Merge pull request #269 from auth0/fix/snyk-medium-vulnerabilities

harishsundar-okta · web-flow · commit ac22b344b31f · 2026-05-18T11:46:38.000+05:30
chore(core, react): fix snyk medium vulnerabilities
diff --git a/README.md b/README.md
@@ -69,10 +69,10 @@ function SettingsPage() {
 
 ## Packages
 
-| Package                                                | Description                                           |
-| ------------------------------------------------------ | ----------------------------------------------------- |
-| [@auth0/universal-components-react](./packages/react/) | React components with `/spa` and `/rwa` entry points  |
-| [@auth0/universal-components-core](./packages/core/)   | Framework-agnostic core utilities, services, and i18n |
+| Package                                                         | Description                                           |
+| --------------------------------------------------------------- | ----------------------------------------------------- |
+| [@auth0/universal-components-react](./packages/react/README.md) | React components with `/spa` and `/rwa` entry points  |
+| [@auth0/universal-components-core](./packages/core/README.md)   | Framework-agnostic core utilities, services, and i18n |
 
 ## Feedback
 
diff --git a/docs-site/api/r.ts b/docs-site/api/r.ts
@@ -3,6 +3,32 @@ import path from 'path';
 
 import type { VercelRequest, VercelResponse } from '@vercel/node';
 
+const RATE_LIMIT_WINDOW_MS = 60 * 1000; // 1 minute
+const RATE_LIMIT_MAX = 60;
+const rateLimitMap = new Map<string, { count: number; resetTime: number }>();
+
+function pruneExpiredRateLimitEntries(now: number): void {
+  for (const [ip, entry] of rateLimitMap.entries()) {
+    if (now > entry.resetTime) {
+      rateLimitMap.delete(ip);
+    }
+  }
+}
+
+function isRateLimited(ip: string): boolean {
+  const now = Date.now();
+  pruneExpiredRateLimitEntries(now);
+  const entry = rateLimitMap.get(ip);
+
+  if (!entry || now > entry.resetTime) {
+    rateLimitMap.set(ip, { count: 1, resetTime: now + RATE_LIMIT_WINDOW_MS });
+    return false;
+  }
+
+  entry.count++;
+  return entry.count > RATE_LIMIT_MAX;
+}
+
 interface VersionInfo {
   latest: string;
   majorVersions?: Record<string, { latest: string }>;
@@ -54,6 +80,11 @@ function sendJson(res: VercelResponse, content: string): void {
 }
 
 export default function handler(req: VercelRequest, res: VercelResponse) {
+  const clientIp = (req.headers['x-forwarded-for'] as string)?.split(',')[0]?.trim() || 'unknown';
+  if (isRateLimited(clientIp)) {
+    return res.status(429).json({ error: 'Too Many Requests', message: 'Rate limit exceeded' });
+  }
+
   const { file } = req.query;
   const fileName = Array.isArray(file) ? file.join('/') : file || '';
 
@@ -68,14 +99,15 @@ export default function handler(req: VercelRequest, res: VercelResponse) {
 
   const basePath = getBasePath();
   const versionInfo = getVersionInfo(basePath);
-  const versionParam = req.query.version as string | undefined;
+  const rawVersionParam = req.query.version;
+  const versionParam = typeof rawVersionParam === 'string' ? rawVersionParam : undefined;
 
   const rootFilePath = path.join(basePath, normalizedFileName);
   if (!versionParam && fs.existsSync(rootFilePath)) {
     try {
       sendJson(res, fs.readFileSync(rootFilePath, 'utf-8'));
     } catch (error) {
-      console.error(`Failed to read registry file ${rootFilePath}:`, error);
+      console.error('Failed to read registry file: %s', rootFilePath);
       res
         .status(500)
         .json({ error: 'Internal Server Error', message: 'Failed to read registry file' });
@@ -121,7 +153,7 @@ export default function handler(req: VercelRequest, res: VercelResponse) {
     try {
       sendJson(res, fs.readFileSync(versionedPath, 'utf-8'));
     } catch (error) {
-      console.error(`Failed to read registry file ${versionedPath}:`, error);
+      console.error('Failed to read registry file: %s', versionedPath);
       res
         .status(500)
         .json({ error: 'Internal Server Error', message: 'Failed to read registry file' });
diff --git a/docs-site/package.json b/docs-site/package.json
@@ -25,7 +25,7 @@
     "clsx": "^2.1.1",
     "lucide-react": "^0.462.0",
     "next-themes": "^0.2.1",
-    "postcss": "^8.5.6",
+    "postcss": "^8.5.14",
     "prismjs": "^1.30.0",
     "react": "^19.2.1",
     "react-dom": "^19.2.1",
@@ -41,6 +41,6 @@
     "@types/react-syntax-highlighter": "^15.5.13",
     "globals": "^15.9.0",
     "typescript": "^5.9.3",
-    "vite": "^7.2.4"
+    "vite": "^7.3.2"
   }
 }
diff --git a/docs-site/src/api/registry-middleware.ts b/docs-site/src/api/registry-middleware.ts
@@ -3,6 +3,32 @@ import path from 'path';
 
 import type { Plugin } from 'vite';
 
