From 26d10f70178ff8fdfe1e40b4da2cb780b83b4460 Mon Sep 17 00:00:00 2001 From: Julio Araujo Date: Thu, 23 Apr 2026 15:21:23 +0200 Subject: [PATCH] chore(deps): bump xmldom and related deps (#40270) --- .../update-version-durability/package.json | 2 +- .../server/lib/parsers/Response.ts | 6 +- apps/meteor/package.json | 2 +- package.json | 4 +- yarn.lock | 199 ++++++++++++++++-- 5 files changed, 188 insertions(+), 25 deletions(-) diff --git a/.github/actions/update-version-durability/package.json b/.github/actions/update-version-durability/package.json index 6c325f04320f2..ba7dee8a6c92d 100644 --- a/.github/actions/update-version-durability/package.json +++ b/.github/actions/update-version-durability/package.json @@ -16,6 +16,6 @@ "colors": "^1.4.0", "diff": "^5.1.0", "semver": "^7.5.4", - "@xmldom/xmldom": "^0.8.10" + "@xmldom/xmldom": "^0.8.13" } } diff --git a/apps/meteor/app/meteor-accounts-saml/server/lib/parsers/Response.ts b/apps/meteor/app/meteor-accounts-saml/server/lib/parsers/Response.ts index 87aeb4ad9f6c8..f4363278b3d6b 100644 --- a/apps/meteor/app/meteor-accounts-saml/server/lib/parsers/Response.ts +++ b/apps/meteor/app/meteor-accounts-saml/server/lib/parsers/Response.ts @@ -208,7 +208,9 @@ export class ResponseParser { let newXml = null; if (typeof encAssertion !== 'undefined') { - const options = { key: this.serviceProviderOptions.privateKey }; + // disallowDecryptionWithInsecureAlgorithm defaults to true in xml-encryption v4, but AES-CBC/3DES + // are still widely used by SAML IdPs in practice, so we keep the pre-v4 behaviour here. + const options = { key: this.serviceProviderOptions.privateKey, disallowDecryptionWithInsecureAlgorithm: false }; const encData = encAssertion.getElementsByTagNameNS('*', 'EncryptedData')[0]; xmlenc.decrypt(encData, options, (err, result) => { if (err) { @@ -350,7 +352,7 @@ export class ResponseParser { const encSubject = assertion.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'EncryptedID')[0]; if (typeof encSubject !== 'undefined') { - const options = { key: this.serviceProviderOptions.privateKey }; + const options = { key: this.serviceProviderOptions.privateKey, disallowDecryptionWithInsecureAlgorithm: false }; xmlenc.decrypt(encSubject.getElementsByTagNameNS('*', 'EncryptedData')[0], options, (err, result) => { if (err) { SAMLUtils.error({ err }); diff --git a/apps/meteor/package.json b/apps/meteor/package.json index 5a0548dcb9fc5..3bc8d9825567d 100644 --- a/apps/meteor/package.json +++ b/apps/meteor/package.json @@ -300,7 +300,7 @@ "universal-perf-hooks": "^1.0.1", "webdav": "^4.11.5", "xml-crypto": "~3.2.1", - "xml-encryption": "~3.1.0", + "xml-encryption": "~4.0.0", "xml2js": "~0.6.2", "yaqrcode": "^0.2.1", "zod": "~4.3.6", diff --git a/package.json b/package.json index 93c586a99614c..590453560c26a 100644 --- a/package.json +++ b/package.json @@ -55,7 +55,9 @@ "lodash": "4.17.21", "minimist": "1.2.6", "mongodb": "6.10.0", - "underscore": "1.13.7" + "underscore": "1.13.7", + "xml-crypto/@xmldom/xmldom": "0.8.13", + "xml-encryption/@xmldom/xmldom": "0.8.13" }, "dependencies": { "@types/stream-buffers": "^3.0.8", diff --git a/yarn.lock b/yarn.lock index d88bc8a06ef6d..4e2fe6ac0ed14 100644 --- a/yarn.lock +++ b/yarn.lock @@ -7715,7 +7715,16 @@ __metadata: languageName: node linkType: hard -"@react-types/shared@npm:^3.0.0-nightly-fb28ab3b4-241024, @react-types/shared@npm:^3.14.1, @react-types/shared@npm:^3.27.0": +"@react-types/shared@npm:^3.0.0-nightly-fb28ab3b4-241024": + version: 3.34.0 + resolution: "@react-types/shared@npm:3.34.0" + peerDependencies: + react: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1 + checksum: 10/d28b0a3a3f68f94167fd7b4f474803430093b1a31f5f50cef6ddd755b923ba3af35dde40ffcc1f320926892744823a039b4a396c671f7c59aa49634811f0c43a + languageName: node + linkType: hard + +"@react-types/shared@npm:^3.14.1, @react-types/shared@npm:^3.27.0": version: 3.27.0 resolution: "@react-types/shared@npm:3.27.0" peerDependencies: @@ -9336,7 +9345,7 @@ __metadata: webdav: "npm:^4.11.5" webpack: "npm:~5.99.9" xml-crypto: "npm:~3.2.1" - xml-encryption: "npm:~3.1.0" + xml-encryption: "npm:~4.0.0" xml2js: "npm:~0.6.2" yaqrcode: "npm:^0.2.1" zod: "npm:~4.3.6" @@ -10437,7 +10446,7 @@ __metadata: peerDependencies: "@rocket.chat/layout": "*" "@rocket.chat/tools": 0.2.4 - "@rocket.chat/ui-contexts": 28.0.1 + "@rocket.chat/ui-contexts": 28.0.2 "@tanstack/react-query": "*" react: "*" react-hook-form: "*" @@ -14612,10 +14621,10 @@ __metadata: languageName: node linkType: hard -"@xmldom/xmldom@npm:^0.8.5, @xmldom/xmldom@npm:^0.8.8": - version: 0.8.10 - resolution: "@xmldom/xmldom@npm:0.8.10" - checksum: 10/62400bc5e0e75b90650e33a5ceeb8d94829dd11f9b260962b71a784cd014ddccec3e603fe788af9c1e839fa4648d8c521ebd80d8b752878d3a40edabc9ce7ccf +"@xmldom/xmldom@npm:0.8.13": + version: 0.8.13 + resolution: "@xmldom/xmldom@npm:0.8.13" + checksum: 10/f8f3d56fa91d5026885c0c5c00b07eae47647bda0d742ecbf8e51e06bb287ab30222977b20529ee15c364031606225ebca58907a8ecc76a3add6b3f10e6ddfc6 languageName: node linkType: hard @@ -16550,7 +16559,7 @@ __metadata: languageName: node linkType: hard -"buffer-equal-constant-time@npm:1.0.1": +"buffer-equal-constant-time@npm:1.0.1, buffer-equal-constant-time@npm:^1.0.1": version: 1.0.1 resolution: "buffer-equal-constant-time@npm:1.0.1" checksum: 10/80bb945f5d782a56f374b292770901065bad21420e34936ecbe949e57724b4a13874f735850dd1cc61f078773c4fb5493a41391e7bda40d1fa388d6bd80daaab @@ -18037,7 +18046,7 @@ __metadata: languageName: node linkType: hard -"cross-fetch@npm:^3.0.4, cross-fetch@npm:^3.1.5": +"cross-fetch@npm:^3.0.4": version: 3.1.6 resolution: "cross-fetch@npm:3.1.6" dependencies: @@ -18046,6 +18055,15 @@ __metadata: languageName: node linkType: hard +"cross-fetch@npm:^3.1.5": + version: 3.2.0 + resolution: "cross-fetch@npm:3.2.0" + dependencies: + node-fetch: "npm:^2.7.0" + checksum: 10/e4ab1d390a5b6ca8bb0605f028af2ffc1127d2e407b954654949f506d04873c4863ece264662c074865d7874060e35f938cec74fe7b5736d46d545e2685f6aec + languageName: node + linkType: hard + "cross-spawn@npm:7.0.6": version: 7.0.6 resolution: "cross-spawn@npm:7.0.6" @@ -19877,7 +19895,69 @@ __metadata: languageName: node linkType: hard -"es-abstract@npm:^1.17.5, es-abstract@npm:^1.19.1, es-abstract@npm:^1.22.1, es-abstract@npm:^1.23.2, es-abstract@npm:^1.23.3, es-abstract@npm:^1.23.5, es-abstract@npm:^1.23.6, es-abstract@npm:^1.23.9": +"es-abstract@npm:^1.17.5": + version: 1.24.1 + resolution: "es-abstract@npm:1.24.1" + dependencies: + array-buffer-byte-length: "npm:^1.0.2" + arraybuffer.prototype.slice: "npm:^1.0.4" + available-typed-arrays: "npm:^1.0.7" + call-bind: "npm:^1.0.8" + call-bound: "npm:^1.0.4" + data-view-buffer: "npm:^1.0.2" + data-view-byte-length: "npm:^1.0.2" + data-view-byte-offset: "npm:^1.0.1" + es-define-property: "npm:^1.0.1" + es-errors: "npm:^1.3.0" + es-object-atoms: "npm:^1.1.1" + es-set-tostringtag: "npm:^2.1.0" + es-to-primitive: "npm:^1.3.0" + function.prototype.name: "npm:^1.1.8" + get-intrinsic: "npm:^1.3.0" + get-proto: "npm:^1.0.1" + get-symbol-description: "npm:^1.1.0" + globalthis: "npm:^1.0.4" + gopd: "npm:^1.2.0" + has-property-descriptors: "npm:^1.0.2" + has-proto: "npm:^1.2.0" + has-symbols: "npm:^1.1.0" + hasown: "npm:^2.0.2" + internal-slot: "npm:^1.1.0" + is-array-buffer: "npm:^3.0.5" + is-callable: "npm:^1.2.7" + is-data-view: "npm:^1.0.2" + is-negative-zero: "npm:^2.0.3" + is-regex: "npm:^1.2.1" + is-set: "npm:^2.0.3" + is-shared-array-buffer: "npm:^1.0.4" + is-string: "npm:^1.1.1" + is-typed-array: "npm:^1.1.15" + is-weakref: "npm:^1.1.1" + math-intrinsics: "npm:^1.1.0" + object-inspect: "npm:^1.13.4" + object-keys: "npm:^1.1.1" + object.assign: "npm:^4.1.7" + own-keys: "npm:^1.0.1" + regexp.prototype.flags: "npm:^1.5.4" + safe-array-concat: "npm:^1.1.3" + safe-push-apply: "npm:^1.0.0" + safe-regex-test: "npm:^1.1.0" + set-proto: "npm:^1.0.0" + stop-iteration-iterator: "npm:^1.1.0" + string.prototype.trim: "npm:^1.2.10" + string.prototype.trimend: "npm:^1.0.9" + string.prototype.trimstart: "npm:^1.0.8" + typed-array-buffer: "npm:^1.0.3" + typed-array-byte-length: "npm:^1.0.3" + typed-array-byte-offset: "npm:^1.0.4" + typed-array-length: "npm:^1.0.7" + unbox-primitive: "npm:^1.1.0" + which-typed-array: "npm:^1.1.19" + checksum: 10/c84cb69ebae36781309a3ed70ff40b4767a921d3b3518060fac4e08f14ede04491b68e9f318aedf186e349d4af4a40f5d0e4111e46513800e8368551fd09de8c + languageName: node + linkType: hard + +"es-abstract@npm:^1.19.1, es-abstract@npm:^1.22.1, es-abstract@npm:^1.23.2, es-abstract@npm:^1.23.3, es-abstract@npm:^1.23.5, es-abstract@npm:^1.23.6, es-abstract@npm:^1.23.9": version: 1.23.9 resolution: "es-abstract@npm:1.23.9" dependencies: @@ -21651,6 +21731,15 @@ __metadata: languageName: node linkType: hard +"for-each@npm:^0.3.5": + version: 0.3.5 + resolution: "for-each@npm:0.3.5" + dependencies: + is-callable: "npm:^1.2.7" + checksum: 10/330cc2439f85c94f4609de3ee1d32c5693ae15cdd7fe3d112c4fd9efd4ce7143f2c64ef6c2c9e0cfdb0058437f33ef05b5bdae5b98fcc903fb2143fbaf0fea0f + languageName: node + linkType: hard + "foreground-child@npm:^2.0.0": version: 2.0.0 resolution: "foreground-child@npm:2.0.0" @@ -23824,6 +23913,13 @@ __metadata: languageName: node linkType: hard +"is-negative-zero@npm:^2.0.3": + version: 2.0.3 + resolution: "is-negative-zero@npm:2.0.3" + checksum: 10/8fe5cffd8d4fb2ec7b49d657e1691889778d037494c6f40f4d1a524cadd658b4b53ad7b6b73a59bcb4b143ae9a3d15829af864b2c0f9d65ac1e678c4c80f17e5 + languageName: node + linkType: hard + "is-network-error@npm:^1.0.0": version: 1.1.0 resolution: "is-network-error@npm:1.1.0" @@ -24038,7 +24134,7 @@ __metadata: languageName: node linkType: hard -"is-weakref@npm:^1.0.2, is-weakref@npm:^1.1.0": +"is-weakref@npm:^1.0.2, is-weakref@npm:^1.1.0, is-weakref@npm:^1.1.1": version: 1.1.1 resolution: "is-weakref@npm:1.1.1" dependencies: @@ -25758,7 +25854,7 @@ __metadata: languageName: node linkType: hard -"jsonwebtoken@npm:9.0.2, jsonwebtoken@npm:^9.0.0, jsonwebtoken@npm:^9.0.2": +"jsonwebtoken@npm:9.0.2, jsonwebtoken@npm:^9.0.0": version: 9.0.2 resolution: "jsonwebtoken@npm:9.0.2" dependencies: @@ -25776,6 +25872,24 @@ __metadata: languageName: node linkType: hard +"jsonwebtoken@npm:^9.0.2": + version: 9.0.3 + resolution: "jsonwebtoken@npm:9.0.3" + dependencies: + jws: "npm:^4.0.1" + lodash.includes: "npm:^4.3.0" + lodash.isboolean: "npm:^3.0.3" + lodash.isinteger: "npm:^4.0.4" + lodash.isnumber: "npm:^3.0.3" + lodash.isplainobject: "npm:^4.0.6" + lodash.isstring: "npm:^4.0.1" + lodash.once: "npm:^4.0.0" + ms: "npm:^2.1.1" + semver: "npm:^7.5.4" + checksum: 10/a67a276db41fbfb458ebdc4938d5d7b01d4743e16bda0f25ac01996fe5b5819d66656153f6cfce19b4680b79ae9f9ca185965defc22e77e0abddf443573238d6 + languageName: node + linkType: hard + "jsprim@npm:^1.2.2": version: 1.4.2 resolution: "jsprim@npm:1.4.2" @@ -25851,6 +25965,17 @@ __metadata: languageName: node linkType: hard +"jwa@npm:^2.0.1": + version: 2.0.1 + resolution: "jwa@npm:2.0.1" + dependencies: + buffer-equal-constant-time: "npm:^1.0.1" + ecdsa-sig-formatter: "npm:1.0.11" + safe-buffer: "npm:^5.0.1" + checksum: 10/b04312a1de85f912b96aa3a7211717b8336945fab5b4f7cbc7800f4c80934060c0a3111576fad8d76e41ad62887d6da4b21fd4c47e45c174197f8be7dc0c1694 + languageName: node + linkType: hard + "jws@npm:^3.2.2": version: 3.2.2 resolution: "jws@npm:3.2.2" @@ -25871,6 +25996,16 @@ __metadata: languageName: node linkType: hard +"jws@npm:^4.0.1": + version: 4.0.1 + resolution: "jws@npm:4.0.1" + dependencies: + jwa: "npm:^2.0.1" + safe-buffer: "npm:^5.0.1" + checksum: 10/75d7b157489fa9a72023712c58a7a7706c7e2b10eec27fabd3bb9cae0c9e492251ab72527d20a8a5f5726196f0508c320c643fddff7076657f6bca16d0ceeeeb + languageName: