Version 0.7.0 of typed-rest-client, released on January 9, 2017, offers a robust solution for making REST and HTTP calls within Node.js applications, particularly those written in TypeScript. Designed by Microsoft, this version builds upon the foundation of previous iterations, providing developers with strongly-typed clients that enhance code maintainability and reduce runtime errors. A notable aspect of the package is its dependency on "tunnel" version 0.0.4, potentially offering secure and configurable tunneling capabilities for specific network configurations. The inclusion of "underscore" version 1.8.3 suggests the package utilizes some functional programming utilities for data manipulation, possibly simplifying common tasks.
Compared to the unspecified previous stable version, users should consider potential API changes or performance improvements that may have been introduced with the 0.7.0 release. For developers using TypeScript, This ensures you have access to the latest type definitions and features. The developer dependencies, including "shelljs" 0.7.0 and "typescript" 2.1.4, highlight the tools used for building and testing the client, this assures that the package is being actively maintained and utilizes modern toolchains. Given its MIT license, the typed-rest-client in version 0.7.0 is readily usable in a wide array of projects, both commercial and open-source. By leveraging the typed-rest-client, developers can create cleaner, more reliable, and easier-to-maintain code when interacting with RESTful APIs.
All the vulnerabilities related to the version 0.7.0 of the package
Potential leak of authentication data to 3rd parties
Users of typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties.
The flow of the vulnerability is as follows:
BasicCredentialHandler, BearerCredentialHandler or PersonalAccessTokenCredentialHandlerAuthorization header.The expected behavior is that the next request will NOT set the Authorization header.
The problem was fixed on April 1st 2020.
There is no workaround.
This is similar to the following issues in nature:
Arbitrary Code Execution in underscore
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.