From 150b63d34bb63e1c0cbcc3c965691f33b6f56022 Mon Sep 17 00:00:00 2001 From: UNITRONIX <36471318+UNITRONIX@users.noreply.github.com> Date: Wed, 5 Aug 2026 17:12:34 +0200 Subject: [PATCH] fix(security): bump Dependabot deps and harden CDAP file-transfer callbacks Close brace-expansion, postcss, and quinn-proto alerts; validate request_id before invoking pending download callbacks (CodeQL). --- CHANGELOG.md | 4 + betterdesk-agent-client/package-lock.json | 14 +-- betterdesk-agent-client/package.json | 3 + package-lock.json | 14 +-- package.json | 3 + rdclient-desktop/src-tauri/Cargo.lock | 92 +++++++++---------- web-nodejs/package-lock.json | 11 +-- web-nodejs/package.json | 2 +- .../public/js/rdclient/cdap-filetransfer.js | 13 ++- 9 files changed, 80 insertions(+), 76 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9d26beb7..b5ce9bbe 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ ## [Unreleased] +### Security +- **Dependabot dependency bumps:** `brace-expansion` → 5.0.9 (web-nodejs override), `postcss` → ≥8.5.23 (root + agent-client overrides), `quinn-proto` → 0.11.16 (RdClient Cargo.lock). Dev/build tooling and transitive deps only for postcss/quinn; brace-expansion via panel lockfile. +- **CDAP file transfer dynamic callback (CodeQL):** validate `request_id` (string + whitelist) and use own-property lookup before invoking pending download callbacks in `cdap-filetransfer.js`. Ships via panel update (static JS). + ### Changed - _(none yet)_ diff --git a/betterdesk-agent-client/package-lock.json b/betterdesk-agent-client/package-lock.json index 4ed73b93..93849843 100644 --- a/betterdesk-agent-client/package-lock.json +++ b/betterdesk-agent-client/package-lock.json @@ -2000,9 +2000,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.12", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz", - "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==", + "version": "3.3.17", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz", + "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==", "dev": true, "funding": [ { @@ -2079,9 +2079,9 @@ } }, "node_modules/postcss": { - "version": "8.5.15", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz", - "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==", + "version": "8.5.25", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz", + "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==", "dev": true, "funding": [ { @@ -2099,7 +2099,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.12", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, diff --git a/betterdesk-agent-client/package.json b/betterdesk-agent-client/package.json index f99691a2..cfef222e 100644 --- a/betterdesk-agent-client/package.json +++ b/betterdesk-agent-client/package.json @@ -27,5 +27,8 @@ "vite": "^6.4.3", "vite-plugin-solid": "^2.10.0", "vitest": "^3.2.5" + }, + "overrides": { + "postcss": "^8.5.23" } } diff --git a/package-lock.json b/package-lock.json index 5f0c0dd6..4546af9f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1156,9 +1156,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.12", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz", - "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==", + "version": "3.3.17", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz", + "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==", "dev": true, "funding": [ { @@ -1212,9 +1212,9 @@ } }, "node_modules/postcss": { - "version": "8.5.15", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz", - "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==", + "version": "8.5.25", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz", + "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==", "dev": true, "funding": [ { @@ -1232,7 +1232,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.12", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, diff --git a/package.json b/package.json index d47a2471..9b84e7e9 100644 --- a/package.json +++ b/package.json @@ -4,5 +4,8 @@ }, "devDependencies": { "vitest": "^3.2.5" + }, + "overrides": { + "postcss": "^8.5.23" } } diff --git a/rdclient-desktop/src-tauri/Cargo.lock b/rdclient-desktop/src-tauri/Cargo.lock index 29b4d6f6..869c7414 100644 --- a/rdclient-desktop/src-tauri/Cargo.lock +++ b/rdclient-desktop/src-tauri/Cargo.lock @@ -313,6 +313,17 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" +[[package]] +name = "chacha20" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "rand_core", +] + [[package]] name = "chrono" version = "0.4.45" @@ -394,6 +405,15 @@ dependencies = [ "libc", ] +[[package]] +name = "cpufeatures" +version = "0.3.