node + linkType: hard + "jwt-decode@npm:^4.0.0": version: 4.0.0 resolution: "jwt-decode@npm:4.0.0" @@ -28370,7 +28505,7 @@ __metadata: languageName: node linkType: hard -"object-inspect@npm:^1.13.3": +"object-inspect@npm:^1.13.3, object-inspect@npm:^1.13.4": version: 1.13.4 resolution: "object-inspect@npm:1.13.4" checksum: 10/aa13b1190ad3e366f6c83ad8a16ed37a19ed57d267385aa4bfdccda833d7b90465c057ff6c55d035a6b2e52c1a2295582b294217a0a3a1ae7abdd6877ef781fb @@ -30758,7 +30893,7 @@ __metadata: languageName: node linkType: hard -"qs@npm:^6.11.2, qs@npm:^6.12.3, qs@npm:^6.9.4": +"qs@npm:^6.11.2, qs@npm:^6.12.3": version: 6.14.0 resolution: "qs@npm:6.14.0" dependencies: @@ -30776,6 +30911,15 @@ __metadata: languageName: node linkType: hard +"qs@npm:^6.9.4": + version: 6.15.1 + resolution: "qs@npm:6.15.1" + dependencies: + side-channel: "npm:^1.1.0" + checksum: 10/ec10b9957446b3f4a38000940f6374720b4e2985209b89df197066038c951472ea24cd98d6bc6df73a0cbec75bc056f638032e3fb447345017ff7e0f0a2693ac + languageName: node + linkType: hard + "qs@npm:~6.5.2": version: 6.5.3 resolution: "qs@npm:6.5.3" @@ -31746,7 +31890,7 @@ __metadata: languageName: node linkType: hard -"regexp.prototype.flags@npm:^1.5.3": +"regexp.prototype.flags@npm:^1.5.3, regexp.prototype.flags@npm:^1.5.4": version: 1.5.4 resolution: "regexp.prototype.flags@npm:1.5.4" dependencies: @@ -33693,7 +33837,7 @@ __metadata: languageName: node linkType: hard -"stop-iteration-iterator@npm:^1.0.0": +"stop-iteration-iterator@npm:^1.0.0, stop-iteration-iterator@npm:^1.1.0": version: 1.1.0 resolution: "stop-iteration-iterator@npm:1.1.0" dependencies: @@ -36914,6 +37058,21 @@ __metadata: languageName: node linkType: hard +"which-typed-array@npm:^1.1.19": + version: 1.1.20 + resolution: "which-typed-array@npm:1.1.20" + dependencies: + available-typed-arrays: "npm:^1.0.7" + call-bind: "npm:^1.0.8" + call-bound: "npm:^1.0.4" + for-each: "npm:^0.3.5" + get-proto: "npm:^1.0.1" + gopd: "npm:^1.2.0" + has-tostringtag: "npm:^1.0.2" + checksum: 10/e56da3fc995d330ff012f682476f7883c16b12d36c6717c87c7ca23eb5a5ef957fa89115dacb389b11a9b4e99d5dbe2d12689b4d5d08c050b5aed0eae385b840 + languageName: node + linkType: hard + "which@npm:2.0.2, which@npm:^2.0.1": version: 2.0.2 resolution: "which@npm:2.0.2" @@ -37124,14 +37283,14 @@ __metadata: languageName: node linkType: hard -"xml-encryption@npm:~3.1.0": - version: 3.1.0 - resolution: "xml-encryption@npm:3.1.0" +"xml-encryption@npm:~4.0.0": + version: 4.0.0 + resolution: "xml-encryption@npm:4.0.0" dependencies: "@xmldom/xmldom": "npm:^0.8.5" escape-html: "npm:^1.0.3" xpath: "npm:0.0.32" - checksum: 10/c84c1e11692181c24a1c30123fed4fa31015c58994bbdcf091f07fa79f0fb809774b1533d191c4739bf76bb0fb95f223d393e84cc48417480a1896b2b689373b + checksum: 10/319f5c0c591a5600f5f6846c9b27a69e6ecd7d4a2215cfb9ffac37490143d48239652097eae6ff33a0d55f8b534c03caa09e75ee260d89d3d1bc26802c1cfc36 languageName: node linkType: hard