Update node-fetch dependency

[mbeckem]

Hello,

my team noticed that node-expose-sspi is currently (indirectly) affected by CVE-2022-0235. The reason for that is the pinned dependency on an older version of node-fetch ("3.0.0-beta.9").

My guess is that the old version of node-fetch is being used because it is the last version that can still be imported as a CommonJS module.
Later versions are published as ESM which is problematic for CommonJS clients.

This PR updates node-fetch and integrates it using the following approach:

1. Use import type where only type declarations are required
2. Using an ugly workaround to asynchronously import the fetch function (see loadNodeFetch.ts). Essentially, eval is used via new Function(...) to stop the TypeScript compiler from replacing an asynchronous import(...) expression.

Unfortunately I am unable to run all tests right now.
My main development setup is running Linux and my Windows VM is not part of an domain, making testing the server side code rather difficult.
I was able to test the client side SSO flow manually: it appears to work well.

[jlguenego]

I will investigate this one and come back to you.

…

On Mon, Apr 4, 2022 at 3:29 PM Michael Beckemeyer ***@***.***> wrote: Hello, my team noticed that node-expose-sspi is currently (indirectly) affected by CVE-2022-0235 <https://nvd.nist.gov/vuln/detail/CVE-2022-0235>. The reason for that is the pinned dependency on an older version of node-fetch ("3.0.0-beta.9"). My guess is that the old version of node-fetch is being used because it is the last version that can still be imported as a CommonJS module. Later versions are published as ESM which is problematic for CommonJS clients. This PR updates node-fetch and integrates it using the following approach: 1. Use import type where only type declarations are required 2. Using an ugly workaround to asynchronously import the fetch function (see loadNodeFetch.ts). Essentially, eval is used via new Function(...) to stop the TypeScript compiler from replacing an asynchronous import(...) expression. Unfortunately I am unable to run all tests right now. My main development setup is running Linux and my Windows VM is not part of an domain, making testing the server side code rather difficult. I was able to test the client side SSO flow manually: it appears to work well. ------------------------------ You can view, comment on, or merge this pull request online at: #141 Commit Summary - 4ea175d <4ea175d> Update node fetch and load it using a workaround File Changes (8 files <https://github.com/jlguenego/node-expose-sspi/pull/141/files>) - *M* package-lock.json <https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-053150b640a7ce75eff69d1a22cae7f0f94ad64ce9a855db544dda0929316519> (74) - *M* package.json <https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519> (3) - *M* src/sso/client/AbstractHandler.ts <https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-128296bcece02f590ffd4cb4e2c878c3bcdb3a73c85bcef706f7ec7e97d870ee> (2) - *M* src/sso/client/BasicHandler.ts <https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-69b37a3e40e5bbb3a399b2040ec4cfe63ebbb7a83ed9752d4f0e0555ce675160> (4) - *M* src/sso/client/ClientCookie.ts <https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-b764c4fb31b99578660eb38759bd52b03564126cec5786868007307d11de0490> (2) - *M* src/sso/client/DigestHandler.ts <https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-464677d18972e0b35b1ed518110f5c29c2a5f0e04da1784522071608a3da507d> (10) - *M* src/sso/client/NegotiateHandler.ts <https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-abdeeacb64efe26bf8fbd6c0973e07b7375a9b836795fdf00065306cf9f9f153> (4) - *A* src/sso/loadNodeFetch.ts <https://github.com/jlguenego/node-expose-sspi/pull/141/files#diff-7d79a88eab22bdc6e85f50d9677f92b6e416debbeaf1b05656b86209bc9f0ed2> (29) Patch Links: - https://github.com/jlguenego/node-expose-sspi/pull/141.patch - https://github.com/jlguenego/node-expose-sspi/pull/141.diff — Reply to this email directly, view it on GitHub <#141>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAVV6TWHK5U3HLHPHNPD6Z3VDLVE3ANCNFSM5SPRJWKQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

-- Jean-Louis GUENEGO Tel : +33 6 12 19 81 48 mail: ***@***.***

[bdinesh]

Hello,

When I use sso Client fetch method (in NodeJS 20.x), I'm seeing an error TypeError [ERR_INVALID_THIS]: Value of "this" must be of type URLSearchParams in node-fetch package. Looks like this issue is fixed in node-fetch v3.2 package. Is there any plan to update the dependencies of node-expose-sspi package to make it compatible with NodeJS v20?