Bump socket.io-parser from 4.0.4 to 4.0.5 in /research-hub-web

[dependabot]

Bumps socket.io-parser from 4.0.4 to 4.0.5.

Release notes

Sourced from socket.io-parser's releases.

4.0.5

Bug Fixes

• check the format of the index of each attachment (b559f05)

Links

• Diff: socketio/socket.io-parser@4.0.4...4.0.5
• Branch: 4.0.x

Changelog

Sourced from socket.io-parser's changelog.

4.0.5 (2022-06-27)

Bug Fixes

• check the format of the index of each attachment (b559f05)

4.2.0 (2022-04-17)

Features

• allow the usage of custom replacer and reviver (#112) (b08bc1a)

4.1.2 (2022-02-17)

Bug Fixes

• allow objects with a null prototype in binary packets (#114) (7f6b262)

4.1.1 (2021-10-14)

4.1.0 (2021-10-11)

Features

• provide an ESM build with and without debug (388c616)

Commits

• f3329eb chore(release): 4.0.5
• b559f05 fix: check the format of the index of each attachment
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

To fix this, we should explicitly declare minimal GITHUB_TOKEN permissions for the workflow. Since the job only checks out the repository and runs Node/Angular tooling, it only requires read access to repository contents. The recommended minimal starting point from CodeQL is permissions: { contents: read }.

The best fix without changing existing functionality is to add a permissions block at the workflow root (top level, alongside name: and on:). This will apply to all jobs in this workflow, including run-linters, and restrict the GITHUB_TOKEN to read-only repository contents. No additional scopes (like pull-requests or issues) are needed based on the provided steps.

Concretely:

• Edit .github/workflows/linting.yml.
• Insert a new permissions: section after name: Lint (line 1) and before on: (line 3).
• Set contents: read as the only permission.

No imports, methods, or other definitions are required since this is purely a YAML workflow configuration change.

In general, you fix this by explicitly setting a permissions: block to restrict the default GITHUB_TOKEN for the workflow or for each job. Start with minimal read-only access (e.g., contents: read) and only add additional scopes if the workflow or its actions truly require them.

For this specific workflow, the simplest and safest change without altering existing behavior is to add a workflow-level permissions: block granting read-only access to repository contents. There is no evidence in the snippet that any step needs write permission to the repo, issues, or pull requests. Place the permissions block near the top of the file (after name: and before on:) so it applies to all jobs, including sentry-release. No imports or other definitions are required; this is purely a YAML configuration change in .github/workflows/sentry.yml.

Concretely: in .github/workflows/sentry.yml, insert

permissions:
  contents: read

after line 1 (name: Sentry Release). No other lines need modification.

In general, to fix log injection issues, any user-controlled data should be sanitized before being interpolated into log messages. For plain-text logs, this typically means stripping or replacing newline and carriage-return characters and optionally truncating very long input. It is also useful to clearly delimit or quote user input in the log message so it cannot be confused with log syntax.

For this specific file (hub-search-proxy/handler.js), the best fix is to sanitize event.body before logging it. We can do that locally inside the search handler without changing behavior elsewhere. Right before the console.log call, introduce a local variable, e.g. safeBody, which is derived from event.body by converting it to a string and removing \r and \n. Then log that sanitized value instead of event.body. This preserves the information content of the body (minus newlines) for debugging while preventing an attacker from injecting extra log lines. No additional imports are needed; we can rely on built-in String methods and a simple regular expression.

Concretely:

• In hub-search-proxy/handler.js, within module.exports.search, around line 53:
  • Replace console.log(Received query: ${event.body}); with a two-line sequence:
    • First, define const safeBody = String(event.body).replace(/[\r\n]/g, '');
    • Then, log safeBody instead of event.body.
• No other regions of the file need modification, since this is the only flagged use.