i18n-npm-3.12.5-435edff786.patch",
77-
"@react-aria/i18n@npm:^3.12.5": "patch:@react-aria/i18n@npm%3A3.12.5#~/.yarn/patches/@react-aria-i18n-npm-3.12.5-435edff786.patch"
77+
"@react-aria/i18n@npm:^3.12.5": "patch:@react-aria/i18n@npm%3A3.12.5#~/.yarn/patches/@react-aria-i18n-npm-3.12.5-435edff786.patch",
78+
"@react-aria/toolbar@npm:^3.0.0-nightly.5042": "3.0.0-nightly-fb28ab3b4-241024",
79+
"xml-crypto/@xmldom/xmldom": "0.8.13",
80+
"xml-encryption/@xmldom/xmldom": "0.8.13"
7881
},
7982
"dependencies": {
8083
"@types/stream-buffers": "^3.0.8",

‎yarn.lock‎

Lines changed: 71 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7486,7 +7486,7 @@ __metadata:
74867486
languageName: node
74877487
linkType: hard
74887488

7489-
"@react-aria/toolbar@npm:^3.0.0-nightly.5042":
7489+
"@react-aria/toolbar@npm:3.0.0-nightly-fb28ab3b4-241024":
74907490
version: 3.0.0-nightly-fb28ab3b4-241024
74917491
resolution: "@react-aria/toolbar@npm:3.0.0-nightly-fb28ab3b4-241024"
74927492
dependencies:
@@ -8567,7 +8567,16 @@ __metadata:
85678567
languageName: node
85688568
linkType: hard
85698569

8570-
"@react-types/shared@npm:^3.0.0-nightly-fb28ab3b4-241024, @react-types/shared@npm:^3.14.1, @react-types/shared@npm:^3.27.0":
8570+
"@react-types/shared@npm:^3.0.0-nightly-fb28ab3b4-241024":
8571+
version: 3.34.0
8572+
resolution: "@react-types/shared@npm:3.34.0"
8573+
peerDependencies:
8574+
react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
8575+
checksum: 10/d28b0a3a3f68f94167fd7b4f474803430093b1a31f5f50cef6ddd755b923ba3af35dde40ffcc1f320926892744823a039b4a396c671f7c59aa49634811f0c43a
8576+
languageName: node
8577+
linkType: hard
8578+
8579+
"@react-types/shared@npm:^3.14.1, @react-types/shared@npm:^3.27.0":
85718580
version: 3.27.0
85728581
resolution: "@react-types/shared@npm:3.27.0"
85738582
peerDependencies:
@@ -10164,7 +10173,7 @@ __metadata:
1016410173
webdav: "npm:^4.11.5"
1016510174
webpack: "npm:~5.104.0"
1016610175
xml-crypto: "npm:~3.2.1"
10167-
xml-encryption: "npm:~3.1.0"
10176+
xml-encryption: "npm:~4.0.0"
1016810177
xml2js: "npm:~0.6.2"
1016910178
yaqrcode: "npm:^0.2.1"
1017010179
yoga-layout: "patch:yoga-layout@npm%3A3.2.1#~/.yarn/patches/yoga-layout-npm-3.2.1-51ec934670.patch"
@@ -15895,10 +15904,10 @@ __metadata:
1589515904
languageName: node
1589615905
linkType: hard
1589715906

15898-
"@xmldom/xmldom@npm:^0.8.5, @xmldom/xmldom@npm:^0.8.8":
15899-
version: 0.8.10
15900-
resolution: "@xmldom/xmldom@npm:0.8.10"
15901-
checksum: 10/62400bc5e0e75b90650e33a5ceeb8d94829dd11f9b260962b71a784cd014ddccec3e603fe788af9c1e839fa4648d8c521ebd80d8b752878d3a40edabc9ce7ccf
15907+
"@xmldom/xmldom@npm:0.8.13":
15908+
version: 0.8.13
15909+
resolution: "@xmldom/xmldom@npm:0.8.13"
15910+
checksum: 10/f8f3d56fa91d5026885c0c5c00b07eae47647bda0d742ecbf8e51e06bb287ab30222977b20529ee15c364031606225ebca58907a8ecc76a3add6b3f10e6ddfc6
1590215911
languageName: node
1590315912
linkType: hard
1590415913

@@ -17789,7 +17798,7 @@ __metadata:
1778917798
languageName: node
1779017799
linkType: hard
1779117800

17792-
"buffer-equal-constant-time@npm:1.0.1":
17801+
"buffer-equal-constant-time@npm:1.0.1, buffer-equal-constant-time@npm:^1.0.1":
1779317802
version: 1.0.1
1779417803
resolution: "buffer-equal-constant-time@npm:1.0.1"
1779517804
checksum: 10/80bb945f5d782a56f374b292770901065bad21420e34936ecbe949e57724b4a13874f735850dd1cc61f078773c4fb5493a41391e7bda40d1fa388d6bd80daaab
@@ -26855,7 +26864,7 @@ __metadata:
2685526864
languageName: node
2685626865
linkType: hard
2685726866

26858-
"jsonwebtoken@npm:9.0.2, jsonwebtoken@npm:^9.0.0, jsonwebtoken@npm:^9.0.2":
26867+
"jsonwebtoken@npm:9.0.2, jsonwebtoken@npm:^9.0.0":
2685926868
version: 9.0.2
2686026869
resolution: "jsonwebtoken@npm:9.0.2"
2686126870
dependencies:
@@ -26873,6 +26882,24 @@ __metadata:
2687326882
languageName: node
2687426883
linkType: hard
2687526884

