chore: Upgrade axios to 1.6.0 to resolve CVE-2023-45857 (#115)

newrelic · Oct 27, 2023 · 1116c6b · 1116c6b
1 parent 2e4a2e0
commit 1116c6b
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 6 deletions.
diff --git a/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js b/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js
@@ -180,7 +180,10 @@ function handleFuzzResponse(response, fuzzDetails) {
  */
 function parseAxiosHttpRequestToFuzz(requestObject) {
     let serverName = requestObject.serverName ? requestObject.serverName : LOCALHOST;
-    let host = serverName + COLON + requestObject.serverPort
+    let host = serverName + COLON + requestObject.serverPort;
+    if(requestObject.headers && requestObject.headers['content-length']){
+        delete requestObject.headers['content-length'];
+    }
     return {
         url: requestObject.protocol + COLON_SLASH_SLASH + host + requestObject.url,
         method: requestObject.method,

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -36,7 +36,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-lambda": "^3.405.0",
-    "axios": "0.21.4",
+    "axios": "1.6.0",
     "check-disk-space": "3.3.1",
     "content-type": "^1.0.5",
     "fast-safe-stringify": "^2.1.1",