+const RATE_LIMIT_WINDOW_MS = 60 * 1000;
+const RATE_LIMIT_MAX = 60;
+const rateLimitMap = new Map<string, { count: number; resetTime: number }>();
+
+function pruneExpiredRateLimitEntries(now: number): void {
+  for (const [ip, entry] of rateLimitMap.entries()) {
+    if (now > entry.resetTime) {
+      rateLimitMap.delete(ip);
+    }
+  }
+}
+
+function isRateLimited(ip: string): boolean {
+  const now = Date.now();
+  pruneExpiredRateLimitEntries(now);
+  const entry = rateLimitMap.get(ip);
+
+  if (!entry || now > entry.resetTime) {
+    rateLimitMap.set(ip, { count: 1, resetTime: now + RATE_LIMIT_WINDOW_MS });
+    return false;
+  }
+
+  entry.count++;
+  return entry.count > RATE_LIMIT_MAX;
+}
+
 interface VersionInfo {
   latest: string;
   majorVersions?: Record<string, { latest: string }>;
@@ -38,6 +64,17 @@ export function registryMiddleware(): Plugin {
           return next();
         }
 
+        const clientIp =
+          (req.headers['x-forwarded-for'] as string)?.split(',')[0]?.trim() ||
+          req.socket.remoteAddress ||
+          'unknown';
+        if (isRateLimited(clientIp)) {
+          res.statusCode = 429;
+          res.setHeader('Content-Type', 'application/json');
+          res.end(JSON.stringify({ error: 'Too Many Requests' }));
+          return;
+        }
+
         const url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
         const fileName = url.pathname.replace(/^\/r\//, '');
 
diff --git a/docs-site/src/components/ui/sidebar.tsx b/docs-site/src/components/ui/sidebar.tsx
@@ -78,7 +78,7 @@ function SidebarProvider({
       }
 
       // This sets the cookie to keep the sidebar state.
-      document.cookie = `${SIDEBAR_COOKIE_NAME}=${openState}; path=/; max-age=${SIDEBAR_COOKIE_MAX_AGE}`;
+      document.cookie = `${SIDEBAR_COOKIE_NAME}=${openState}; path=/; max-age=${SIDEBAR_COOKIE_MAX_AGE}; secure; samesite=lax`;
     },
     [setOpenProp, open],
   );
diff --git a/examples/next-rwa/package.json b/examples/next-rwa/package.json
@@ -10,7 +10,7 @@
     "lint": "next lint"
   },
   "dependencies": {
-    "@auth0/nextjs-auth0": "^4.16.0",
+    "@auth0/nextjs-auth0": "^4.20.0",
     "@auth0/universal-components-react": "workspace:*",
     "@radix-ui/react-slot": "^1.2.3",
     "@tailwindcss/postcss": "^4.1.17",
@@ -21,7 +21,7 @@
     "lucide-react": "^0.511.0",
     "next": "16.1.5",
     "ora": "^8.0.1",
-    "postcss": "^8.5.5",
+    "postcss": "^8.5.14",
     "radix-ui": "^1.4.3",
     "react": "^19.2.1",
     "react-dom": "^19.2.1",
diff --git a/packages/react/package.json b/packages/react/package.json
@@ -113,7 +113,7 @@
     "@testing-library/user-event": "^14.6.1",
     "@types/react": "^19.1.2",
     "@types/react-dom": "^19.1.2",
-    "postcss": "^8.5.6",
+    "postcss": "^8.5.14",
     "postcss-cli": "^11.0.1",
     "react-hook-form": "^7.57.0",
     "rimraf": "^5.0.0",
diff --git a/packages/react/src/components/ui/image-preview-field.tsx b/packages/react/src/components/ui/image-preview-field.tsx
@@ -77,6 +77,7 @@ function ImagePreviewField({
 
   const hasError = error || (!isValidUrl && imageUrl.trim() !== '') || imageError;
   const showPreview = imageUrl.trim() !== '' && isValidUrl && !imageError;
+  const sanitizedImageUrl = showPreview ? encodeURI(imageUrl) : '';
 
   return (
     <div className="space-y-2">
@@ -90,8 +91,8 @@ function ImagePreviewField({
         {showPreview ? (
           <img
             loading="lazy"
-            srcSet={imageUrl}
-            src={imageUrl}
+            srcSet={sanitizedImageUrl}
+            src={sanitizedImageUrl}
             sizes={imgSizes}
             decoding="async"
             alt="Preview"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml

Original file line number	Diff line number	Diff line change
`@@ -78,7 +78,7 @@ function SidebarProvider({`
`78`	`78`	`}`
`79`	`79`
`80`	`80`	`// This sets the cookie to keep the sidebar state.`
`81`		- document.cookie = `${SIDEBAR_COOKIE_NAME}=${openState}; path=/; max-age=${SIDEBAR_COOKIE_MAX_AGE}`;
	`81`	+ document.cookie = `${SIDEBAR_COOKIE_NAME}=${openState}; path=/; max-age=${SIDEBAR_COOKIE_MAX_AGE}; secure; samesite=lax`;
`82`	`82`	`},`
`83`	`83`	`[setOpenProp, open],`
`84`	`84`	`);`