The npm package "cookie" offers functionalities for parsing and serializing HTTP server cookies, crucial for managing user sessions and preferences in web applications. Version 0.6.0, released in November 2023, represents an evolution over the previous stable version 0.5.0, which was released in April 2022. Both versions share the same core purpose and MIT license, ensuring developers have the freedom to integrate them into various projects. They also maintain the same author and repository.
Key differences lie primarily in the development dependencies. Version 0.6.0 upgrades several tools, most notably eslint from version 7.32.0 to 8.53.0 and mocha from 9.2.2 to 10.2.0. These updates suggest improvements in code linting and testing capabilities, potentially leading to more robust and maintainable code within the "cookie" package itself. The top-sites dependency also sees an update from 1.1.97 to 1.1.194, but the impact on the library's functionality is unclear. The size of the unpacked package has slightly increased, too.
For developers using the library, these dependency upgrades signify a commitment to modern development practices. While the core API for parsing and serializing cookies likely remains consistent, the updated tooling points to improved code quality and potentially enhanced security measures. Therefore, upgrading to version 0.6.0 is recommended to benefit from these improvements. Developers relying on older tooling chains may encounter minor compatibility issues, but the advantages of using the latest version generally outweigh any potential migration costs.
All the vulnerabilities related to the version 0.6.0 of the package
cookie accepts cookie name, path, and domain with out of bounds characters
The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.
A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie.
Upgrade to 0.7.0, which updates the validation for name, path, and domain.
Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.
