From 2087c5afb7b05fbbf58b822769144c1c72657ee1 Mon Sep 17 00:00:00 2001 From: maurice Date: Mon, 2 Nov 2026 09:17:37 +0100 Subject: [PATCH] Service lockfile: body-parser 2.4.0, qs 6.17.1 npm audit --omit=dev reported GHSA-27r3-jxmh-p828 (body-parser, high: DoS through trailing bytes after a compressed body) and GHSA-6pq8-jhm2-2vcw (qs, moderate, in qs.stringify). The weekly audit workflow failed on them from 2026-10-26; being continue-on-error, its run read as success. npm update body-parser qs --package-lock-only --omit=dev: body-parser 2.3.0 -> 2.4.0 with its nested content-type 2.0.0 -> 2.1.0, and qs 6.16.0 -> 6.17.1, nothing else; express 5.2.1 and c2pa-node 0.9.5 unchanged. Express 5.3.0 (#183) would not have done this: it still accepts body-parser ^2.3.0. Reasoned, not tested: the body-parser flaw is reachable only with a valid token, since the Bearer check (server.js:901) runs before express.json (server.js:960); the service never calls qs, and Express only parses. Left: minimatch < 11.0.1 (moderate), reached only via unzipper -> fstream -> rimraf -> glob on c2pa-node's install path; glob 7 requires minimatch ^3.1.1, so only an override would move it. Rebuilt and verified: the container holds body-parser 2.4.0 and qs 6.17.1; integration 217 passed / 23 skipped, no failures; bin/e2e.php trusted, Article 50 mark intact; composer check 528 passed / 7 skipped. --- CHANGELOG.md | 16 ++++++++++++++++ service/package-lock.json | 24 ++++++++++++------------ 2 files changed, 28 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 624c693..33962a0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,22 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +### Security: in the signing service, not in a tag + +- **The service's lockfile takes `body-parser` 2.4.0 and `qs` 6.17.1**, for + GHSA-27r3-jxmh-p828 (high: denial of service through trailing bytes after a + compressed request body) and GHSA-6pq8-jhm2-2vcw (moderate, in + `qs.stringify`). The `body-parser` flaw is reachable only by a caller holding + the token, because the Bearer check runs before the body is parsed. The + service never calls `qs` itself, and Express uses it to parse, not to + `stringify`. That is reasoned from the code, + not tested. Express stays at 5.2.1 and c2pa-node at 0.9.5. This is + `service/`, so it arrives through `git pull` and a rebuild. Still reported, + and left: `minimatch` (moderate), reached only through the install-time path + that unpacks c2pa-node's native binary, and fixed only in a major that the + packages on that path do not accept. The weekly `audit` workflow had been red + on this step since 2026-10-26 while its runs read as success. + ## [0.20.0] - 2026-10-29 A minor release: the pure-PHP reader gives the verifier's own report of the diff --git a/service/package-lock.json b/service/package-lock.json index bbc5fec..c814240 100644 --- a/service/package-lock.json +++ b/service/package-lock.json @@ -110,18 +110,18 @@ "license": "MIT" }, "node_modules/body-parser": { - "version": "2.3.0", - "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz", - "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==", + "version": "2.4.0", + "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz", + "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==", "license": "MIT", "dependencies": { "bytes": "^3.1.2", - "content-type": "^2.0.0", + "content-type": "^2.1.0", "debug": "^4.4.3", "http-errors": "^2.0.1", - "iconv-lite": "^0.7.2", + "iconv-lite": "^0.7.3", "on-finished": "^2.4.1", - "qs": "^6.15.2", + "qs": "^6.16.1", "raw-body": "^3.0.2", "type-is": "^2.1.0" }, @@ -134,9 +134,9 @@ } }, "node_modules/body-parser/node_modules/content-type": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz", - "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==", + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz", + "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==", "license": "MIT", "engines": { "node": ">=18" @@ -1067,9 +1067,9 @@ } }, "node_modules/qs": { - "version": "6.16.0", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz", - "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==", + "version": "6.17.1", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.17.1.tgz", + "integrity": "sha512-jd3COkaKVgGUW+ZHyEHCG9bH7RoaaiWuMgzsIBjUMVjLAaWGWpoUAVwljVvBHxRu/2qEHnadLGZrkutYUBPQJA==", "license": "BSD-3-Clause", "dependencies": { "es-define-property": "^1.0.1",