René's URL Explorer Experiment

Title: fix(deps): update dependency koa to v2.16.2 [security] by renovate[bot] · Pull Request #238 · 142vip/JavaScriptCollection · GitHub

Open Graph Title: fix(deps): update dependency koa to v2.16.2 [security] by renovate[bot] · Pull Request #238 · 142vip/JavaScriptCollection

X Title: fix(deps): update dependency koa to v2.16.2 [security] by renovate[bot] · Pull Request #238 · 142vip/JavaScriptCollection

Description: This PR contains the following updates: Package Change Age Confidence koa (source) 2.15.4 -> 2.16.2 WarningSome dependencies could not be looked up. Check the Dependency Dashboard for more information. GitHub Vulnerability Alerts CVE-2025-8129 Summary In the latest version of Koa, the back method used for redirect operations adopts an insecure implementation, which uses the user-controllable referrer header as the redirect target. Details on the API document https://www.koajs.net/api/response#responseredirecturl-alt, we can see: response.redirect(url, [alt]) Performs a [302] redirect to url. The string "back" is specially provided for Referrer support, using alt or "/" when Referrer does not exist. ctx.redirect('back'); ctx.redirect('back', '/index.html'); ctx.redirect('/login'); ctx.redirect('http://google.com'); however, the "back" method is insecure: https://github.com/koajs/koa/blob/master/lib/response.js#L322 back (alt) { const url = this.ctx.get('Referrer') || alt || '/' this.redirect(url) }, Referrer Header is User-Controlled. PoC there is a demo for POC: const Koa = require('koa') const serve = require('koa-static') const Router = require('@​koa/router') const path = require('path') const app = new Koa() const router = new Router() // Serve static files from the public directory app.use(serve(path.join(__dirname, 'public'))) // Define routes router.get('/test', ctx => { ctx.redirect('back', '/index1.html') }) router.get('/test2', ctx => { ctx.redirect('back') }) router.get('/', ctx => { ctx.body = 'Welcome to the home page! Try accessing /test, /test2' }) app.use(router.routes()) app.use(router.allowedMethods()) const port = 3000 app.listen(port, () => { console.log(`Server running at http://localhost:${port}`) }) Proof Of Concept GET /test HTTP/1.1 Host: 127.0.0.1:3000 Referer: http://www.baidu.com Connection: close GET /test2 HTTP/1.1 Host: 127.0.0.1:3000 Referer: http://www.baidu.com Connection: close Impact https://learn.snyk.io/lesson/open-redirect/ Release Notes koajs/koa (koa) v2.16.2 Compare Source What's Changed fix: only allow back redirect to the same origin referer by @​fengmk2 in https://github.com/koajs/koa/pull/1898 Full Changelog: koajs/koa@v2.16.1...v2.16.2 v2.16.1 Compare Source fix: don't render redirect values in anchor ref v2.16.0 Compare Source This is a backported release to fix core underlying issue with HEAD requests when using http2.createSecureServer. See discussion at https://github.com/koajs/koa/pull/1593 and https://github.com/koajs/koa/issues/1547. fix missing cleanup, if response socket is no longer writeable (issue 1547) (https://github.com/koajs/koa/pull/1593) 399cb6b Configuration 📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 Ignore: Close this PR and you won't be reminded about this update again. If you want to rebase/retry this PR, check this box This PR was generated by Mend Renovate. View the repository job log.

Open Graph Description: This PR contains the following updates: Package Change Age Confidence koa (source) 2.15.4 -> 2.16.2 WarningSome dependencies could not be looked up. Check the Dependency Dashboard f...

X Description: This PR contains the following updates: Package Change Age Confidence koa (source) 2.15.4 -> 2.16.2 WarningSome dependencies could not be looked up. Check the Dependency Dashboa...

Opengraph URL: https://github.com/142vip/JavaScriptCollection/pull/238

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width