26885+
"jsonwebtoken@npm:^9.0.2":
26886+
version: 9.0.3
26887+
resolution: "jsonwebtoken@npm:9.0.3"
26888+
dependencies:
26889+
jws: "npm:^4.0.1"
26890+
lodash.includes: "npm:^4.3.0"
26891+
lodash.isboolean: "npm:^3.0.3"
26892+
lodash.isinteger: "npm:^4.0.4"
26893+
lodash.isnumber: "npm:^3.0.3"
26894+
lodash.isplainobject: "npm:^4.0.6"
26895+
lodash.isstring: "npm:^4.0.1"
26896+
lodash.once: "npm:^4.0.0"
26897+
ms: "npm:^2.1.1"
26898+
semver: "npm:^7.5.4"
26899+
checksum: 10/a67a276db41fbfb458ebdc4938d5d7b01d4743e16bda0f25ac01996fe5b5819d66656153f6cfce19b4680b79ae9f9ca185965defc22e77e0abddf443573238d6
26900+
languageName: node
26901+
linkType: hard
26902+
2687626903
"jsprim@npm:^1.2.2":
2687726904
version: 1.4.2
2687826905
resolution: "jsprim@npm:1.4.2"
@@ -26948,6 +26975,17 @@ __metadata:
2694826975
languageName: node
2694926976
linkType: hard
2695026977

26978+
"jwa@npm:^2.0.1":
26979+
version: 2.0.1
26980+
resolution: "jwa@npm:2.0.1"
26981+
dependencies:
26982+
buffer-equal-constant-time: "npm:^1.0.1"
26983+
ecdsa-sig-formatter: "npm:1.0.11"
26984+
safe-buffer: "npm:^5.0.1"
26985+
checksum: 10/b04312a1de85f912b96aa3a7211717b8336945fab5b4f7cbc7800f4c80934060c0a3111576fad8d76e41ad62887d6da4b21fd4c47e45c174197f8be7dc0c1694
26986+
languageName: node
26987+
linkType: hard
26988+
2695126989
"jws@npm:^3.2.2":
2695226990
version: 3.2.2
2695326991
resolution: "jws@npm:3.2.2"
@@ -26968,6 +27006,16 @@ __metadata:
2696827006
languageName: node
2696927007
linkType: hard
2697027008

27009+
"jws@npm:^4.0.1":
27010+
version: 4.0.1
27011+
resolution: "jws@npm:4.0.1"
27012+
dependencies:
27013+
jwa: "npm:^2.0.1"
27014+
safe-buffer: "npm:^5.0.1"
27015+
checksum: 10/75d7b157489fa9a72023712c58a7a7706c7e2b10eec27fabd3bb9cae0c9e492251ab72527d20a8a5f5726196f0508c320c643fddff7076657f6bca16d0ceeeeb
27016+
languageName: node
27017+
linkType: hard
27018+
2697127019
"jwt-decode@npm:^4.0.0":
2697227020
version: 4.0.0
2697327021
resolution: "jwt-decode@npm:4.0.0"
@@ -31927,7 +31975,7 @@ __metadata:
3192731975
languageName: node
3192831976
linkType: hard
3192931977

31930-
"qs@npm:^6.11.2, qs@npm:^6.12.3, qs@npm:^6.9.4":
31978+
"qs@npm:^6.11.2, qs@npm:^6.12.3":
3193131979
version: 6.14.0
3193231980
resolution: "qs@npm:6.14.0"
3193331981
dependencies:
@@ -31945,6 +31993,15 @@ __metadata:
3194531993
languageName: node
3194631994
linkType: hard
3194731995

31996+
"qs@npm:^6.9.4":
31997+
version: 6.15.1
31998+
resolution: "qs@npm:6.15.1"
31999+
dependencies:
32000+
side-channel: "npm:^1.1.0"
32001+
checksum: 10/ec10b9957446b3f4a38000940f6374720b4e2985209b89df197066038c951472ea24cd98d6bc6df73a0cbec75bc056f638032e3fb447345017ff7e0f0a2693ac
32002+
languageName: node
32003+
linkType: hard
32004+
3194832005
"qs@npm:~6.5.2":
3194932006
version: 6.5.3
3195032007
resolution: "qs@npm:6.5.3"
@@ -38185,14 +38242,14 @@ __metadata:
3818538242
languageName: node
3818638243
linkType: hard
3818738244

38188-
"xml-encryption@npm:~3.1.0":
38189-
version: 3.1.0
38190-
resolution: "xml-encryption@npm:3.1.0"
38245+
"xml-encryption@npm:~4.0.0":
38246+
version: 4.0.0
38247+
resolution: "xml-encryption@npm:4.0.0"
3819138248
dependencies:
3819238249
"@xmldom/xmldom": "npm:^0.8.5"
3819338250
escape-html: "npm:^1.0.3"
3819438251
xpath: "npm:0.0.32"
38195-
checksum: 10/c84c1e11692181c24a1c30123fed4fa31015c58994bbdcf091f07fa79f0fb809774b1533d191c4739bf76bb0fb95f223d393e84cc48417480a1896b2b689373b
38252+
checksum: 10/319f5c0c591a5600f5f6846c9b27a69e6ecd7d4a2215cfb9ffac37490143d48239652097eae6ff33a0d55f8b534c03caa09e75ee260d89d3d1bc26802c1cfc36
3819638253
languageName: node
3819738254
linkType: hard
3819838255

0 commit comments

Comments
 (0)