Socket.IO version 4.7.2 represents a minor update to the popular real-time communication library, building upon the foundation laid by version 4.7.1. Examining the package metadata reveals subtle yet important distinctions that developers should consider. The core dependencies remain largely consistent, with the exception of engine.io, which advances from version 6.5.0 in 4.7.1 to version 6.5.2 in 4.7.2. This suggests improvements or bug fixes within the underlying engine responsible for managing low-level connections. While the direct impact on developers might be minimal, this update likely enhances connection stability and performance.
From a development perspective, the devDependencies also see a change. Namely, the version of the socket.io-client has been bumped to 4.7.2 to coincide with the server-side version. This is critical for ensuring seamless compatibility when testing and developing applications using both the client and server components of socket.io.
Other, more subtle differences are visible if we compare the distribution packages. socket.io-4.7.2 presents a slightly larger unpacked size, indicating potential additions or modifications to the core library files. The release date also highlights the recency of version 4.7.2 (August 2nd, 2023) compared to 4.7.1 (June 28th, 2023), implying a focus on recent improvements and potentially addressing newly discovered issues. For developers seeking the latest enhancements and bug fixes, upgrading to 4.7.2 is the recommended path, ensuring a more robust and efficient real-time communication experience.
All the vulnerabilities related to the version 4.7.2 of the package
cookie accepts cookie name, path, and domain with out of bounds characters
The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.
A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie.
Upgrade to 0.7.0, which updates the validation for name, path, and domain.
Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.