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201" +dependencies = [ + "libc", +] + [[package]] name = "crc32fast" version = "1.5.0" @@ -1036,11 +1056,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" dependencies = [ "cfg-if", - "js-sys", "libc", "r-efi 5.3.0", "wasip2", - "wasm-bindgen", ] [[package]] @@ -1050,10 +1068,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555" dependencies = [ "cfg-if", + "js-sys", "libc", "r-efi 6.0.0", + "rand_core", "wasip2", "wasip3", + "wasm-bindgen", ] [[package]] @@ -2314,15 +2335,6 @@ version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391" -[[package]] -name = "ppv-lite86" -version = "0.2.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9" -dependencies = [ - "zerocopy", -] - [[package]] name = "precomputed-hash" version = "0.1.1" @@ -2432,14 +2444,15 @@ dependencies = [ [[package]] name = "quinn-proto" -version = "0.11.14" +version = "0.11.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098" +checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560" dependencies = [ "bytes", - "getrandom 0.3.4", + "getrandom 0.4.2", "lru-slab", "rand", + "rand_pcg", "ring", "rustc-hash", "rustls", @@ -2488,31 +2501,28 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" [[package]] name = "rand" -version = "0.9.4" +version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea" +checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" dependencies = [ - "rand_chacha", - "rand_core", -] - -[[package]] -name = "rand_chacha" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb" -dependencies = [ - "ppv-lite86", + "chacha20", + "getrandom 0.4.2", "rand_core", ] [[package]] name = "rand_core" -version = "0.9.5" +version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c" +checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" + +[[package]] +name = "rand_pcg" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a" dependencies = [ - "getrandom 0.3.4", + "rand_core", ] [[package]] @@ -3025,7 +3035,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" dependencies = [ "cfg-if", - "cpufeatures", + "cpufeatures 0.2.17", "digest", ] @@ -5026,26 +5036,6 @@ dependencies = [ "synstructure", ] -[[package]] -name = "zerocopy" -version = "0.8.52" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f" -dependencies = [ - "zerocopy-derive", -] - -[[package]] -name = "zerocopy-derive" -version = "0.8.52" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.117", -] - [[package]] name = "zerofrom" version = "0.1.8" diff --git a/web-nodejs/package-lock.json b/web-nodejs/package-lock.json index 17da917d..17cacf86 100644 --- a/web-nodejs/package-lock.json +++ b/web-nodejs/package-lock.json @@ -1,12 +1,12 @@ { "name": "betterdesk-console", - "version": "3.5.2", + "version": "3.5.13", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "betterdesk-console", - "version": "3.5.2", + "version": "3.5.13", "license": "AGPL-3.0", "dependencies": { "axios": "^1.19.0", @@ -22,7 +22,6 @@ "multer": "^2.2.0", "nodemailer": "^9.0.3", "otplib": "^12.0.1", - "pg": "^8.22.0", "protobufjs": "^7.6.5", "qrcode": "^1.5.4", "tweetnacl": "^1.0.3", @@ -1699,9 +1698,9 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.8", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz", - "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" diff --git a/web-nodejs/package.json b/web-nodejs/package.json index 38daad26..a414f6bf 100644 --- a/web-nodejs/package.json +++ b/web-nodejs/package.json @@ -54,7 +54,7 @@ "js-yaml": "^3.15.0", "tar": "^7.5.21", "path-to-regexp": "^0.1.13", - "brace-expansion": "^5.0.8", + "brace-expansion": "^5.0.9", "form-data": "^4.0.6", "body-parser": "^1.20.6", "protobufjs": "^7.6.5" diff --git a/web-nodejs/public/js/rdclient/cdap-filetransfer.js b/web-nodejs/public/js/rdclient/cdap-filetransfer.js index 89a392ca..a7805e75 100644 --- a/web-nodejs/public/js/rdclient/cdap-filetransfer.js +++ b/web-nodejs/public/js/rdclient/cdap-filetransfer.js @@ -98,10 +98,15 @@ class CDAPFileTransfer { this._onList(msg); break; case 'file_read_response': { - const cb = msg.request_id && this._pending[msg.request_id]; - if (cb) { - cb(msg); - delete this._pending[msg.request_id]; + const requestId = msg.request_id; + if (requestId && typeof requestId === 'string' && /^[\w-]{1,64}$/.test(requestId)) { + const cb = Object.prototype.hasOwnProperty.call(this._pending, requestId) + ? this._pending[requestId] + : null; + if (typeof cb === 'function') { + cb(msg); + delete this._pending[requestId]; + } } break; }