Fix bugs in ip and socket.io packages to improve security and stability

[caputomarcos]

Bug 1:

Incorrect Handling of Certain Private IP Formats in ip Package The isPublic() function in the NPM package ip incorrectly identifies certain private IP addresses in uncommon formats, such as 0x7F.1, as public. This issue could lead to security vulnerabilities like Server-Side Request Forgery (SSRF) when isPublic() is used to protect sensitive code paths against user input. This commit updates the ip package to versions 1.1.9 and 2.0.1, which include a fix for this issue.

References:

CVE-2023-42282
Cosmos of Cyberspace Advisory

Related comments and commits:

JoshGlazebrook/socks#93,
github/advisory-database#3504,
indutny/node-ip#138,
indutny/node-ip@32f468f,
indutny/node-ip@6a3ada9

Bug 2:

Uncaught Exception Vulnerability in socket.io Package The socket.io package for Node.js is vulnerable to uncaught exceptions when handling error events. Without a proper listener for these events, an attacker could send specially crafted packets that trigger unhandled exceptions, potentially crashing the Node process. This commit upgrades the socket.io package to versions 2.5.1, 4.6.2, or higher, which include fixes for this vulnerability.

[unocelli]

Hi, Interesting PR, why did you close it?

[caputomarcos]

Hi @unocelli, I closed the PR because the fuxa stopped working correctly after the socketio update. Specifically, the connection between the front and back ends gets lost after some time. I’ll keep the bug open so we can work on a solution together. best regards!